Fivem Resource Builder banner
matiaspalmac matiaspalmac

Fivem Resource Builder

Development community

Description

Scaffold FiveM and RedM resources that are secure before you write a line. A Claude Code skill for ESX, QBCore, QBox, ox and React NUI — bounded arithmetic, anti-dupe, ACE permissions and cleanup baked in. Legacy + GTA V Enhanced.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

FiveM Resource Builder

[![npm](https://img.shields.io/npm/v/fivem-resource-builder)](https://www.npmjs.com/package/fivem-resource-builder) [![downloads](https://img.shields.io/npm/dm/fivem-resource-builder)](https://www.npmjs.com/package/fivem-resource-builder) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)

A Claude Code skill that scaffolds full FiveM and RedM resources with the security already in place. Ask for a shop, a garage, a job, a HUD; you get a working resource where every server event validates input, every price lives on the server, and nothing trusts the client.

npx fivem-resource-builder

Restart Claude Code, then `/fivem-resource-builder` or just say what you want:

"create a QBCore shop with a NUI" "scaffold an ESX garage" "add a secure buy event to this resource"

Why it's different

Most generators hand you an empty skeleton and wish you luck. This one writes the parts people get wrong:

  • source resolved on the server, never sent by the client
  • Input validated for type, range, length and NaN
  • Bounded arithmetic — quantities capped before they are multiplied and totals sanity-checked afterwards, because lua54 integers wrap silently and a validated-positive quantity can still mint money
  • Rate limits and anti-dupe mutexes on money and item events
  • Prices read from server config, not from the NUI
  • Proximity checks on world actions
  • ACE for admin, not job strings — anything that can set a job otherwise inherits admin
  • Shared state written server-side, so the resource survives sv_stateBagStrictMode true
  • Secrets in set convars, never setr (which replicates to every client)
  • playerDropped and onResourceStop cleanup, every time
  • NUI that escapes user text, ships a browser preview mode, and comes with a locked-down build chain

The output is built to pass the audit (below) on the first run — and the checklist that guarantees it is kept in