# Security Audit

Security audit, save tampering, cheat vectors, network exploits, data exposure, input...

- Repository: https://github.com/Donchitos/Claude-Code-Game-Studios (32144 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-19
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Donchitos/Claude-Code-Game-Studios --skill security-audit -g -a claude-code -y`
Codex: `npx skills add Donchitos/Claude-Code-Game-Studios --skill security-audit -g -a codex -y`
Cursor: `npx skills add Donchitos/Claude-Code-Game-Studios --skill security-audit -g -a cursor -y`
Gemini CLI: `npx skills add Donchitos/Claude-Code-Game-Studios --skill security-audit -g -a gemini-cli -y`

## Description

Security audit, save tampering, cheat vectors, network exploits, data exposure, input validation. Before public or multiplayer release.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

!`bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation,workflow`

**Automation mode**: Resolve `modes.automation` (`project.local.yaml` →
`project.yaml` → default `collaborative`). Every `AskUserQuestion` call and
every file write follows `.claude/docs/automation-modes.md`
(collaborative asks always · guided major-only · autonomous logs and proceeds;
`automation_always_ask` categories always prompt).

**`workflow`** (resolved above) decides only what Phase 7 tells you about the
release gate: at `standard` and `full` it requires this report; at `minimal` it
does not. The audit itself runs the same at every tier.

# Security Audit

Security is not optional for any shipped game. Even single-player games have
save tampering vectors. Multiplayer games have cheat surfaces, data exposure
risks, and denial-of-service potential. This skill systematically audits the
codebase for the most common game security failures and produces a prioritised
remediation plan.

**Run this skill:**
- Before any public release (required for the Polish → Release gate at `workflow: standard` and `full`)
- Before enabling any online/multiplayer feature
- After implementing any system that reads from disk or network
- When a security-related bug is reported

**Output:** `production/security/security-audit-[date]-[scope].md`, the scope
in the name keeps a same-day `quick` or `save` run from overwriting the `full`
report the release gate reads.

---

## Phase 1: Parse Arguments and Scope

**Modes:**
- `full`, all categories (recommended before release)
- `network`, network/multiplayer only
- `save`, save file and serialization only
- `input`, input validation and injection only
- `quick`, high-severity checks only (fastest, for iterative use)
- No argument, run `full`

The rest: https://github.com/Donchitos/Claude-Code-Game-Studios/blob/HEAD/.claude/skills/security-audit/SKILL.md