What problem does it solve? FiveM server operators cannot tell from a pattern scan whether a resource lets players mint money, crash the server, or escalate to admin, or whether a leaked script carries a hidden backdoor. This Skill performs a semantic security review of FiveM and RedM resources, reasoning about reachability and trust boundaries rather than matching signatures. ## Core Features & Use Cases - Multi-phase audit: Covers provenance and trust tiers, security (dupes, event forgery, SQLi, NUI trust, state bags, HTTP handlers), malware and supply chain (backdoors, C2 indicators, npm/NUI build chain, txAdmin injection), performance, cleanup, compatibility, and architecture quality. - Structured report with scoring: Every finding carries a confidence level, file and line, exploit scenario, and copy-paste fix, ending in a 0-100 score, a trust tier, and a hard gate where any unresolved CRITICAL means not production ready. - Use Case: You downloaded a free copy of a paid shop script and want to know if it is safe. Run the audit in the resource folder; it classifies the origin as untrusted, finds the Lua 5.4 integer-overflow dupe in the purchase handler, and reports the result as "no backdoor found" rather than "clean". ## Quick Start Navigate to a FiveM resource folder in Claude Code and ask it to audit this resource for security issues, optionally naming a single phase such as security, provenance, malware, or performance.
