security-audit

# Security Audit Security is not optional for any shipped game. Even single-player games have save tampering vectors. Multiplayer games have cheat surfaces, data exposure risks, and denial-of-service potential. This skill systematically audits the codebase for the most common game security failures and produces a prioritised remediation plan. **Run this skill:** - Before any public release (required for the Polish → Release gate) - Before enabling any online/multiplayer feature - After implementing any system that reads from disk or network - When a security-related bug is reported **Output:** `production/security/security-audit-[date].md` --- ## Phase 1: Parse Arguments and Scope **Modes:** - `full` — all categories (recommended before release) - `network` — network/multiplayer only - `save` — save file and serialization only - `input` — input validation and injection only - `quick` — high-severity checks only (fastest, for iterative use) - No argument — run `full` Read `docs/framework/technical-preferences.md` to determine: - Engine and language (affects which patterns to search for) - Target platforms (affects which attack surfaces apply) - Whether multiplayer/networking is in scope --- ## Phase 2: Spawn Security Engineer Spawn `security-engineer` via Task. Pass: - The audit scope/mode - Engine and language from technical preferences - A manifest of all source directories: `src/`, `assets/data/`, any config files The security-engineer runs the audit across 6 cat...