msayib/roblox-dev-skill

Python·108 files·commit 3ea5d22·scanned 2d ago·cached ✓

85/100

MALICIOUS

Matches known-malicious patterns. Do not clone or install.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Crypto/Web3 project

19% file coverage

threat-state: maliciouslive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).install.cmd

rem
rem   curl -fsSL https://raw.githubusercontent.com/MSayib/roblox-dev-skill/master/install.cmd -o install.cmd && install.cmd
rem
rem A thin launcher: it runs install.ps1 in PowerShell and passes...

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.install.sh

#
#   curl -fsSL https://raw.githubusercontent.com/MSayib/roblox-dev-skill/master/install.sh | bash
#
# Installs the skill once and links it into every agent you pick, then (optionally) sets up

+10


section "piped like curl | bash"
fresh d
HOME="$H" XDG_DATA_HOME="" NO_COLOR=1 bash -s -- --source "$REPO" --agents universal --no-docs < "$INSTALLER" > "$H.log" 2>&1; rc=$?

+10

infoSuspicious file in repoExecutable file (install.cmd) in repositoryinstall.cmd+2

infoSuspicious file in repoExecutable file (install.ps1) in repositoryinstall.ps1+2

infoSuspicious file in repoExecutable file (test_powershell.ps1) in repositorytests/install/test_powershell.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

21 files scanned @ 3ea5d22 | 10/27/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain6

owasp / injection0

telemetry

files 21/108rules hit 6engine v7commit 3ea5d22

github

msayib/roblox-dev-skill

An agent skill that turns AI coding assistants into Roblox development experts: Luau, engine APIs, architecture, anti-exploit security, and how to drive Studio's built-in MCP server safely. Version-stamped against a specific Studio/Luau release. Works with Claude Code, Antigravity, Codex, and any Skills-format assistant.

Python

126d

108 files

21 scanned(19%)

3ea5d22

architecture░▒▓

entry (0) flagged (0) pkg (15)

26 nodes · 44 edgesscroll to zoom · click node to jump to finding