roblox-npc-ai
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests game state data, such as player character positions and health, to inform NPC decision-making and pathfinding.
- Ingestion points: Character data and player lists are retrieved via
Players:GetPlayers()andFindFirstChildcalls within thefindNearestPlayerandcanDetectPlayerfunctions inreferences/full.md. - Boundary markers: The skill does not explicitly use boundary markers for this data, as it is processed as numerical and object-based game state rather than natural language instructions.
- Capability inventory: Capabilities are limited to Roblox engine movement functions, such as
humanoid:MoveTo()andpath:ComputeAsync(), which do not interact with the host file system or network outside the game environment. - Sanitization: Input data is used directly in mathematical checks (Magnitude, Dot product) and standard engine APIs.
- [SAFE]: The skill promotes security best practices for Roblox game development by recommending the use of Server Authority and the
SetNetworkOwner(nil)method to prevent clients from gaining unauthorized physics control over NPCs. - [SAFE]: External documentation links point to official Roblox creator domains and established developer community forums.
Audit Metadata