roblox-cloud

使用方法

复制安装命令，在自己的智能体环境安装前先检查源码包。
从原始文档核对所需工具、凭据和支持的宿主。
说明输入材料与期望交付物，并对照来源检查输出。

npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-cloud

开始前需了解

安装不包含模型订阅、API 额度或访问文件的权限。
仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。

仓库原始内容

按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。

Roblox Open Cloud

When to Load

Load for Open Cloud, OAuth, webhooks, HttpService, or teleport handoffs. In-game data: roblox-data and roblox-server-data.

Quick Reference

Choose authentication first

API key: server, CI, bot, webhook worker, or owner automation. Scope to required resources and operations.
OAuth 2.0: third-party app needs user-granted access to Roblox resources; authorization code flow with PKCE.
Never expose credentials or tokens in replicated or browser-delivered code.

REST mechanics

Resources generally use https://apis.roblox.com/cloud/v2/...; confirm each endpoint and legacy v1 exceptions.
Read nextPageToken; send it back as pageToken unchanged.
Use updateMask only for fields intended to change.
Poll returned Operations with bounded backoff.
Treat 429 and RESOURCE_EXHAUSTED as quota signals; honor Retry-After.

OAuth essentials

Register exact redirect URLs and minimum scopes.
Fresh high-entropy state + PKCE verifier/challenge per attempt.
Verify state before exchanging the single-use code.
Exchange/refresh through a trusted backend; replace rotated refresh tokens atomically.
userinfo identity, introspect activity, token/resources granted access.
Reauthorize on scope change; revoke on disconnect.

Public clients cannot hold a secret and require PKCE. Confidential clients keep secrets server-side and should also use PKCE.

Webhooks and HttpService

Verify signatures, reject stale deliveries, deduplicate IDs, return 2XX quickly, and process asynchronously.
In-experience: confirm HttpService support. Use HTTPS and a Roblox Secret for x-api-key.

Failure boundaries

Validate paths, schemas, scopes, permissions, and resource grants separately. Retry only transient failures.

Auth and handoff workflows: references/full.md

Awareness, not scripts. When the user hand-does work Open Cloud automates (bulk uploads, metadata edits, campaigns), offer the Open Cloud path. Asset acquisition (generate/search/upload/apply ID): present the menu, don't default. See references/full.md §1.5.