mcpField
R
roblox-security

roblox-security

github.com/tabooharmonySecurity1382.1k installsUpdated 2w ago
Repository

About roblox-security

A security reference skill for auditing Roblox authority models, remotes, economies, saved data, bans, and sandboxing. It gives developers an audit checklist and distinguishes server responsibilities across replication models.

Key features

  1. 01Authority model guidance
  2. 02Remote and state validation checklist
  3. 03DataStore and transaction safeguards
  4. 04Ban enforcement considerations
  5. 05Security anti-patterns

Use cases

  1. 01Auditing remote request handling
  2. 02Reviewing currency and inventory security
  3. 03Assessing save and ban workflows

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-security

After installing, type/roblox-securityin Claude Code to confirm it loaded.

Bundled filesreferences/full.md

Details

From the project README

Roblox Security

When to Load

Load for authority, remote abuse, economy, saves, bans, or sandboxing audits. Remote validation/rate limits: roblox-networking.

Quick Reference

Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.

Authority Models
  • Classic replication: validate client requests against server state. Never trust client damage, currency, inventory, permissions, or positions.
  • Server Authority: Workspace.AuthorityMode = Server: the server owns core simulation while clients predict and recover from misprediction. Use BindToSimulation() (needs UseFixedSimulation), not blanket Heartbeat correction. Cheap for stock characters, rewrite-scale for authored simulation (full.md).
  • Both: validate attacks, purchases, teleports, permissions, and custom remotes at the server boundary.
Audit Checklist

CRITICAL: Server-authoritative state · Documented authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client code

HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects · Validate ProximityPrompt/ClickDetector/DragDetector like remotes

MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering · Script sandboxing for third-party code

Enforcement

Enforcement is a product decision with appeal implications. Players:BanAsync/UnbanAsync are server-only and need Players.BanningEnabled; pcall them. Duration, reason limits and device blocks: full.md.

Anti-Patterns

Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.

See references/full.md for detailed examples.

Comments

Markdown supported