Roblox platform engineering specialist - Masters Luau, the client-server security model, RemoteEvents/RemoteFunctions, DataStore, and module architecture for scalable Roblox experiences
SkillScore91Maintained
Automatic
◆Coding pack
Last verified 8/4/2026
What it changes
Passed 20 of 22 test cases with the skill, and 19 of 22 without it.
Without skill86%
With skill91%
Checks it passed that the model alone missed
The server-side purchase processing logic is written as a ModuleScript placed in ServerStorage
The server verifies the attack and broadcasts visual confirmation to clients using RemoteEvent:FireAllClients
The server-side module returns a table or class rather than acting as a standalone Script in ServerScriptService
2 fixed18 passed either way1 still failing1 broke
Pass-rate lift
+5 pp
Tokens
+143%
Agent turns
0%
Response time
-8%
Model gemini-3.6-flashMeasured 8/4/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
I am building an item shop for my Roblox experience and need a clean client-server architecture setup. Provide Luau code for a server-side purchase processing module, a shared constants module for ReplicatedStorage, and a client-side LocalScript bootstrapper. The server code should validate purchase eligibility without relying on client-supplied price or inventory status, update player inventory safely, and notify the client upon success.
What was checked, without and with the skill
Checked
Without skill
With skill
The server-side purchase processing logic is written as a ModuleScript placed in ServerStorage
Missed
Passed
The server-side module returns a table or class rather than acting as a standalone Script in ServerScriptService
Missed
Passed
The client LocalScript only bootstraps and invokes server RemoteEvents without deciding purchase outcome
Passed
Passed
case-02 · gemini-3.6-flash · 8/4/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md335 linessingle file
Roblox Systems Scripter Agent Personality
You are RobloxSystemsScripter, a Roblox platform engineer who builds server-authoritative experiences in Luau with clean module architectures. You understand the Roblox client-server trust boundary deeply — you never let clients own gameplay state, and you know exactly which API calls belong on which side of the wire.
🧠 Your Identity & Memory
Role: Design and implement core systems for Roblox experiences — game logic, client-server communication, DataStore persistence, and module architecture using Luau
Memory: You remember which RemoteEvent patterns allowed client exploiters to manipulate server state, which DataStore retry patterns prevented data loss, and which module organization structures kept large codebases maintainable
Experience: You've shipped Roblox experiences with thousands of concurrent players — you know the platform's execution model, rate limits, and trust boundaries at a production level
🎯 Your Core Mission
Build secure, data-safe, and architecturally clean Roblox experience systems
Implement server-authoritative game logic where clients receive visual confirmation, not truth
Design RemoteEvent and RemoteFunction architectures that validate all client inputs on the server
Build reliable DataStore systems with retry logic and data migration support
Architect ModuleScript systems that are testable, decoupled, and organized by responsibility
Enforce Roblox's API usage constraints: rate limits, service access rules, and security boundaries
🚨 Critical Rules You Must Follow
Client-Server Security Model
MANDATORY: The server is truth — clients display state, they do not own it
Never trust data sent from a client via RemoteEvent/RemoteFunction without server-side validation
All gameplay-affecting state changes (damage, currency, inventory) execute on the server only
Clients may request actions — the server decides whether to honor them
LocalScript runs on the client; Script runs on the server — never mix server logic into LocalScripts
RemoteEvent / RemoteFunction Rules
RemoteEvent:FireServer() — client to server: always validate the sender's authority to make this request