Don't trust us. Trust the CODE.

A while ago, I started investigating suspicious Roblox Toolbox models. What initially looked like ordinary assets turned into a much bigger investigation involving hidden scripts, dynamically loaded modules, and unusual GUI behavior.

I called that investigation Rig of Troy.

But eventually, I had a question:

What if I built a tool to help investigate suspicious code instead of manually searching for patterns every single time?

That's how CodeSentinel was born.

What is CodeSentinel?

CodeSentinel is a free, open-source desktop application developed under SyntaxError Interactive.

It performs static code analysis, meaning it inspects source code without intentionally executing the code being analyzed.

It currently supports:

  • Python — suspicious execution patterns and AST-based analysis.
  • Lua/Luau — dynamic loading, Roblox-specific behaviors, and suspicious GUI interactions.
  • JavaScript — dynamic code execution and other potentially dangerous patterns.

Features

CodeSentinel includes:

  • A graphical interface built with PySide6.
  • File opening, code pasting, and folder scanning.
  • Automatic language mismatch detection.
  • Severity levels for findings.
  • SHA-256 hashing.
  • JSON report export.
  • Cross-script behavioral correlation.
  • Explanations for detected patterns.

One of the more interesting features is the ability to identify related indicators across multiple scripts.

During development, I tested it against simplified examples based on the Rig of Troy investigation.

The analyzer successfully identified GUI installation behavior, input interception, and a correlation between indicators found in separate files.

Important: A correlation is not proof that two scripts are malicious or directly connected.

Does it detect every malicious script?

No.

And I don't want to pretend otherwise.

CodeSentinel is an experimental static analysis tool, not an antivirus or a replacement for a professional security audit.

It can produce false positives and false negatives.

Zero findings does not mean a file is safe.

The goal is to help developers identify code that deserves further investigation.

Testing

Before preparing the public beta, I ran seven manual test scenarios covering:

  • Legitimate and suspicious Python.
  • Legitimate Luau.
  • Multiple-script analysis.
  • Legitimate and suspicious JavaScript.
  • Language mismatch handling.
  • JSON reporting.

All seven scenarios passed after fixing an issue with cross-script correlation.

These tests are an initial validation, not a comprehensive measurement of detection accuracy.

Open Source

CodeSentinel is available under the MIT License.

You can inspect the source code, report bugs, suggest improvements, or contribute to development.

GitHub: https://github.com/Fireson2753/CodeSentinel

If a Windows executable is available in the repository's Releases section, you can download it there. Otherwise, the project can be run from source using Python and its listed dependencies.

What's Next?

For now, I'm keeping the analysis engine stable rather than adding features endlessly.

My priorities are improving reliability, gathering feedback, and expanding the test suite.

This project started with me investigating suspicious Roblox assets.

Now it's an open-source tool.

And that's pretty cool.

CodeSentinel — SyntaxError Interactive

Don't trust us. Trust the CODE.