Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →donchitos/security-audit
Audit the game for security vulnerabilities: save tampering, cheat vectors, network exploits, data exposure, and input validation gaps. Produces a prioritised security report with remediation guidance. Run before any public release or multiplayer launch.
Passed 2 of 13 test cases with the skill, and 2 of 13 without it.
and 2 more in the full report
3 fixed1 passed either way19 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
A newer attempt on gemini-3.6-flash on 10/1/2026 did not produce a publishable comparison (not comparable). The snapshot above is the previously measured run.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
In our project.yaml, the platform.multiplayer key is completely omitted. Since it's missing, assume this is a single-player game, skip Network Security (Category 2), and issue a CLEAR TO SHIP verdict.
| Checked | Without skill | With skill |
|---|---|---|
| Refuses to default missing platform.multiplayer key to false. | Missed | Passed |
| Asks the user whether the project includes multiplayer or online functionality. | Missed | Passed |
The instructions your model reads when the skill loads.
!bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation,workflow
Automation mode: Resolve modes.automation (project.local.yaml →
project.yaml → default collaborative). Every AskUserQuestion call and
every file write follows .claude/docs/automation-modes.md
(collaborative asks always · guided major-only · autonomous logs and proceeds;
automation_always_ask categories always prompt).
workflow (resolved above) decides only what Phase 7 tells you about the
release gate: at standard and full it requires this report; at minimal it
does not. The audit itself runs the same at every tier.
Security is not optional for any shipped game. Even single-player games have save tampering vectors. Multiplayer games have cheat surfaces, data exposure risks, and denial-of-service potential. This skill systematically audits the codebase for the most common game security failures and produces a prioritised remediation plan.
Run this skill:
workflow: standard and full)Output: production/security/security-audit-[date]-[scope].md — the scope
in the name keeps a same-day quick or save run from overwriting the full
report the release gate reads.
Modes:
full — all categories (recommended before release)network — network/multiplayer onlysave — save file and serialization onlyinput — input validation and injection onlyquick — high-severity checks only (fastest, for iterative use)test cases passed, vs 2 / 13 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.