About fivem-security
fivem-security is a skill for reviewing and hardening FiveM scripts, aimed at developers handling network events, admin commands, permissions, bans, and persistent data. It emphasizes server-side validation and authorization, with procedural checks and rule references.
Key features
- 01Validate state and permissions server-side
- 02Review network events and NUI callbacks
- 03Rate-limit critical events and clean up state
- 04Filter native game network events
- 05Log rejections and escalate cautiously
Use cases
- 01Harden handlers that grant money, items, or vehicles
- 02Protect admin commands and restricted events
- 03Review ban, whitelist, and persistent-data logic
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/fivem-securityin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
rules/ace-permissions.mdevents.mdidentifiers.mdnet-game-events.mdrate-limiting.mdsandbox.mdserver-convars.mdDetails
From the project READMEFiveM Security
Activation Contract
Load for any net event handler, code granting money, items, vehicles or permissions, admin commands, ban logic, or questions about cheats, exploits or hardening.
Hard Rules
- Never trust the client. The client REQUESTS; the server DECIDES from its own config and state.
- Never accept prices, amounts, rewards or item names from the client. Derive them server-side.
GetInvokingResource()is nil for every net event crossing the network, player or cheater alike. NOT auth.RegisterNUICallbackis NOT authenticated: a cheater POSTs to any endpoint. Never the only gate beforeTriggerServerEvent.- Distance-check server-side:
#(GetEntityCoords(GetPlayerPed(source)) - target), ~10 units. - Re-verify state server-side (job, item, cooldown) even if the client checked.
- Rate-limit critical events; clear per-source state in
playerDropped. - Filter native game events (
weaponDamageEvent,startProjectileEvent,removeAllWeaponsEvent,ptFxEvent) withAddEventHandler+CancelEvent(). - Authorize admin actions with ACE only:
IsPlayerAceAllowed(source, object). Never an identifier list. - Key persistent data on
license:.steam:is absent for non-Steam launches. - The sandbox blocks writes outside the resource's own folder,
os.executeandio.tmpfile(). - Log rejections. Escalate on counts, never auto-ban on one hit.
Decision Gates
| Situation | Reference |
|---|---|
| Client-sent price, amount, or any argument | rules/events.md |
| Repeated or spammable event | rules/rate-limiting.md |
| Damage, projectile, weapon strip, particles | rules/net-game-events.md |
| Admin command or admin-only event | rules/ace-permissions.md |
| Ban, whitelist, persistent record | rules/identifiers.md |
| Resource writes files or spawns processes | rules/sandbox.md |
| Hardening the server itself | rules/server-convars.md |
Execution Steps
- List every net event and NUI callback and the state each changes.
- Strip client values the server can compute itself.
- Add type/range, distance and state checks at the top; return early.
- Cooldown or token-bucket anything spammable; clean up on drop.
- Gate admin paths behind
IsPlayerAceAllowed. - Add game event filters for damage, projectiles, weapons.
- Log rejections with name and source id.
Output Contract
Return hardened handler(s) with validation, distance, ACE and state checks first; name the client parameters removed; include required server.cfg lines.
References
- rules/events.md — handlers, distance, NUI callbacks.
- rules/net-game-events.md — game event payloads, cancelling.
- rules/ace-permissions.md — principals, objects, ACE guards.
- rules/rate-limiting.md — cooldowns, token buckets, cleanup.
- rules/identifiers.md —
license:, tokens, deferrals. - rules/sandbox.md — filesystem, process, convar limits.
- rules/server-convars.md — hardening convars.
Upstream docs: https://docs.fivem.net/docs/scripting-manual/