@adiholick/nvstudio-mcp 2.2.3 → 2.3.0

package/studio-plugin/preview_asset.lua

@@ -0,0 +1,99 @@
+--!strict
+-- ============================================================================
+-- Skill Module: preview_asset
+-- Deskripsi: Pratinjau & Pemindaian Keamanan Aset Creator Store Secara Terisolasi
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+local InsertService = game:GetService("InsertService")
+
+local SecurityScanner = require(script.Parent:WaitForChild("security_scanner"))
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local assetIdStr = ""
+    local deepScan = true
+
+    if typeof(data) == "string" then
+        local success, parsed = pcall(function()
+            return HttpService:JSONDecode(data)
+        end)
+        if success and typeof(parsed) == "table" then
+            assetIdStr = tostring(parsed.asset_id or parsed.assetId or "")
+            if parsed.deep_scan ~= nil then deepScan = parsed.deep_scan end
+        else
+            assetIdStr = data
+        end
+    elseif typeof(data) == "table" then
+        assetIdStr = tostring(data.asset_id or data.assetId or "")
+        if data.deep_scan ~= nil then deepScan = data.deep_scan end
+    end
+
+    local cleanIdStr = string.gsub(assetIdStr, "rbxassetid://", "")
+    cleanIdStr = string.gsub(cleanIdStr, "%s+", "")
+    local assetId = tonumber(cleanIdStr)
+
+    if not assetId or assetId <= 0 then
+        return { status = "error", error = "Asset ID tidak valid. Berikan Asset ID angka (contoh: 123456789)." }
+    end
+
+    -- Muat Aset secara terisolasi (unparented / memory only)
+    local ok, model = pcall(function()
+        return InsertService:LoadAsset(assetId)
+    end)
+
+    if not ok or not model then
+        return {
+            status = "error",
+            error = string.format("Gagal memuat aset ID %d. Pastikan Asset ID publik dan terdaftar di Creator Store.", assetId)
+        }
+    end
+
+    local scanResult
+    local scanOk, err = pcall(function()
+        scanResult = SecurityScanner.scanInstance(model, deepScan)
+    end)
+
+    local rootName = model.Name
+    local childrenOverview = {}
+    for _, child in ipairs(model:GetChildren()) do
+        table.insert(childrenOverview, {
+            name = child.Name,
+            className = child.ClassName,
+        })
+    end
+
+    -- Hancurkan model sementara dari memori (Cleanup Mutlak)
+    pcall(function()
+        model:Destroy()
+    end)
+
+    if not scanOk or not scanResult then
+        return {
+            status = "error",
+            error = "Gagal memindai aset: " .. tostring(err)
+        }
+    end
+
+    local recommendation = "Aman untuk dimasukkan langsung menggunakan insert_asset."
+    if scanResult.riskLevel == "DANGEROUS" then
+        recommendation = "PERINGATAN: Aset ini memiliki ancaman BERBAHAYA! Wajib gunakan 'insert_asset' dengan strip_scripts = true, atau hindari aset ini."
+    elseif scanResult.riskLevel == "WARNING" then
+        recommendation = "Perhatian: Aset mengandung skrip atau peringatan moderat. Periksa kembali atau gunakan strip_scripts = true jika skrip tidak diperlukan."
+    end
+
+    return {
+        status = "success",
+        result = {
+            assetId = assetId,
+            assetName = rootName,
+            riskLevel = scanResult.riskLevel,
+            recommendation = recommendation,
+            stats = scanResult.stats,
+            highThreatsCount = scanResult.highThreats,
+            mediumThreatsCount = scanResult.mediumThreats,
+            threats = scanResult.threats,
+            topLevelChildren = childrenOverview,
+        }
+    }
+end
+

package/studio-plugin/scan_security.lua

@@ -0,0 +1,81 @@
+--!strict
+-- ============================================================================
+-- Skill Module: scan_security
+-- Deskripsi: Audit Keamanan Instance/Model yang Sudah Ada di Tempat Kerja Studio
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+local SecurityScanner = require(script.Parent:WaitForChild("security_scanner"))
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local target = targetInstance or game.Workspace
+    local deepScan = true
+    local cleanThreats = false
+
+    if typeof(data) == "string" and #data > 0 then
+        local success, parsed = pcall(function()
+            return HttpService:JSONDecode(data)
+        end)
+        if success and typeof(parsed) == "table" then
+            if parsed.deep_scan ~= nil then deepScan = parsed.deep_scan end
+            if parsed.clean_threats ~= nil then cleanThreats = parsed.clean_threats end
+        end
+    elseif typeof(data) == "table" then
+        if data.deep_scan ~= nil then deepScan = data.deep_scan end
+        if data.clean_threats ~= nil then cleanThreats = data.clean_threats end
+    end
+
+    local scanResult
+    local ok, err = pcall(function()
+        scanResult = SecurityScanner.scanInstance(target, deepScan)
+    end)
+
+    if not ok or not scanResult then
+        return {
+            status = "error",
+            error = "Gagal memindai target: " .. tostring(err)
+        }
+    end
+
+    local cleanedScripts = {}
+    if cleanThreats and #scanResult.threats > 0 then
+        -- Hapus skrip yang terdeteksi bahaya (HIGH severity)
+        local scriptsToDestroy = {}
+        for _, threat in ipairs(scanResult.threats) do
+            if threat.severity == "HIGH" and threat.scriptPath then
+                scriptsToDestroy[threat.scriptPath] = true
+            end
+        end
+
+        local function purge(instance: Instance)
+            for _, desc in ipairs(instance:GetDescendants()) do
+                if desc:IsA("LuaSourceContainer") and scriptsToDestroy[desc:GetFullName()] then
+                    table.insert(cleanedScripts, {
+                        name = desc.Name,
+                        className = desc.ClassName,
+                        path = desc:GetFullName(),
+                    })
+                    pcall(function() desc:Destroy() end)
+                end
+            end
+        end
+
+        purge(target)
+    end
+
+    return {
+        status = "success",
+        result = {
+            target = target:GetFullName(),
+            riskLevel = scanResult.riskLevel,
+            stats = scanResult.stats,
+            highThreatsCount = scanResult.highThreats,
+            mediumThreatsCount = scanResult.mediumThreats,
+            threats = scanResult.threats,
+            cleanedThreatsCount = #cleanedScripts,
+            cleanedScripts = cleanedScripts,
+            isCleaned = cleanThreats,
+        }
+    }
+end
+

package/studio-plugin/security_scanner.lua

@@ -0,0 +1,346 @@
+--!strict
+-- ============================================================================
+-- Module: security_scanner
+-- Deskripsi: Engine Heuristik Pemindaian Keamanan & Backdoor Detection
+-- Standar: Business-Grade, Zero-Execution Isolation, Comprehensive Threat Rules
+-- ============================================================================
+
+local SecurityScanner = {}
+
+-- Daftar nama skrip yang sering digunakan oleh virus/backdoor klasik Roblox
+local SUSPICIOUS_SCRIPT_NAMES = {
+    "[Vv]accine",
+    "[Aa]nti[Ll]ag",
+    "[Ff]ix[Ll]ag",
+    "[Ii]nfection",
+    "[Ff]ire",
+    "[Cc]lean",
+    "[Vv]irus",
+    "4[Dd]",
+    "4[Dd]_[Pp]lugin",
+    "[Ss]pread",
+    "[Ll]ag[Ff]ixer",
+    "[Dd]up",
+}
+
+-- Aturan Pola Heuristik Kode Berbahaya
+local THREAT_PATTERNS = {
+    {
+        id = "BACKDOOR_REQUIRE",
+        pattern = "require%s*%(%s*%d+%s*%)",
+        severity = "HIGH",
+        name = "Backdoor Numeric Require",
+        description = "Memanggil modul eksternal pihak ketiga via Asset ID numerik (indikasi backdoor/remote loader).",
+    },
+    {
+        id = "LOADSTRING_EXEC",
+        pattern = "loadstring%s*%(",
+        severity = "HIGH",
+        name = "Dynamic Code Execution (loadstring)",
+        description = "Mengeksekusi string kode dinamis yang tidak dapat diaudit.",
+    },
+    {
+        id = "GETFENV_SETFENV",
+        pattern = "[gs]etfenv%s*%(",
+        severity = "HIGH",
+        name = "Environment Manipulation (getfenv/setfenv)",
+        description = "Memanipulasi environment global Luau untuk mengelabui analisis statis.",
+    },
+    {
+        id = "DISCORD_WEBHOOK",
+        pattern = "discord[a-z]*%.com/api/webhooks",
+        severity = "HIGH",
+        name = "Discord Webhook Exfiltration",
+        description = "Mencoba mengirimkan data game atau informasi pemain ke webhook eksternal Discord.",
+    },
+    {
+        id = "IP_LOGGER",
+        pattern = "webhook%.site|grabify%.link|iplogger|blasze",
+        severity = "HIGH",
+        name = "External IP/Data Logger",
+        description = "Menghubungi domain pencatat IP atau data capture pihak ketiga.",
+    },
+    {
+        id = "FORCED_PURCHASE",
+        pattern = "MarketplaceService%s*:%s*Prompt[A-Za-z]*Purchase",
+        severity = "MEDIUM",
+        name = "Forced Robux/Product Purchase",
+        description = "Memicu dialog pembelian paksa Gamepass atau Developer Product.",
+    },
+    {
+        id = "FORCED_TELEPORT",
+        pattern = "TeleportService%s*:%s*Teleport",
+        severity = "MEDIUM",
+        name = "Forced Game Teleportation",
+        description = "Memindahkan pemain secara paksa ke game/place lain.",
+    },
+    {
+        id = "CHAR_TABLE_OBFUSCATION",
+        pattern = "string%.char%s*%(%s*%d+%s*,%s*%d+%s*,%s*%d+",
+        severity = "HIGH",
+        name = "Obfuscated string.char Array",
+        description = "Menyusun kode rahasia tersembunyi menggunakan deretan kode karakter ASCII.",
+    },
+}
+
+-- Helper: Pengecekan nama script mencurigakan
+local function checkSuspiciousName(name: string): boolean
+    for _, pattern in ipairs(SUSPICIOUS_SCRIPT_NAMES) do
+        if string.find(name, pattern) then
+            return true
+        end
+    end
+    return false
+end
+
+-- Helper: Deteksi obfuscation byte escape (\108\111\97\100) atau hex (\x6c\x6f)
+local function checkByteObfuscation(source: string): (boolean, string?)
+    local byteCount = 0
+    for _ in string.gmatch(source, "\\[0-9][0-9][0-9]") do
+        byteCount = byteCount + 1
+        if byteCount >= 4 then
+            return true, "Terdeteksi deretan escape byte ASCII (\\ddd) berulang."
+        end
+    end
+
+    local hexCount = 0
+    for _ in string.gmatch(source, "\\x[0-9a-fA-F][0-9a-fA-F]") do
+        hexCount = hexCount + 1
+        if hexCount >= 4 then
+            return true, "Terdeteksi deretan escape hex (\\xHH) berulang."
+        end
+    end
+
+    return false, nil
+end
+
+-- Helper: Deteksi kode yang sengaja disembunyikan dengan spasi/baris kosong berlebih
+local function checkOffscreenHiding(source: string): (boolean, string?)
+    -- Cek spasi horizontal masif (> 80 spasi berturut-turut)
+    if string.find(source, "   " .. string.rep(" ", 80)) then
+        return true, "Kode sengaja didorong ke kanan dengan lebih dari 80 spasi agar tersembunyi dari layar Studio."
+    end
+
+    -- Cek baris kosong masif di awal skrip (> 15 baris kosong)
+    local leadingNewlines = 0
+    for line in string.gmatch(source, "([^\r\n]*)\r?\n") do
+        if string.gsub(line, "%s+", "") == "" then
+            leadingNewlines = leadingNewlines + 1
+            if leadingNewlines >= 15 then
+                return true, "Terdapat lebih dari 15 baris kosong di awal skrip untuk menyembunyikan payload di baris bawah."
+            end
+        else
+            break
+        end
+    end
+
+    return false, nil
+end
+
+-- Analisis Source Code dari sebuah Script
+local function scanScriptSource(scriptInstance: Instance, source: string): { any }
+    local threats = {}
+    local lines = string.split(source, "\n")
+
+    -- 1. Scan pola heuristik baris per baris
+    for lineIdx, line in ipairs(lines) do
+        -- Skip baris komentar murni
+        local trimmed = string.match(line, "^%s*(.-)%s*$") or ""
+        if not string.sub(trimmed, 1, 2) == "--" then
+            for _, rule in ipairs(THREAT_PATTERNS) do
+                local s, e = string.find(line, rule.pattern)
+                if s then
+                    local snippet = string.sub(line, math.max(1, s - 30), math.min(#line, e + 30))
+                    table.insert(threats, {
+                        severity = rule.severity,
+                        ruleId = rule.id,
+                        name = rule.name,
+                        scriptName = scriptInstance.Name,
+                        scriptPath = scriptInstance:GetFullName(),
+                        scriptClass = scriptInstance.ClassName,
+                        line = lineIdx,
+                        snippet = string.match(snippet, "^%s*(.-)%s*$") or snippet,
+                        description = rule.description,
+                    })
+                end
+            end
+        end
+    end
+
+    -- 2. Cek Obfuscation
+    local isObf, obfReason = checkByteObfuscation(source)
+    if isObf then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "BYTE_OBFUSCATION",
+            name = "Byte / Hex Obfuscation Payload",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = string.sub(source, 1, 60) .. "...",
+            description = obfReason or "Payload kode disamarkan menggunakan escape bytes.",
+        })
+    end
+
+    -- 3. Cek Off-screen Code Hiding
+    local isHidden, hideReason = checkOffscreenHiding(source)
+    if isHidden then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "OFFSCREEN_HIDING",
+            name = "Off-Screen Hidden Code",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = "[Whitespace Padding Terdeteksi]",
+            description = hideReason or "Kode disembunyikan menggunakan whitespace ekstrem.",
+        })
+    end
+
+    return threats
+end
+
+-- ============================================================================
+-- PUBLIC API
+-- ============================================================================
+
+-- Memindai Instance secara rekursif
+function SecurityScanner.scanInstance(rootInstance: Instance, deepScan: boolean?)
+    local shouldDeepScan = (deepScan ~= false)
+    local allThreats = {}
+    local stats = {
+        totalInstances = 1,
+        models = 0,
+        parts = 0,
+        meshParts = 0,
+        textures = 0,
+        scripts = {
+            total = 0,
+            server = 0,
+            localScript = 0,
+            module = 0,
+        },
+    }
+
+    local function inspectItem(item: Instance)
+        stats.totalInstances = stats.totalInstances + 1
+
+        if item:IsA("Model") then
+            stats.models = stats.models + 1
+        elseif item:IsA("MeshPart") then
+            stats.meshParts = stats.meshParts + 1
+            stats.parts = stats.parts + 1
+        elseif item:IsA("BasePart") then
+            stats.parts = stats.parts + 1
+        elseif item:IsA("Texture") or item:IsA("Decal") or item:IsA("SurfaceAppearance") then
+            stats.textures = stats.textures + 1
+        end
+
+        if item:IsA("LuaSourceContainer") then
+            stats.scripts.total = stats.scripts.total + 1
+            if item:IsA("Script") then
+                stats.scripts.server = stats.scripts.server + 1
+            elseif item:IsA("LocalScript") then
+                stats.scripts.localScript = stats.scripts.localScript + 1
+            elseif item:IsA("ModuleScript") then
+                stats.scripts.module = stats.scripts.module + 1
+            end
+
+            -- Cek nama mencurigakan
+            if checkSuspiciousName(item.Name) then
+                table.insert(allThreats, {
+                    severity = "HIGH",
+                    ruleId = "SUSPICIOUS_SCRIPT_NAME",
+                    name = "Known Malicious Script Name Pattern",
+                    scriptName = item.Name,
+                    scriptPath = item:GetFullName(),
+                    scriptClass = item.ClassName,
+                    line = 0,
+                    snippet = item.Name,
+                    description = string.format("Nama skrip '%s' cocok dengan pola nama virus/backdoor klasik.", item.Name),
+                })
+            end
+
+            -- Deep scan isi source code
+            if shouldDeepScan then
+                local success, source = pcall(function()
+                    return (item :: any).Source
+                end)
+                if success and typeof(source) == "string" and #source > 0 then
+                    local scriptThreats = scanScriptSource(item, source)
+                    for _, t in ipairs(scriptThreats) do
+                        table.insert(allThreats, t)
+                    end
+                end
+            end
+        end
+    end
+
+    inspectItem(rootInstance)
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        inspectItem(desc)
+    end
+
+    -- Hitung Level Risiko
+    local riskLevel = "SAFE"
+    local highCount = 0
+    local medCount = 0
+
+    for _, t in ipairs(allThreats) do
+        if t.severity == "HIGH" then
+            highCount = highCount + 1
+        elseif t.severity == "MEDIUM" then
+            medCount = medCount + 1
+        end
+    end
+
+    if highCount > 0 then
+        riskLevel = "DANGEROUS"
+    elseif medCount > 0 or stats.scripts.total > 0 then
+        riskLevel = "WARNING"
+    end
+
+    return {
+        riskLevel = riskLevel,
+        threats = allThreats,
+        stats = stats,
+        highThreats = highCount,
+        mediumThreats = medCount,
+    }
+end
+
+-- Menghapus seluruh skrip dari sebuah instance (Sanitasi Total)
+function SecurityScanner.stripScripts(rootInstance: Instance): { any }
+    local removed = {}
+
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        if desc:IsA("LuaSourceContainer") then
+            table.insert(removed, {
+                name = desc.Name,
+                className = desc.ClassName,
+                path = desc:GetFullName(),
+            })
+            pcall(function()
+                desc:Destroy()
+            end)
+        end
+    end
+
+    if rootInstance:IsA("LuaSourceContainer") then
+        table.insert(removed, {
+            name = rootInstance.Name,
+            className = rootInstance.ClassName,
+            path = rootInstance:GetFullName(),
+        })
+        pcall(function()
+            rootInstance:Destroy()
+        end)
+    end
+
+    return removed
+end
+
+return SecurityScanner
+

package/studio-plugin/set_properties.lua

@@ -12,6 +12,10 @@ return function(targetInstance, data, ctx, targetPath)
             local currentVal = targetInstance[prop]
             if typeof(currentVal) == "Vector3" and type(val) == "table" and #val == 3 then
                 targetInstance[prop] = Vector3.new(val[1], val[2], val[3])
+            elseif typeof(currentVal) == "Vector2" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = Vector2.new(val[1], val[2])
+            elseif typeof(currentVal) == "UDim" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = UDim.new(val[1], val[2])
             elseif typeof(currentVal) == "Color3" and type(val) == "table" and #val == 3 then
                 local r, g, b = val[1], val[2], val[3]
                 if r > 1 or g > 1 or b > 1 then
@@ -21,6 +25,12 @@ return function(targetInstance, data, ctx, targetPath)
                 end
             elseif typeof(currentVal) == "UDim2" and type(val) == "table" and #val == 4 then
                 targetInstance[prop] = UDim2.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "NumberRange" and type(val) == "table" then
+                targetInstance[prop] = NumberRange.new(val[1], val[2] or val[1])
+            elseif typeof(currentVal) == "Rect" and type(val) == "table" and #val >= 4 then
+                targetInstance[prop] = Rect.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "BrickColor" and type(val) == "string" then
+                targetInstance[prop] = BrickColor.new(val)
             elseif typeof(currentVal) == "CFrame" and type(val) == "table" then
                 targetInstance[prop] = CFrame.new(unpack(val))
             elseif typeof(currentVal) == "EnumItem" and type(val) == "string" then

package/studio-plugin/ui_manager.lua

@@ -95,7 +95,7 @@ function UIManager.init(pluginInstance, studioId)
 
     -- Version
     local versionLabel = Instance.new("TextLabel")
-    versionLabel.Text = "v2.2.0"
+    versionLabel.Text = "v2.3.0"
     versionLabel.Font = Enum.Font.Gotham
     versionLabel.TextSize = 11
     versionLabel.TextColor3 = Color3.fromRGB(120, 120, 130)