npx skills add sentinelcore/roblox-skills --skill roblox-security
tabooharmony/roblox-brain
roblox-security
Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
Installation
$
npx skills add tabooharmony/roblox-brain --skill roblox-security
Similar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
firebase-security-rules-auditor
Similar name
firebase/agent-skills
>- Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege esc…
111K installs
better-auth-security-best-practices
Similar name
better-auth/skills
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, s…
30.3K installs
firestore-security-rules-auditor
Similar name
firebase/agent-skills
20.4K installs
security-review
Similar name
getsentry/skills
Security code review for vulnerabilities.
15.5K installs
security-best-practices
Similar name
openai/skills
Perform language and framework specific security best-practice reviews and suggest improvements…
8.2K installs
security-threat-model
Similar name
openai/skills
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabili…
5.4K installsAlso in this package
Other skills from tabooharmony/roblox-brain · top by installs.
npx skills add tabooharmony/roblox-brain
More details
Agent compatibility
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Claude Code
Not declared
Cursor
Not declared
Codex
Not declared
GitHub Copilot
Not declared
Windsurf
Not declared
Gemini CLI
Not declared
Cline
Not declared
OpenCode
Not declared
Also listed on
Alternate registries and mirrors of this skill.
Repository health
Stars
42
License
LICENSE
Default branch
main
Open issues
0
Status
Active
Package contents
Files included with this skill beyond the listing page.
-
skill md
SKILL.md2,629 B -
docs
SUMMARY.md130 B
History
- First seen on skills.sh
- First recorded snapshot · 533 installs
SKILL.md
Roblox Security
When to Load
Load for exploit audits and hardening. Covers classic replication, opt-in Server Authority, remote abuse, economy attacks, and DataStore flows. Use roblox-networking for validation and rate-limit implementations.
Quick Reference
Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.
Authority Models
- Classic replication: validate client requests and custom movement against server state. Never trust client damage, currency, inventory, permissions, or positions.
- Server Authority: with
Workspace.AuthorityMode = Server, the server owns core simulation while clients predict and recover from misprediction. UseBindToSimulation()(requiresWorkspace.UseFixedSimulation), not blanketHeartbeatCFrame correction. Migration is cheap for stock characters but a rewrite-scale commitment for authored simulation (reality check in full.md). - Both: validate attacks, purchases, teleports, dashes, permissions, and custom remotes at the server boundary.
Audit Checklist
CRITICAL: Server-authoritative state · Choose and document the authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client or replicated code
HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects
MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering
Anti-Patterns
Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.
See references/full.md for detailed examples.