roblox-studio-mcp
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Provides the
execute_luautool for running code directly within Roblox Studio. This allows the agent to manipulate the game's data model, create instances, and modify behavior as intended by the developer. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its ability to read and process external data from the Roblox environment.
- Ingestion points: Content is ingested via
script_read,script_search,script_grep, andsearch_game_treefrom the Roblox place file. - Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading script sources.
- Capability inventory: The agent can execute code (
execute_luau) and modify files (multi_edit) within the Studio environment. - Sanitization: No specific sanitization or validation logic is defined for data read from the game hierarchy or scripts.
Audit Metadata