# Game Security Research

> Authorized game-client, protocol, replay, and anti-tamper security research for local, self-hosted, or intentionally vulnerable training targets.

- Skill: `purpleailab/game-security-research` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/game-security-research`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/game-security-research/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/game-security-research

---


# Game Security Research

## Scope

Use only local, self-hosted, or intentionally vulnerable game targets with
written authorization. Do not create or deploy online-game cheats, anti-cheat
bypasses, ban evasion, aim assistance, overlays, memory manipulation, or
multiplayer disruption tooling.

## Research workflow

1. **Pin client and server builds.** Record executable hashes, engine version,
   platform, symbols, server commit, and local-lab topology before inspection.
2. **Map trust boundaries.** Identify which values are authoritative on the
   server: inventory, currency, movement, progression, matchmaking, replay, and
   entitlement state. Classify client-only checks as hypotheses until server
   state is measured.
3. **Analyze accepted artifacts.** Inspect local save files, replay formats,
   asset bundles, protocol schemas, and debug telemetry. Keep raw captures and
   parsed summaries separate.
4. **Validate safely.** Submit the minimum input to the self-hosted target and
   record the server-observed state transition. Run the corresponding ordinary
   player action as the negative control.
5. **Evaluate defenses.** Exercise anti-tamper and telemetry only as a defender:
   confirm expected alerts, integrity checks, and server-side rejection after a
   local test case. Never develop an evasion workflow.

## Promotion rule

A reportable finding must include the pinned build identity, minimal replay or
request, packet/trace evidence, server-side state delta, baseline result, and a
post-remediation replay. A client-only display change is not proof of impact.