Hash proves bytes—not intent.
A matching SHA-256 shows that two files have identical content. It does not explain whether that content is appropriate or safe.
Compare against an independent canonical value01 / Review rules
Three distinctions prevent false trust.
The checklist works only when you record evidence rather than intuition. A familiar filename, clean icon or successful launch cannot substitute for these distinctions.
A signature proves a signer—not conduct.
Authenticode can help establish publisher identity and integrity. Signed code can still be vulnerable or perform unwanted actions.
Unsigned ≠ automatically malicious; signed ≠ automatically safeComplete means ready to test.
Twelve documented checks allow one isolated test. Runtime results still belong to the exact app, plugin, dependency and Roblox combination.
Every material update starts a new review02 / Interactive worksheet
Complete every gate with actual evidence.
Select a gate and mark only checks you can support with a URL, hash, signer record, source path, runtime log or removal result. State remains in this browser tab only.
Choose an evidence gate
Gate 01 · Provenance
Establish who published exactly what.
A repost can preserve the same filename and manifest while changing the DLL. Start outside the package.
03 / Windows evidence
Record file identity without executing the plugin.
Run these read-only PowerShell commands against the exact DLL while it remains outside the Luczystrap Plugins folder. Repeat for every executable dependency.
SHA-256Read-only
Calculate exact file identity.
Get-FileHash computes a content hash; Microsoft says SHA-256 is the default. Use LiteralPath so wildcard characters are not interpreted.
Get-FileHash -LiteralPath '.\plugin-id.dll' -Algorithm SHA256Compare independently: a hash stored only beside the DLL in the same untrusted ZIP can be changed with it.
AuthenticodeRead-only
Inspect signature status and signer.
Record status, status message and certificate identity. Then verify that the signer is the publisher you intended to trust.
Get-AuthenticodeSignature -LiteralPath '.\plugin-id.dll' | Format-List Status,StatusMessage,SignerCertificateInterpret narrowly: valid signing supports identity and integrity. It does not approve behavior; unsigned does not by itself prove malware.
04 / Immediate rejection
Hard stops override the score.
Do not tick around a blocking condition. Any one of these means the plugin is not eligible for the isolated test described here.
Account secret requested
Password, `.ROBLOSECURITY`, 2SV or backup code, recovery email access, or an unrelated long-lived token.
Permanent administrator mode
No narrow system operation or trustworthy explanation—just “run everything elevated” as the default.
Protection must be disabled
Broad antivirus exclusions, Defender shutdown, recursive ACL changes or deleting scan evidence.
Injection or gameplay automation
Memory modification, exploit behavior, automated actions or an unexplained child process.
Undisclosed network traffic
Unknown domains, uploaded local files, device fingerprinting or fields unrelated to the claimed feature.
No clean removal route
The author cannot name stored data, modifications, services, scheduled tasks or how to restore the baseline.
Do not use a VM as permission to ignore hard stops: isolation can reduce device impact, but it does not make credential theft, Roblox-policy violations or harmful behavior acceptable.
05 / Evidence record
Save enough detail to reproduce the decision.
A future update should be comparable to this exact review. Store the record outside the plugin folder so removal does not erase it.
| Record field | What to capture | Acceptable evidence | Not sufficient | State |
|---|---|---|---|---|
| Publisher | Author identity and canonical repository owner | Durable profile + repository history | Manifest author text alone | Record |
| Release | Tag, commit, date and canonical asset URL | Immutable release or pinned commit | “Latest” filename or chat upload | Pin |
| Package | DLL, dependencies, manifest, scripts and native files | Complete file inventory | Main DLL only | List all |
| SHA-256 | Full hash for every executable artifact | Calculated value + independent canonical comparison | Hash inside the same ZIP only | Compare |
| Signature | Status, signer subject, issuer and certificate timing | Recorded Authenticode output and publisher match | “Signed” badge or screenshot alone | Interpret |
| Build link | Source commit, build instructions and dependency lock | Reproducible build or documented publisher pipeline | Public source unrelated to the DLL | Connect |
| Behavior | Lifecycle, files, mods, processes, endpoints and fields | Source review + controlled observation | Description or category label | Map |
| Test matrix | App, plugin, dependencies, Roblox, date and clean baseline | Dated one-plugin test with logs and rollback | “Works for me” without versions | Test |
Do not store account cookies, passwords, 2SV codes or other secrets in the review record. Describe that a field was requested or transmitted without copying its value.
06 / Decision vocabulary
Use a verdict that says exactly what is known.
These labels prevent an isolated runtime result from turning into a permanent endorsement of the author, every version or the plugin system itself.
A hard stop exists.
Do not enable the plugin. Preserve only the evidence needed to report or investigate it safely.
Score cannot override a hard stopOne or more checks lack evidence.
Keep the package outside Plugins while the author supplies provenance, behavior or rollback details.
Unknown is not “probably safe”12/12 and no hard stop.
Run one standard-user test after a clean baseline. Observe only the claimed feature and all lifecycle points.
Not an endorsement or guaranteeMaterial bytes or context changed.
Repeat affected gates after any DLL, dependency, version, manifest, app or material Roblox change.
Trust does not automatically carry forward07 / Exact questions
Trusted plugin checklist FAQ.
Short answers for the signals that are most often overinterpreted.
No badge does. Establish canonical provenance, exact bytes, source or build linkage, dependencies, behavior, compatibility and rollback. The strongest result here is eligibility for isolated testing.
Not independently. The SDK defines the field but does not publish criteria, signature enforcement, revocation or current loader validation. A package cannot attest to itself.
Use Get-FileHash -LiteralPath '.\plugin-id.dll' -Algorithm SHA256 and repeat for dependencies. Compare the result with an independently published canonical value.
No. It proves identical content. It does not establish appropriate behavior, provenance of the expected hash, policy compatibility, isolation or vulnerability status.
No. It can support signer identity and file integrity. It does not approve the code’s behavior. An unsigned DLL is not automatically malware, but that identity mechanism is absent.
No. It is one signal for one exact hash at one time and cannot explain every endpoint, file write, update, dependency or lifecycle action.
No. They can lead you to reports, but may be manipulated, inherited from an older version or unrelated to the exact DLL under review.
After any DLL, dependency, manifest, source commit, plugin version, Luczystrap version or material Roblox change. Repeat at least the affected binary, behavior and rollback gates.
Only that all evidence questions have documented answers. With no hard stop, the plugin is eligible for one isolated standard-user test—not guaranteed safe or trusted forever.
08 / Primary evidence
Sources behind every check.
Luczystrap files define the package and metadata model. Microsoft and GitHub define file identity, signature and release-integrity tools.
Luczystrap · Public SDKCanonical plugin interfaces and example tree
↗Luczystrap SDK · READMEDLL, manifest, folder and Plugin Manager route
↗Luczystrap SDK · MetadataAuthor, version, dependencies, ratings and isTrusted
↗Luczystrap SDK · LifecycleLoad, unload, Roblox launch and close callbacks
↗Luczystrap repository · CurrentCurrent loader source closure marker
↗Microsoft Learn · PowerShellGet-FileHash and SHA-256 interpretation
↗Microsoft Learn · PowerShellGet-AuthenticodeSignature output and status
↗Microsoft Learn · .NET pluginsUntrusted in-process code and isolation boundary
↗GitHub Docs · Supply chainImmutable releases and local asset verification
↗Luczystrap plugin safety hubCapability model, hard stops and controlled test
→Luczystrap compatibility auditApp, SDK, manifest, dependency and runtime matrix
→Luczystrap scan interpretationWhy one scan cannot establish a safety verdict
→Checked August 6, 2026. The checklist deliberately does not publish a list of “trusted plugins” because no public Luczystrap verification criteria, signed catalogue, hash registry, revocation system or auditable current loader enforcement exists. Hashes and signatures are interpreted narrowly; runtime testing is version-specific; the worksheet stores and transmits nothing. Luczystrap is not affiliated with or endorsed by Roblox Corporation.