roblox-data

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references external documentation and README files from official Roblox sources and the community-standard ProfileStore library hosted on GitHub. These links are provided for developer reference and do not involve automated script downloads or execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a design pattern for handling external player data which may be influenced by client actions.
  • Ingestion points: Data is ingested from persistent storage via store:GetAsync and ProfileStore:StartSessionAsync in references/full.md.
  • Boundary markers: The skill explicitly instructs developers to handle failed loads by preventing default data overwrites and using session locks to prevent concurrent mutations.
  • Capability inventory: The logic utilizes standard Roblox services for data persistence, session management, and player lifecycle control (e.g., Kick).
  • Sanitization: The instructions mandate strict validation of numbers (checking for NaN and infinity) and strings (verifying UTF-8 validity) before any data is written to the store, mitigating potential data corruption or injection attacks within the storage schema.
  • [COMMAND_EXECUTION]: The provided Luau scripts utilize legitimate Roblox engine APIs (such as DataStoreService and MessagingService) for their intended game development purposes. The code follows safe execution patterns, such as wrapping service calls in pcall to handle transient failures.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 06:23 AM
Security Audit — agent-trust-hub — roblox-data