RbxAvatarAbilitiesContentUri allows any module named AvatarAbilities to be loaded/executed

[Judgy_Oreo (phoenixwhitefire)]

@RobIoxArenaEvents

I used the internal flag editor for simplicity, but a theoretical ‘attacker’ could do this on their own with a customized ClientAppSettings.json file like so.

Flags are applied based on an allowlist for the Client, this is not possible to override unless the Client has already been modified in which case they could just run any code they want anyway.