roblox-development-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Roblox DataModel, including game scripts and object metadata, which could contain instructions intended to influence the agent. The skill includes specific directives for the agent to review external scripts before execution and establishes clear boundaries between different execution contexts to minimize this risk.
- [DYNAMIC_EXECUTION]: The skill uses the
execute_luautool to run diagnostic probes within the Roblox Studio environment. These probes are used to gather project metadata and UI layout information. This activity is restricted to the connected Studio session and is accompanied by instructions to yield the main thread appropriately. - [COMMAND_EXECUTION]: Node.js scripts are provided for managing local project documentation. These scripts include security controls such as project root validation and checks for symbolic links to prevent directory traversal or link-based attacks.
- [DATA_EXPOSURE]: The skill provides explicit architectural guidelines to prevent the storage of sensitive information, such as credentials or private player data, in shared or replicated storage locations.
Audit Metadata