ShieldScan - Anti-Backdoor Scanner for Roblox Studio

Resources Community Resources
,
1

Hello everyone!

I created ShieldScan, a free Roblox Studio plugin designed to help developers identify potentially malicious scripts commonly found in free models and imported assets.

Why?

Backdoors hidden inside free models remain one of the most common security risks in Roblox development. While no automated tool can guarantee complete protection, Shield Scan aims to make the inspection process faster and easier.

Features

  • Scans scripts for suspicious patterns.
  • Highlights potentially dangerous code.
  • Helps identify common backdoor techniques.
  • Simple interface directly inside Roblox Studio.
  • Open-source.

Plugin

https://create.roblox.com/store/asset/118988717840663/ShieldScan-v110

Source Code

Screenshots

ui
ui323Ă—443 15.5 KB

shieldscan
shieldscan1280Ă—720 58.5 KB

How it works

Shield Scan analyzes scripts and searches for patterns commonly associated with malicious behavior, such as:

  • Suspicious use of require().
  • Hidden loaders and script injectors.

The plugin focuses on assisting manual review rather than replacing it.

Limitations

  • False positives may occur.
  • New obfuscation methods may bypass detection.
  • Developers should always manually review flagged scripts.

Feedback

I’m actively improving the plugin and would appreciate feedback, bug reports, and suggestions from the community.

1 Like
2

image
image180Ă—212 2 KB

:sob:??

image
image228Ă—984 8.88 KB

also wouldnt this just flag like every script to ever exist as a backdoor

4 Likes
3

Thanks for the feedback!

You’re absolutely right that relying purely on keywords can lead to false positives. The current implementation is intentionally conservative and is designed to flag potentially suspicious patterns for manual review rather than definitively classify a script as a backdoor.

Regarding "d1h" specifically, that keyword wasn’t randomly chosen. I’ve encountered it multiple times while analyzing actual backdoor samples, which is why it was included in the list. That said, I agree that its usefulness should be re-evaluated and backed by more concrete detection logic.

I’m currently working on improving the scanner to reduce false positives and move beyond simple keyword matching where possible. The goal is to combine multiple indicators instead of treating every keyword match as equally suspicious.

Thanks again for taking the time to look through the repository and provide feedback, it’s genuinely helpful.

1 Like
4

i tried it, and it doesnt seem to detect the “PackageLink” backdoor which is like the most common one ever

1 Like
5

Thanks for reporting this. I’m actually not familiar with this specific PackageLink backdoor technique yet, so I’ll be looking into it. If you have an example or a sample place/model that contains it, I’d appreciate it as it would help me improve detection support for it.

6

there is no way this was written by an actual human

3 Likes
7

I’m from israel and this is my favourite resource :joy::victory_hand:t6: much love from tel aviv :israel::israel:

1 Like
8

literally search up “:glowing_star:” in toolbox and youll find like millions of the backdoor

9

That’s fair, English isn’t my first language, so I usually run longer replies through AI tools to help with grammar and make them easier to understand, and I probably overdid it on that one
But the actual point was just that I agreed with the criticism and started improving the scanner based on the feedback.

10

Honestly, thanks for pointing that out. I wasn’t aware of that backdoor when I first released ShieldScan, and I still researching it, but your comment definitely helped improve the plugin.