Script Safety
Treat a script like any other program you install. Read its source, understand its permissions, and know how to stop it.
Before you run it
- Obtain the script from a source you trust.
- Confirm every Hexis member against the current public reference.
- Review every requested permission.
- Look for chat commands, external requests, stored data, and inventory changes.
- Keep a visible stop control available.
Permission review
A script should request only what its goal requires. A navigation-only workflow should not need unrelated external communication or broad data access. If the reason for a permission is unclear, do not approve it.
Generated scripts
AI-generated code needs the same review as downloaded code. Models can invent
functions, omit failure handling, or request excessive access. Use
llms-api.txt as the allowlist for
Hexis members.
Sensitive data
Never place licenses, authentication tokens, private configuration, or personal data in Lua source. Remove sensitive values from logs before sharing them for support or AI-assisted debugging.
Stop on uncertainty
Stop the script when its observed state no longer matches its assumptions, its timeout expires, a documented permission is denied, or you cannot explain what it will do next.