roblox-security
installsforks
How to install roblox-security?
tabooharmony/roblox-brain/roblox-security
$npx -y skills add TabooHarmony/roblox-brain --skill roblox-securityUse when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
SKILL.md
| 1 | ## When to Load |
| 2 | |
| 3 | Load for exploit audits and hardening. Covers classic replication, opt-in Server Authority, remote abuse, economy attacks, and DataStore flows. Use `roblox-networking` for validation and rate-limit implementations. |
| 4 | |
| 5 | ## Quick Reference |
| 6 | |
| 7 | **Core:** Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model. |
| 8 | |
| 9 | ### Authority Models |
| 10 | |
| 11 | - **Classic replication:** validate client requests and custom movement against server state. Never trust client damage, currency, inventory, permissions, or positions. |
| 12 | - **Server Authority:** with `Workspace.AuthorityMode = Server` and its required settings, the server owns core simulation while clients predict and recover from misprediction. Use `BindToSimulation()`, not blanket `Heartbeat` CFrame correction. |
| 13 | - **Both:** validate attacks, purchases, teleports, dashes, permissions, and custom remotes at the server boundary. |
| 14 | |
| 15 | ### Vectors & Mitigations |
| 16 | |
| 17 | | Vector | Attack | Fix | |
| 18 | |--------|--------|-----| |
| 19 | | Movement | Custom dash, teleport, or locomotion abuse | Server state and transition checks; under Server Authority, keep simulation logic in `BindToSimulation()` and do not add blanket CFrame snap-back | |
| 20 | | Remote | Spam, arg spoof, replay | Rate limiter + validate arg types + idempotency | |
| 21 | | Economy | Dupe, negative qty | Session lock, atomic ops, qty > 0 | |
| 22 | | DataStore | Save spam, session hijack | Server-controlled saves, JobId session lock | |
| 23 | | General | Client trusts values | Server computes ALL game state | |
| 24 | |
| 25 | ### Audit Checklist |
| 26 | |
| 27 | **CRITICAL:** Server-authoritative state · Choose and document the authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client or replicated code |
| 28 | |
| 29 | **HIGH:** Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects |
| 30 | |
| 31 | **MEDIUM:** Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering |
| 32 | |
| 33 | ### Anti-Patterns |
| 34 | |
| 35 | Don't obfuscate client code, use `_G` for security, kick without logging, over-validate movement, or rely on client anti-cheat. |
| 36 | |
| 37 | See `references/full.md` for detailed examples. |
People who liked this also viewed
6 picksType
- hyperframes-cliUse the HyperFrames CLI development loop: init, add, catalog, capture, lint, check, snapshot, compare, grade-compare, preview, play, present, beats, keyframes, single or batch render, publish, cloud, SkillsJul 2026
- request-refactor-planSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- analyze-projectRigor Analyze / Rigor Audit read-only skill for deep learning research repositories. Use when the user wants to read and understand a repository, inspect model structure and training or inference entrSkillsMay 2026
- explore-codeRigor Improve implementation leaf skill for auditable candidate implementation in deep learning research repositories. Use when the researcher explicitly authorizes exploratory work on an isolated braSkillsMay 2026
- ubiquitous-languageSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- scaffold-exercisesSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
