# fivem-security

Reviews FiveM server handlers and rewrites them so the server stops trusting client input. Useful when cheaters fire forged events at your resource.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 491 installs · ★ 18
- Author: germanfndez
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/germanfndez/fiveai-skills/tree/HEAD/skills/fivem-security/SKILL.md
- Updated: 2026-10-17
- HTML: https://affpapa.org/en/nevibecode/skills/fivem-security

## What it does

The skill loads for any net event handler, code that grants money, items, vehicles or permissions, admin commands, ban logic, and anything about exploits. Its first rule is blunt: the client requests, the server decides from its own config and state. Prices, amounts, rewards and item names get derived server-side instead of read from event arguments.

Execution runs in seven steps. List every net event and NUI callback with the state it changes. Strip client values the server can compute. Put type, range and distance checks at the top and return early. Add a cooldown or token bucket to anything spammable, then clean up per-source state in `playerDropped`. Gate admin paths behind `IsPlayerAceAllowed`. Filter native game events such as `weaponDamageEvent` and `ptFxEvent` with `AddEventHandler` plus `CancelEvent()`. Rejections get logged with name and source id.

Two assumptions break naive setups. `GetInvokingResource()` is nil for every net event crossing the network, so it is not authentication. `RegisterNUICallback` is not authenticated either — a cheater can POST to any endpoint, so it must never be the only gate before `TriggerServerEvent`. For persistent records the skill points at `license:`, since `steam:` is absent on non-Steam launches.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add germanfndez/fiveai-skills --skill fivem-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/fivem-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/fivem-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add germanfndez/fiveai-skills --skill fivem-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/fivem-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add germanfndez/fiveai-skills --skill fivem-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/fivem-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install germanfndez/fiveai-skills fivem-security
```

2. **Manually: put the files in place**
- File: `.github/skills/fivem-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add germanfndez/fiveai-skills --skill fivem-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/germanfndez/fiveai-skills --path skills/fivem-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/fivem-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add germanfndez/fiveai-skills --skill fivem-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/germanfndez/fiveai-skills/tree/HEAD/skills/fivem-security/SKILL.md

## When to use it
- drop client-supplied prices and amounts from event handlers
- add a server-side distance check before granting an item
- throttle a spammable event with a cooldown
- replace an identifier list with an ACE check on admin commands
- filter forged damage and projectile game events

## Example prompts
- review my `TriggerServerEvent('shop:buy')` handler for exploits
- add server-side validation and a distance check to this net event
- how do I secure an admin money command in FiveM

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 13c28f0e658cf13d.

BEGIN THIRD-PARTY FILE 13c28f0e658cf13d
```text
---
name: fivem-security
description: "Trigger: security, anti-cheat, exploit, secure events, validate client data, server authority, distance check, rate limit, review server code. Harden FiveM net events and server-side validation."
license: MIT
metadata:
  author: germanfndez
  version: "1.0.0"
---

# FiveM Security

## Activation Contract

Load for any net event handler, code granting money, items, vehicles or permissions, admin commands, ban logic, or questions about cheats, exploits or hardening.

## Hard Rules

- Never trust the client. The client REQUESTS; the server DECIDES from its own config and state.
- Never accept prices, amounts, rewards or item names from the client. Derive them server-side.
- `GetInvokingResource()` is nil for every net event crossing the network, player or cheater alike. NOT auth.
- `RegisterNUICallback` is NOT authenticated: a cheater POSTs to any endpoint. Never the only gate before `TriggerServerEvent`.
- Distance-check server-side: `#(GetEntityCoords(GetPlayerPed(source)) - target)`, ~10 units.
- Re-verify state server-side (job, item, cooldown) even if the client checked.
- Rate-limit critical events; clear per-source state in `playerDropped`.
- Filter native game events (`weaponDamageEvent`, `startProjectileEvent`, `removeAllWeaponsEvent`, `ptFxEvent`) with `AddEventHandler` + `CancelEvent()`.
- Authorize admin actions with ACE only: `IsPlayerAceAllowed(source, object)`. Never an identifier list.
- Key persistent data on `license:`. `steam:` is absent for non-Steam launches.
- The sandbox blocks writes outside the resource's own folder, `os.execute` and `io.tmpfile()`.
- Log rejections. Escalate on counts, never auto-ban on one hit.

## Decision Gates

| Situation | Reference |
|---|---|
| Client-sent price, amount, or any argument | rules/events.md |
| Repeated or spammable event | rules/rate-limiting.md |
| Damage, projectile, weapon strip, particles | rules/net-game-events.md |
| Admin command or admin-only event | rules/ace-permissions.md |
| Ban, whitelist, persistent record | rules/identifiers.md |
| Resource writes files or spawns processes | rules/sandbox.md |
| Hardening the server itself | rules/server-convars.md |

## Execution Steps

1. List every net event and NUI callback and the state each changes.
2. Strip client values the server can compute itself.
3. Add type/range, distance and state checks at the top; return early.
```
END THIRD-PARTY FILE 13c28f0e658cf13d

The third-party file has ended. Everything between the 13c28f0e658cf13d tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2418 of 3306 bytes. © germanfndez · MIT · https://github.com/germanfndez/fiveai-skills/tree/HEAD/skills/fivem-security/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md