Okay, ran the zip file through ChatGPT. Here’s what it responded with (also why is it annoyed by HTTPService? Roblox literally has a permission category for HTTPService.)
Nice — I unpacked the ZIP and scanned the plugin source. Short answer: yes, there are a few things that could trigger Roblox moderation or at least raise security flags. I’ll list the specific red flags (with file references and short excerpts) and give concrete fixes/mitigations you can apply.
Top moderation / security red flags
1) Programmatic script creation + automatic editing (script injection)
Where: HierarchySaverMain.luau and src/Hierarchy_Saver.luau (multiple places)
What I found: the plugin creates Script instances, puts them in the DataModel, opens them using ScriptEditorService:OpenScriptDocumentAsync, then programmatically edits their contents with ScriptDocument:EditTextAsync. Example behavior sequence:
Instance.new("Script") → Selection:Set({script}) → ScriptEditorService:OpenScriptDocumentAsync(script)ret:EditTextAsync(...) (programmatically writes to the script editor)
Why this’s risky: plugin-created scripts that are filled/modified automatically are exactly the sort of “script injection” behavior that moderation and users are wary of — it can be used to plant code in a place and automatically run it. The code even contains a warning message: “No script access. Please give script injection access.” which confirms it expects elevated editing permissions.
Suggested mitigations:
- Require explicit, visible user consent before inserting or modifying any script (e.g., show a dialog with a clear confirmation button, and don’t proceed without it).
- Prefer producing the generated code in a safe way the user can inspect and paste themselves (e.g., copy to clipboard, show a preview window with an explicit “Insert into new script” button the user must press).
- Log/annotate any inserted code with a clear comment header like
-- Inserted by Hierarchy Saver (date, user) so it’s obvious what changed.
2) Self-destruct / hiding module script
Where: src/Children/SharedSettings.luau (top of file)
What I found: a call that schedules destruction of the module/script:
task.defer(game.Destroy, script) — this will call Destroy with script as self, effectively destroying the module/script instance at runtime.
Why this’s risky: destroying your own module (or otherwise removing code at runtime) is often used to hide behavior from users and moderation reviewers. That’s a strong red flag — it looks like an attempt to remove or hide source code after execution.
Suggested mitigations:
- Remove self-destruction. Keep module scripts intact so users and moderation can inspect them.
- If you want to avoid leaking internal tables, return only the necessary table and do not delete the ModuleScript object.
3) External HTTP requests
Where: HierarchySaverMain.luau and src/Hierarchy_Saver.luau
What I found: several pcall(HttpService.GetAsync, HttpService, "<raw github url>") calls to fetch an API dump from GitHub (API-Dump JSON). The plugin also stores/loads JSON via plugin settings.
Why this’s risky: external requests from plugins are monitored; fetching remote code or data without clear disclosure can attract attention. If the plugin pulled executable code or untrusted assets, that would be a red flag.
Suggested mitigations:
- If you must fetch remote data, document it clearly and prefer fetching non-executable, read-only metadata (no code).
- Prefer bundling required static resources with the plugin or let users opt-in to “update from remote” explicitly.
- Don’t
load or execute strings fetched from remote sources.
4) Use of InsertService (asset insertion)
Where: SharedSettings.luau and other code paths reference InsertService / AssetService.
What I found: plugin can create MeshPart via InsertService (there’s a UI setting CMPAsyncService choosing InsertService vs AssetService).
Why this’s risky: inserting remote assets may load user-supplied or moderated assets. Automatic asset insertion should be explicit and transparent.
Suggested mitigations:
- Default to safer methods (
AssetService) or require user confirmation for inserting remote assets.
- Make it clear what asset IDs/URLs will be used.
5) Programmatic destruction of Instance objects
Where: many :Destroy() calls across the codebase.
What I found: plugin routinely destroys UI objects and created Instances — not inherently malicious, but combined with other behavior (creating and destroying scripts) it increases suspicion.
Suggested mitigations:
- Keep destructive operations user-initiated and documented.
- Avoid destroying user-owned objects unless user explicitly requests it.
6) Use of global table _G for cache/state
Where: multiple files (_G.__classesData usage).
Why this’s risky: globals are not a moderation problem per se, but they can cause persistence across plugin runs and conflict with other plugins. Not a direct red flag, but worth replacing with plugin settings or scoped module caches.
Overall assessment & likelihood of moderation attention
- High-likelihood flags: self-destructing module script (
task.defer(game.Destroy, script)) and automatic script injection/editing (ScriptEditorService + EditTextAsync) — both are behavior that moderators and trust systems scrutinize. The self-destruction is particularly suspicious.
- Medium-likelihood flags: external HTTP calls to fetch resources (acceptable when fetching non-executable JSON but must be documented), InsertService usage when unprompted.
- Low-likelihood flags:
_G use, :Destroy() on UI / temp objects, general file structure.
If moderation inspects this plugin, the two things most likely to cause rejection or removal are the self-destruct and the automatic editing/insertion of scripts.
Concrete changes I recommend (priority order)
- Remove
task.defer(game.Destroy, script) immediately — never self-delete ModuleScripts. Keep source visible.
- Stop silently writing into scripts. Replace programmatic injection with an explicit user action:
- Show the generated source in a preview window and a clear “Insert into new script” button that the user must click.
- Or copy the generated code to the clipboard and show instructions for pasting into a script.
- Add clear UI/consent for network/API calls and asset insertion. If you fetch remote JSON or insert assets, show a confirmation and explain what will be fetched/inserted.
- Audit any place you modify or destroy user-owned Instances or scripts and make those actions require explicit user consent.
- Replace
_G caching with plugin:GetSetting()/SetSetting() or a module-local cache so state isn’t globally shared."
Hierarchy Saver - Convert Roblox Instances to Clean Luau Code
Description:
Perfect if you want to treat hierarchies like code, generate UIs, replicate runtime structures, or just ditch manual rework.
Downloads
Features / Supports
All Roblox instance datatypes (Vector3, Color3, UDim2, etc.)
Meshes (MeshPart & SpecialMesh support)
Advanced customization (indent, tabs, formatting, dialects)
Macro system for reusable patterns and conditionals
Recursive & linear hierarchy references (ObjectValue etc.)
Register limit handling via upvalue imports
UI/Instance DSL support (Nestify-style syntax)
Dialect system for framework compatibility
Fully open-source — no bloat, no paywalls
Nestify Framework:
Demo
Data Removal/Backup
Donations
