메뉴
Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when implementing Roblox character animations, particles, beams, trails, tweens, camera shake, or other visual effects.
Use when building Roblox menus, HUDs, shops, notifications, dialogs, or responsive cross-platform UI.
Use when handling Roblox keyboard, mouse, gamepad, touch, motion input, or cross-platform action binding.
Use when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
Use when creating Roblox NPCs or enemies with pathfinding, state machines, line-of-sight or FOV detection, spawns, or AI update loops.
Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.
| name | roblox-security |
| description | Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows. |
| last_reviewed | "2026-07-13T00:00:00.000Z" |
| sources | ["https://create.roblox.com/docs/scripting/security/security-tactics","https://create.roblox.com/docs/scripting/security/client-server-boundary","https://create.roblox.com/docs/projects/server-authority","https://create.roblox.com/docs/projects/server-authority/techniques"] |
Load for exploit audits and hardening. Covers classic replication, opt-in Server Authority, remote abuse, economy attacks, and DataStore flows. Use roblox-networking for validation and rate-limit implementations.
Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.
Workspace.AuthorityMode = Server and its required settings, the server owns core simulation while clients predict and recover from misprediction. Use BindToSimulation(), not blanket Heartbeat CFrame correction.| Vector | Attack | Fix |
|---|---|---|
| Movement | Custom dash, teleport, or locomotion abuse | Server state and transition checks; under Server Authority, keep simulation logic in BindToSimulation() and do not add blanket CFrame snap-back |
| Remote | Spam, arg spoof, replay | Rate limiter + validate arg types + idempotency |
| Economy | Dupe, negative qty | Session lock, atomic ops, qty > 0 |
| DataStore | Save spam, session hijack | Server-controlled saves, JobId session lock |
| General | Client trusts values | Server computes ALL game state |
CRITICAL: Server-authoritative state · Choose and document the authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client or replicated code
HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects
MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering
Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.
See references/full.md for detailed examples.