# roblox-security

A skill that steers your coding agent toward server-authoritative Roblox code: request validation, anti-cheat checks, rate limits.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 703 installs · ★ 28
- Author: sentinelcore
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sentinelcore/roblox-skills/tree/HEAD/roblox-security/SKILL.md
- Updated: 2026-02-23
- HTML: https://affpapa.org/en/nevibecode/skills/sentinelcore-roblox-security

## What it does

The skill hands the agent one rule and builds everything on it: the client is not trustworthy. A `LocalScript` runs on the player's machine, so damage, currency, stats and position changes belong on the server. A table of insecure-versus-secure patterns shows the agent what to rewrite.

It ships Lua snippets for the usual cases: `leaderstats` created from `ServerScriptService`, an interaction distance check, a per-player ability cooldown, a purchase quantity clamp, a `Validate` module for numbers, `Instance` and strings, plus a speed check that kicks after repeated violations. There is also a note on what belongs in `ServerScriptService` and what may sit in `ReplicatedStorage`.

Watch your module layout. Currency, damage or `DataStore` logic inside a `ReplicatedStorage` module can be pulled in by the client with `require()`. Worth checking before the skill starts suggesting moves.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add sentinelcore/roblox-skills --skill roblox-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/roblox-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/roblox-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add sentinelcore/roblox-skills --skill roblox-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/roblox-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add sentinelcore/roblox-skills --skill roblox-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/roblox-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install sentinelcore/roblox-skills roblox-security
```

2. **Manually: put the files in place**
- File: `.github/skills/roblox-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add sentinelcore/roblox-skills --skill roblox-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/sentinelcore/roblox-skills --path roblox-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/roblox-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add sentinelcore/roblox-skills --skill roblox-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/sentinelcore/roblox-skills/tree/HEAD/roblox-security/SKILL.md

## When to use it
- rewrite a `RemoteEvent` handler so the server computes damage itself
- move currency and stats out of a `LocalScript` into server-owned `leaderstats`
- add a cooldown and a call limit to player actions
- verify interaction distance before running the action
- find sensitive modules sitting in `ReplicatedStorage`

## Example prompts
- Review this `RemoteEvent` for exploits and rewrite the handler with server-side validation
- Set up `leaderstats` with coins owned by the server
- Add rate limiting and a cooldown to `UseAbilityRemote`

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

## Other versions with the same name
- [roblox-security · tabooharmony](https://affpapa.org/en/nevibecode/skills/roblox-security.md) — 1900 installs

From the same set: [sentinelcore/roblox-skills](https://affpapa.org/en/nevibecode/by/sentinelcore/roblox-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md