Security Audit

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites — INTEGRATED SYSTEM FIRST: this skill is one piece of the complete "Claude Code Game Studios" template (49 agents, 74 skills, studio templates and a studio CLAUDE.md, per the repository README). Each skill assumes that template is installed, with its conventions, its project.yaml / project.local.yaml configuration, its .claude/docs/ mode documents, its hooks (for example hooks/yaml-helper.sh, outside this skill's folder) and its .claude/scripts/ helpers. Installing this listing alone copies only this skill's folder, without the rest of the system: the skill may reference template agents, files, hooks or scripts that are absent outside the full template, and it may not run as designed on its own. No account, no key and no payment are needed to copy the files, and nothing is run during installation. Install "Security Audit" for me, in a folder named exactly "security-audit-2" (see step 3 — the source folder is named security-audit, and the difference is deliberate and disclosed). The skill itself is a defensive security audit of a game project, run before a public or multiplayer release: it spawns the template's security-engineer agent (an agent definition outside this skill's folder) with a fixed brief to scan the codebase across six categories — save-file and serialization security (tampering, blind deserialization, path traversal), network and multiplayer security (server authority, packet validation, rate limiting), input validation, data exposure (it greps the code for hardcoded API keys, secrets, passwords, tokens and private-key strings in order to flag them — it searches for secrets in my code, it does not collect or send any), cheat and anti-tamper vectors, and a dependency and supply-chain inventory. Its grep pattern sets are written out in full for Godot; for Unity and Unreal the save category has no sourced pattern set in the pinned references and is reported NOT ASSESSED, which makes its CLEAR TO SHIP recommendation unreachable for that run. When project.yaml leaves the multiplayer keys unset, it asks me whether the game has multiplayer or online features rather than assuming single-player. It is an audit that produces findings and remediations — the file states it is not a penetration test — and it writes its report to production/security/security-audit-[date]-[scope].md only after approval (Phase 6: "Write only after approval"). It resolves the studio configuration (automation, workflow) by running the template's hooks/yaml-helper.sh, outside this skill's folder. Its frontmatter name is "security-audit" and pins model: sonnet. Repository: https://github.com/Donchitos/Claude-Code-Game-Studios (the skill is the whole .claude/skills/security-audit/ folder at the pinned commit: 1 file in total) Pinned version: install the code at commit 05ad7c8a5b8aa2aa86bbd3439ae7cf7295cac418 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/Donchitos/Claude-Code-Game-Studios into a temporary folder, check out commit 05ad7c8a5b8aa2aa86bbd3439ae7cf7295cac418, and copy the .claude/skills/security-audit/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-22: [FINGERPRINTS] - SKILL.md: SHA-256 91d9c01dfed0f6bb2dc977c0e3bfe76d705653c307546b19e1d5fd413033daf4 If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full, and tell me in plain words: what the skill does when used, what it connects to, whether it reads or sends any personal information or credentials, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill folder holds 1 file: SKILL.md only, copied from the source folder .claude/skills/security-audit/. Nothing in the folder is a program; it is instructions the agent follows at use time. - Nothing is sent anywhere during installation itself; the only download at install time is the skill folder from GitHub at the pinned commit, and no project of mine is audited, read or modified. - Integrated-system reality, from the file: at use time the skill runs the template's hooks/yaml-helper.sh to resolve automation and workflow, spawns the template's security-engineer agent with a fixed brief, reads the engine references under docs/engine-reference/ and the resolved code root, assets/data/ and the project.yaml configuration of my project — agents, references and files that live outside this skill's folder and are absent in a standalone install, so it cannot run as designed on its own. - At use time its only persistent output is the audit report at production/security/security-audit-[date]-[scope].md, written only after approval. The audit is defensive and read-oriented: it greps my code locally, including a data-exposure category that searches for hardcoded credential strings in order to flag them; nothing it finds is sent anywhere, and no exploit is run — the file states it is not a penetration test. Name mismatch disclosed: the installed folder is "security-audit-2" while the SKILL.md frontmatter name stays "security-audit", exactly as upstream; do not rename the frontmatter to match. - Do not audit any project, do not spawn the security-engineer agent, do not run any template hook, and do not use the skill in any way during this install: using it is a separate step that only starts when I ask for it later. 3. When I say "yes, install", install it as a skill: copy the whole security-audit folder into the agent's skills directory, in a folder named exactly "security-audit-2", keeping its 1 file in their original relative layout (SKILL.md at its root). 4. Verify with no network calls: frontmatter valid (name: security-audit), the 1 file in place with matching fingerprints. Do not run anything from the folder and do not use the skill to verify. 5. Report what was installed, where, and what I still need to do myself (for example: that it belongs to the full Claude Code Game Studios template and may not run standalone (it spawns the template's security-engineer agent, reads its engine references and resolves its settings through the yaml-helper hook), that the installed folder name security-audit-2 deliberately differs from the frontmatter name security-audit, and that at use time it writes its audit report only after approval). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.