Many sites offering "Free OP Scripts" bundle their downloads with Keyloggers or Trojans that can steal your Discord tokens or browser passwords.
Never trust the client. Always validate instructions on the server side.
Users use a third-party tool called an executor (like Synapse X, Script-Ware, or Krnl) to inject code into the Roblox client.
If you are a Roblox developer, you can defend your game against these "Universal" scripts by:
"ESP" (seeing players through walls) and "Fullbright" for dark maps.