germanfndezgermanfndez/fiveai-skills/skills/fivem-security/SKILL.md

fivem-security

Skill19 starsChanged 2 months agoMITView on GitHub

Trigger: security, anti-cheat, exploit, secure events, validate client data, server authority, distance check, rate limit, review server code. Harden FiveM net events and server-side validation.

In this repository12 other files it gives its agents.
- skill-creatorSkill
- esx-frameworkSkill
- fivemanageSkill
- fivem-basicsSkill
- fivem-deploymentSkill
- fivem-nuiSkill
- lua-basicsSkill
- ox-inventorySkill
- oxlibSkill
- oxmysqlSkill
- ox-targetSkill
- qbcore-frameworkSkill

The file

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 4 are distinctive, and 0 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Never trust the client. The client REQUESTS.
line 18
Distinctive:
Never accept prices, amounts, rewards or item names from the client.
line 19
Distinctive:
Add type/range, distance and state checks at the top.
line 47
Distinctive:
Add game event filters for damage, projectiles, weapons.
line 50

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

FiveM Security

Activation Contract

Load for any net event handler, code granting money, items, vehicles or permissions, admin commands, ban logic, or questions about cheats, exploits or hardening.

Hard Rules

Never trust the client. The client REQUESTS; the server DECIDES from its own config and state.
Never accept prices, amounts, rewards or item names from the client. Derive them server-side.
GetInvokingResource() is nil for every net event crossing the network, player or cheater alike. NOT auth.
RegisterNUICallback is NOT authenticated: a cheater POSTs to any endpoint. Never the only gate before TriggerServerEvent.
Distance-check server-side: #(GetEntityCoords(GetPlayerPed(source)) - target), ~10 units.
Re-verify state server-side (job, item, cooldown) even if the client checked.
Rate-limit critical events; clear per-source state in playerDropped.
Filter native game events (weaponDamageEvent, startProjectileEvent, removeAllWeaponsEvent, ptFxEvent) with AddEventHandler + CancelEvent().
Authorize admin actions with ACE only: IsPlayerAceAllowed(source, object). Never an identifier list.
Key persistent data on license:. steam: is absent for non-Steam launches.
The sandbox blocks writes outside the resource's own folder, os.execute and io.tmpfile().
Log rejections. Escalate on counts, never auto-ban on one hit.

Decision Gates

Situation	Reference
Client-sent price, amount, or any argument	rules/events.md
Repeated or spammable event	rules/rate-limiting.md
Damage, projectile, weapon strip, particles	rules/net-game-events.md
Admin command or admin-only event	rules/ace-permissions.md
Ban, whitelist, persistent record	rules/identifiers.md
Resource writes files or spawns processes	rules/sandbox.md
Hardening the server itself	rules/server-convars.md

Execution Steps

List every net event and NUI callback and the state each changes.
Strip client values the server can compute itself.
Add type/range, distance and state checks at the top; return early.
Cooldown or token-bucket anything spammable; clean up on drop.
Gate admin paths behind IsPlayerAceAllowed.
Add game event filters for damage, projectiles, weapons.
Log rejections with name and source id.

Output Contract

Return hardened handler(s) with validation, distance, ACE and state checks first; name the client parameters removed; include required server.cfg lines.

References

rules/events.md — handlers, distance, NUI callbacks.
rules/net-game-events.md — game event payloads, cancelling.
rules/ace-permissions.md — principals, objects, ACE guards.
rules/rate-limiting.md — cooldowns, token buckets, cleanup.
rules/identifiers.md — license:, tokens, deferrals.
rules/sandbox.md — filesystem, process, convar limits.
rules/server-convars.md — hardening convars.

Upstream docs: https://docs.fivem.net/docs/scripting-manual/

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free