Fivem Security Audit — Security skill for Claude Code

FiveM Security Audit

[](https://www.npmjs.com/package/fivem-security-audit) [](https://www.npmjs.com/package/fivem-security-audit) [](https://opensource.org/licenses/MIT)

**A reviewer, not a scanner.**

Backdoor scanners answer one question: *does this file contain a string somebody already catalogued?* That misses the bug that actually drains your economy, because a money dupe has no signature.

This answers the question you actually have:

**Can a player on my server mint money, crash it, or hand themselves admin — and should I trust this file at all?**

It reads the code, reasons about who can reach each line and with what input, quotes the exact line, and tells you how to fix it. It is a Claude Code skill, so the "reading and reasoning" is real reading, not a regex pass.

npx fivem-security-audit

Restart Claude Code, then run it in any resource folder:

/fivem-security-audit

Or just ask: *"audit this resource"*, *"is this leaked script safe?"*, *"why is my economy leaking money?"* Single phase: `/fivem-security-audit security`, `provenance`, `performance`, …

A finding a scanner cannot produce

local item = Config.Items[itemId]              -- price is server-authoritative
if not item then return end
if type(qty) ~= 'number' or qty < 1 then return end   -- qty is validated positive

local total = item.price * qty
if xPlayer.getMoney() < total then return end  -- balance checked before deducting
xPlayer.removeMoney(total)

Every checklist item passes. There is no suspicious string, no obfuscation, no known-bad domain. It still mints money: `lua54` integers wrap silently on overflow, so a large enough `qty` makes `total` negative, the balance check passes trivially, and removing a negative amount adds it.

Finding that requires understandi