More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    RBsmithy pro

    2

    Production engineering and security auditor for Roblox and Rojo Luau projects.

    $19.99

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    1 installSecurity scanned
    RBsmithy pro

    RBsmithy pro

    Example session with this skill installed

    Review my RemoteEvent handling in the 'Combat' folder for potential exploit risks and suggest a secure validation pattern.

    • Read your context and instructions
    • Compiled the rbsmithy pro

    I have completed a boundary audit of the RemoteEvent logic in src/server/Combat/ and src/client/Combat/. The review focused on ownership validation and rate limiting.

    Remote Security Audit

    RemoteClient ClaimServer TruthValidationRate Limit
    DealDamageTarget, DamageWeapon StatsRaycast/Magnitude5/sec
    UseAbilityAbilityIDCooldown Stateos.clock() check1/sec

    Secure Validation Implementation

    -- src/server/Combat/DamageHandler.lua
local RE_DEAL_DAMAGE = ReplicatedStorage.Remotes.DealDamage

RE_DEAL_DAMAGE.OnServerEvent:Connect(function(player, target, claimedDamage)
    -- VULNERABILITY FOUND: server was trusting 'claimedDamage' from client
    local character = player.Character
    if not (character and target and target:IsDescendantOf(workspace)) then return end

    -- Validation: Magnitude check
    local dist = (character.PrimaryPart.Position - target.Position).Magnitude
    if dist > 20 then return end 

    -- Validation: Server-owned truth for damage
    local weapon = player.EquippedWeapon.Value
    local actualDamage = WeaponConfig[weapon].BaseDamage
    
    target.Humanoid:TakeDamage(actualDamage)
end)

    Next steps

    1. Replace claimedDamage parameters with server-side lookups in all Combat remotes.
    2. Implement a basic magnitude check to prevent "kill-all" exploits.
    3. Verify the fix in Studio using a local server with two clients to test reachability.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Roblox games often suffer from exploitable RemoteEvents, data loss in DataStore, and botched releases. This skill provides a specialized production engineering auditor and release playbook for developers working in Luau and Rojo.

    What it does

    • Exploit auditing identifies unsafe client-to-server boundaries and validates RemoteEvent security.
    • Data integrity review analyzes DataStore patterns to prevent session contention and player data loss.
    • Release gating generates Go/No-Go checklists based on multiplayer regression and performance budgets.
    • Incident response provides structured triage workflows for live crashes and production regressions.
    • Automated scanning utilizes a read-only Luau auditor to surface high-priority risks in local repositories.

    How it works

    1. Inspection scans default.project.json and Rojo mappings to establish the server-client boundary.
    2. Audit runs a Python-based static analysis or manual file review to find vulnerabilities and persistence failures.
    3. Prioritization generates a triage table ranking findings by severity, player impact, and evidence.
    4. Remediation delivers reviewed Luau patches with explicit server/client ownership and rollback plans.

    Frameworks & tools

    Built for Roblox Studio and Rojo workflows. Requires Python 3.11 for the automated auditor script. Works with Luau, DataStoreService, and MarketplaceService.

    Why this beats prompting it yourself

    Generic AI often suggests insecure patterns like client-side validation for currency or unsafe DataStore retries. This skill enforces strict server-owned truth and production-grade release gates derived from multiplayer engineering best practices.

    Use cases

    • Audit RemoteEvents before a major game update to prevent script injection.
    • Review purchase handling and receipt idempotency for developer products.
    • Create a multiplayer regression plan for new game features.
    • Diagnose and rollback live production incidents or performance spikes.

    Known limitations

    Does not execute Luau code or access the Studio DataModel directly. Static analysis cannot guarantee 100% exploit prevention or parse complex dynamic Luau semantics.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    1 install

    Downloaded by developers to date

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 7 days ago

    • Passed all security checks, Safe to install

    Requires

    Python

    Listed7 days ago

    What's inside

    Frequently Asked Questions