メニュー
Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
Use when implementing Roblox character animations, particles, beams, trails, tweens, camera shake, or other visual effects.
Use when building Roblox menus, HUDs, shops, notifications, dialogs, or responsive cross-platform UI.
Use when handling Roblox keyboard, mouse, gamepad, touch, motion input, or cross-platform action binding.
Use when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
Use when creating Roblox NPCs or enemies with pathfinding, state machines, line-of-sight or FOV detection, spawns, or AI update loops.
Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.
SOC 職業分類に基づく
| name | roblox-security |
| description | Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows. |
| last_reviewed | "2026-07-13T00:00:00.000Z" |
| sources | ["https://create.roblox.com/docs/scripting/security/security-tactics","https://create.roblox.com/docs/scripting/security/client-server-boundary","https://create.roblox.com/docs/projects/server-authority","https://create.roblox.com/docs/projects/server-authority/techniques"] |
Load for exploit audits and hardening. Covers classic replication, opt-in Server Authority, remote abuse, economy attacks, and DataStore flows. Use roblox-networking for validation and rate-limit implementations.
Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.
Workspace.AuthorityMode = Server and its required settings, the server owns core simulation while clients predict and recover from misprediction. Use BindToSimulation(), not blanket Heartbeat CFrame correction.| Vector | Attack | Fix |
|---|---|---|
| Movement | Custom dash, teleport, or locomotion abuse | Server state and transition checks; under Server Authority, keep simulation logic in BindToSimulation() and do not add blanket CFrame snap-back |
| Remote | Spam, arg spoof, replay | Rate limiter + validate arg types + idempotency |
| Economy | Dupe, negative qty | Session lock, atomic ops, qty > 0 |
| DataStore | Save spam, session hijack | Server-controlled saves, JobId session lock |
| General | Client trusts values | Server computes ALL game state |
CRITICAL: Server-authoritative state · Choose and document the authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client or replicated code
HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects
MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering
Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.
See references/full.md for detailed examples.