roblox-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The
last_reviewedmetadata field contains a future date (2026-08-07). While this is an anomaly, it does not introduce any security risks or deceptive behavior that would impact the safety of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where the agent interacts with external Roblox APIs and webhooks. The security posture is assessed as safe based on the following:
- Ingestion points: Data enters the context via Roblox webhook notifications and user-initiated asset management tasks.
- Boundary markers: The skill instructs the agent to 'let the user choose' and 'never assume permission,' maintaining human-in-the-loop control.
- Capability inventory: The skill references external tools for asset acquisition (assets API, generate_mesh, generate_procedural_model), data persistence (data stores, ordered data stores, messaging), and ads management (Ads Manager API) but does not implement them itself.
- Sanitization: Explicit instructions are provided to verify 'roblox-signature' headers, validate paths/schemas, and reject stale deliveries.
Audit Metadata