# Network Authority And Exploit Review

> Use when sensitive multiplayer or MMORPG client actions require static server-authority validation, trust-boundary, replay, abuse, or rate-limit analysis with no attack traffic.

- Skill: `hoatv2211/network-authority-and-exploit-review` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add hoatv2211/network-authority-and-exploit-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hoatv2211/network-authority-and-exploit-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: hoatv2211 (https://skillmd.com/u/hoatv2211)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hoatv2211/network-authority-and-exploit-review

---

# Network Authority and Exploit Review

## Overview
Review who may request, validate, authorize, rate-limit, persist, and broadcast sensitive game actions without performing offensive testing.

## When to use
Use for client-authoritative currency, inventory, combat, movement, reward, trade, admin, replay, duplication, or rate-limit concerns.

## When NOT to use
Do not use to send exploit payloads, bypass authentication, scan external systems, or replace an authorized penetration test.

## Required inputs and context discovery
Collect action list, trust boundaries, initiators, authoritative side, server validation, idempotency, replay protection, rate limits, persistence, audit logs, and supported threat assumptions.

## Safety and risk level
Read-only static review. No live traffic, credential use, service control, player-data access, or exploit proof is authorized.

## Workflow
1. Map clients, gateways, servers, databases, and administrative trust boundaries.
   Completion criterion: every sensitive transition has an owner.
2. Inventory sensitive actions and their authoritative side.
   Completion criterion: client-authoritative sensitive state is visible.
3. Review validation, idempotency, replay, sequencing, and rate-limit guards.
   Completion criterion: missing guards become discrete findings.
4. Trace persistence and broadcast behavior for abuse amplification.
   Completion criterion: exploit impact is bounded without attack execution.
5. Rank source fixes and safe regression simulations.
   Completion criterion: live exploit attempts remain BLOCKED.

## Evidence and output contract
Produce `network-authority-review.json` with trust boundaries, action contracts, findings, severity rationale, limitations, and defensive tests.

## Handoff contract
Record reviewed actions, authority decisions, missing guards, sensitive paths, untested live assumptions, and next defensive owner.

## Pitfalls and anti-rationalization
- Encryption does not replace server authority.
- A client UI restriction is not server validation.
- Do not prove impact on a live environment.
- Static review does not certify exploit absence.

## Verification checklist
- [ ] Trust boundaries are explicit.
- [ ] Sensitive actions have authority owners.
- [ ] Validation, replay, and rate limits are reviewed.
- [ ] Findings cite source contracts.
- [ ] No attack traffic was sent.

## References and scripts
Use the bundled [scripts/authority_review.py](scripts/authority_review.py) on normalized action declarations and project-specific server contracts.