Network authority and exploit review
Skill hoatv2211/GameStudio-CodexKIT/skills/network-authority-and-exploit-review
Use when sensitive multiplayer or MMORPG client actions require static server-authority validation, trust-boundary, replay, abuse, or rate-limit analysis with no attack traffic.From its SKILL.md
npx -y skills add hoatv2211/GameStudio-CodexKIT --skill network-authority-and-exploit-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.4 KB, as published. Nobody here has run it
Network Authority and Exploit Review
Overview
Review who may request, validate, authorize, rate-limit, persist, and broadcast sensitive game actions without performing offensive testing.
When to use
Use for client-authoritative currency, inventory, combat, movement, reward, trade, admin, replay, duplication, or rate-limit concerns.
When NOT to use
Do not use to send exploit payloads, bypass authentication, scan external systems, or replace an authorized penetration test.
Required inputs and context discovery
Collect action list, trust boundaries, initiators, authoritative side, server validation, idempotency, replay protection, rate limits, persistence, audit logs, and supported threat assumptions.
Safety and risk level
Read-only static review. No live traffic, credential use, service control, player-data access, or exploit proof is authorized.
Workflow
- Map clients, gateways, servers, databases, and administrative trust boundaries. Completion criterion: every sensitive transition has an owner.
- Inventory sensitive actions and their authoritative side. Completion criterion: client-authoritative sensitive state is visible.
- Review validation, idempotency, replay, sequencing, and rate-limit guards. Completion criterion: missing guards become discrete findings.
- Trace persistence and broadcast behavior for abuse amplification. Completion criterion: exploit impact is bounded without attack execution.
- Rank source fixes and safe regression simulations. Completion criterion: live exploit attempts remain BLOCKED.
Evidence and output contract
Produce network-authority-review.json with trust boundaries, action contracts, findings, severity rationale, limitations, and defensive tests.
Handoff contract
Record reviewed actions, authority decisions, missing guards, sensitive paths, untested live assumptions, and next defensive owner.
Pitfalls and anti-rationalization
- Encryption does not replace server authority.
- A client UI restriction is not server validation.
- Do not prove impact on a live environment.
- Static review does not certify exploit absence.
Verification checklist
- Trust boundaries are explicit.
- Sensitive actions have authority owners.
- Validation, replay, and rate limits are reviewed.
- Findings cite source contracts.
- No attack traffic was sent.
References and scripts
Use the bundled scripts/authority_review.py on normalized action declarations and project-specific server contracts.