Security Review Skill

Review Roblox Studio / Luau experiences for trust-boundary mistakes and exploit-friendly design. Default to the game-code threat model first (Scripts, ModuleScripts, RemoteEvents, services), not enterprise web checklists. If the scoped target is RCS runtime code, Node tooling, or another off-Roblox surface, switch to the matching runtime/backend threat model instead of forcing Luau-only guidance.

When to Use

• User asks for a security review, exploit check, or anti-cheat pass on a place or Luau codebase
• After adding or changing RemoteEvents, RemoteFunctions, BindableEvents that cross the client–server boundary
• After economy work (developer products, passes, ProcessReceipt, grants, currency)
• After DataStore / OrderedDataStore / MemoryStore access patterns change
• Before a live or high-traffic update when combat, trading, or progression is involved

What It Does

GPT-5.5 Guidance Alignment