FiveM Security Audit

A Claude Code skill that reviews a FiveM or RedM resource the way an attacker would read it, then hands you a report you can act on. Backdoors, dupes, SQL injection, NUI exploits, crash vectors, performance leaks. It reads the code, quotes the exact line, and tells you how to fix it.

npx fivem-security-audit

Restart Claude Code, then run it in any resource folder:

/fivem-security-audit

Or just ask: "audit this resource", "scan this script for backdoors", "is this safe for production?". Pick a single phase with /fivem-security-audit security or performance.

What it looks for

Malware and backdoors. Remote code execution, the Cipher and Blum/Warden families, obfuscation (hex, XOR, base64, Luraph), token grabbers, Discord and Telegram exfiltration, supply-chain injection into txAdmin and build files, known C2 domains and IPs. It knows the difference between a real backdoor and a legitimate anti-dump loader.

Exploitable code. Money and item dupes, event forgery from cheat menus, NUI callback abuse, state-bag floods, entity spoofing, weak permissions, second-order SQL injection. The threat model assumes the player is hostile and the anti-cheat is bypassable.

Performance and stability. Wasteful Wait(0) threads, uncached natives, N+1 queries, leaked streaming assets, missing playerDropped and onResourceStop cleanup, all measured against real resmon budgets.

Every finding carries a confidence level, a file and line, the exploit, and a copy-paste fix. The report ends with a score out of 100 and a hard gate: any unresolved critical means not production ready.

Coverage

Frameworks: ESX Legacy, QBCore, QBox (ox_core), ND_Core, ox_lib, standalone, and RedM (VORP, RSG, RedEM).

Escrow-aware: encrypted .fxap source is reported as unaudited, never waved through as clean.

The toolkit

| Stage | Tool | |-------|------| | Build | fivem-resource-builder | | Audit | fivem-security-audit | | Protect | dei_security_scanner |

Build it secure, audit the diff before you deploy, run the scanner so anything injected later gets caught.

License

MIT