The runner is only as safe as the file you downloaded and the Lua you paste.

A Windows attach tool is not a browser extension. Heuristics will dislike it. That is not the same as “it mines Monero in the background,” and it is also not a promise that every script on the internet is friendly.

What a clean build should not do

It should not harvest cookies or Roblox passwords.
It should not survive reboot as a hidden service.
It should not require a cryptocurrency miner “to stay free.”

Real problems

Lookalike domains and packed installers.
Scripts that steal session cookies.
Moderation for breaking Roblox rules.

Habit: official ZIP, known Lua authors, and a spare account. False positive primer explains Defender noise.