[Mark Sir Link]

in the onActionServerside portion of the script you should be verifying that the player who sent the trigger is actually someone you expect it to be, IE

if(player.account in serveroptions.staff.tokenize(","))