roblox-data
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external documentation and README files from official Roblox sources and the community-standard ProfileStore library hosted on GitHub. These links are provided for developer reference and do not involve automated script downloads or execution.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a design pattern for handling external player data which may be influenced by client actions.
- Ingestion points: Data is ingested from persistent storage via
store:GetAsyncandProfileStore:StartSessionAsyncinreferences/full.md. - Boundary markers: The skill explicitly instructs developers to handle failed loads by preventing default data overwrites and using session locks to prevent concurrent mutations.
- Capability inventory: The logic utilizes standard Roblox services for data persistence, session management, and player lifecycle control (e.g.,
Kick). - Sanitization: The instructions mandate strict validation of numbers (checking for NaN and infinity) and strings (verifying UTF-8 validity) before any data is written to the store, mitigating potential data corruption or injection attacks within the storage schema.
- [COMMAND_EXECUTION]: The provided Luau scripts utilize legitimate Roblox engine APIs (such as
DataStoreServiceandMessagingService) for their intended game development purposes. The code follows safe execution patterns, such as wrapping service calls inpcallto handle transient failures.
Audit Metadata