The Resources page lists every resource on your server. It needs the Scripts permission and a connected server.
The resource list#
Each resource shows its name, description, version (both read from its manifest) and its state: Running, Starting, Stopping, Stopped or Unknown. Use the search box to filter.
Open a resource's menu to Start, Stop or Restart it. The command runs on your server straight away. A restart stops the resource and starts it again one second later.
Stopping a resource that others depend on can break your server. Stopping AstroShield itself switches the protection off until you start it again.
Resource inspect#
Inspect resource opens a read-only report about one resource, with four tabs:
| Tab | Content |
|---|---|
| Findings | Risky patterns that the scan found in the resource's Lua files. |
| Overview | Resource name, state, games and its path on the server. |
| Manifest | Dependencies, server, client and shared scripts and declared files. |
| Files | The files the manifest declares. |
What the scan looks for#
The scan is a static analysis of the resource's Lua files. It never loads or runs the code. Each finding has a severity, a confidence percentage and a recommendation. The checks are:
| Finding | What it points at |
|---|---|
| Dynamic command execution | ExecuteCommand called with a command that is built from variables. |
| Unsecured client-side trigger | Client code that triggers a server event whose name suggests money, items, permissions or bans. |
| Unprotected server-side net event | A server event handler that gives money or items, changes permissions, runs a command or bans, with no visible check of who called it. |
| Dynamic code execution | load() or loadstring(), which can run arbitrary code at runtime. |
| Insecure HTTP request (possible SSRF) | PerformHttpRequest with a URL that is built dynamically. |
Infinite loop without Wait() | A while true do loop with no Wait(), which can freeze the resource thread. |
The scan reads at most 60 Lua files of a resource, up to 1.5 MB each, and reports up to 200 findings. When a resource is bigger than that the report says Scan coverage was capped.
Findings are hints, not verdicts. A finding in a trusted resource is often a false alarm, and a clean scan does not prove a resource is safe. Use it to decide what to review by hand.