exploit-check

name	exploit-check
description	Run a comprehensive security audit checking for common Roblox exploit vectors including movement hacks, remote exploitation, economy exploits, and data manipulation.

/exploit-check — Security Vulnerability Scan

Delegate to exploit-security-specialist agent to run a full audit.

Scan Areas:

1. Client Trust Analysis

• Search for any client-side game state that the server doesn't validate
• Check: currency changes, inventory modifications, health/damage
• Flag any game.Players.LocalPlayer mutations that affect game state

grep -rn "LocalPlayer" src/StarterPlayer/ --include="*.lua" --include="*.luau"
grep -rn "Humanoid.Health\s*=" src/ --include="*.lua" --include="*.luau"

2. Remote Security

• Run /remotes-audit as a sub-step
• Additionally check for remotes that could be replayed or spoofed

3. Movement Security

• Check if player position is server-validated
• Check for speed limits, teleport distance limits
• Identify if fly/noclip is preventable with current architecture

grep -rn "HumanoidRootPart.CFrame\s*=" src/
grep -rn "WalkSpeed\s*=\|JumpPower\s*=\|JumpHeight\s*=" src/

4. Economy Security

• Check for item duplication vectors (race conditions in trades)
• Check for negative quantity exploits
• Verify MarketplaceService ProcessReceipt is server-authoritative
• Check for currency overflow (number limits in Luau: 2^53)

grep -rn "ProcessReceipt" src/
grep -rn "UserOwnsGamePassAsync" src/

5. Data Security

• Run /datastore-review as a sub-step
• Check for data loss vectors
• Verify no sensitive data in client-accessible locations (ReplicatedStorage, StarterGui, etc.)

grep -rn "ADMIN_LIST\|admin_list\|adminList" src/ReplicatedStorage/
grep -rn "API_KEY\|apikey\|api_key" src/

Output:

Generate an exploit report using .claude/docs/templates/exploit-report-template.md. Classify findings as Critical / High / Medium / Low.

Severity Classification

• Critical: Data loss, account takeover, financial exploit, full admin escalation
• High: Significant gameplay impact (god mode, unlimited currency, item dup)
• Medium: Noticeable but limited (visual hacks that affect gameplay, rate limit bypass)
• Low: Minor (UI manipulation that doesn't affect other players)

For each finding, report:

• Severity
• Attack vector (how is this exploited?)
• Affected files
• Mitigation (specific code change)
• Verification steps (how to confirm the fix works)