roblox-security · sentinelcore — Claude Code skill: anti-exploit Roblox scripts

What roblox-security does

The skill hands the agent one rule and builds everything on it: the client is not trustworthy. A LocalScript runs on the player's machine, so damage, currency, stats and position changes belong on the server. A table of insecure-versus-secure patterns shows the agent what to rewrite.

It ships Lua snippets for the usual cases: leaderstats created from ServerScriptService, an interaction distance check, a per-player ability cooldown, a purchase quantity clamp, a Validate module for numbers, Instance and strings, plus a speed check that kicks after repeated violations. There is also a note on what belongs in ServerScriptService and what may sit in ReplicatedStorage.

Watch your module layout. Currency, damage or DataStore logic inside a ReplicatedStorage module can be pulled in by the client with require(). Worth checking before the skill starts suggesting moves.