awesome-game-security-overview

어떤 스킬인가요?

Find, select, classify, or maintain resources in awesome-game-security. Use for repository navigation, category placement, duplicate review, generated descriptions, wiki coverage, or choosing a domain skill.

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

---
name: awesome-game-security-overview
description: Find, select, classify, or maintain resources in awesome-game-security. Use for repository navigation, category placement, duplicate review, generated descriptions, wiki coverage, or choosing a domain skill.
---

# Awesome Game Security resource selection

Start from the user's object and desired output, then load only the repository layers and domain skill needed. Collection membership is a discovery signal, not proof of quality, compatibility, or endorsement.

## Topic routing

- [Catalog workflow](references/catalog-workflow.md) for domain selection, repository search, result format, maintenance, categories, and quality records.
- [Repository navigation](references/repository-navigation.md) for README, descriptions, archives, wiki, and scripts.
- [Coverage roadmap](references/coverage-roadmap.md) and [quality review](references/quality-review-2026-09-09.md) for catalog maintenance.
- Use `game-security-research-rigor` with the selected domain skill when the task asks for technical conclusions.

Prefer the existing `scripts/repository_index.py` for deterministic index queries instead of loading the full README or archive tree.

#!/usr/bin/env python3
"""Read-only README section and local repository-layer lookup; standard library only."""

import argparse
import hashlib
import json
import re
import sys
from pathlib import Path
from urllib.parse import unquote, urlsplit


SLUG = re.compile(r"[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9_.-]+")
URL = re.compile(r"https://github\.com/[^\s<>\"'\]\)]+", re.IGNORECASE)
FENCE = re.compile(r"^ {0,3}(\x60{3,}|~{3,})(.*)$")
NON_REPO_ROUTES = {
    "stars", "topics", "orgs", "organizations", "users", "sponsors",
    "collections", "settings", "features", "marketplace", "login", "signup",
    "search", "about", "enterprise", "security", "site", "notifications",
    "new", "apps", "codespaces", "pulls", "issues", "discussions", "explore",
    "events", "trending", "customer-stories",
}


def repo_slug(value):
    """Identify a GitHub repository without discarding the original URL."""
    if value.lower().startswith("https://"):
        parsed = urlsplit(value)
        if parsed.netloc.lower() != "github.com":
            raise ValueError("Expected a github.com repository URL.")
        parts = unquote(parsed.path).strip("/").split("/")
        value = "/".join(parts[:2])
    if value.endswith(".git"):
        value = value[:-4]
    if not SLUG.fullmatch(value) or value.split("/")[1] in {".", ".."}:
        raise ValueError("Expected owner/repository or a GitHub repository URL.")
    if value.split("/")[0].casefold() in NON_REPO_ROUTES:
        raise ValueError("GitHub navigation URL is not a repository identity.")
    return value


def parse_readme(text):
    """Parse this repository's H2/blockquote/bullet convention, excluding fences."""
    sections, entries = [], []
    section = None
    subsection = None
    fence_char, fence_length = None, 0
    lines = text.splitlines()
    for number, line in enumerate(lines, 1):
        match = FENCE.match(line)
        if fence_char:
            if (match and match[1][0] == fence_char
                    and len(match[1]) >= fence_length and not match[2].strip()):
                fence_char = None
            continue
        if match:
            fence_char, fence_length = match[1][0], len(match[1])
            continue
        if line.startswith("## "):
            if section:
                section["end_line"] = number - 1
            section = {"title": line[3:].strip(), "line": number,
                       "end_line": len(lines), "subsections": [], "github_entries": 0}
            sections.append(section)
            subsection = None
        elif section and line.startswith("> "):
            subsection = line[2:].strip()
            section["subsections"].append({"title": subsection, "line": number})
        elif section and re.match(r"^\s*[-*+]\s+", line):
            for match in URL.finditer(line):
                original = match[0].rstrip(".,;:")
                try:
                    slug = repo_slug(original)
                except ValueError:
                    continue
                entries.append({"repo": slug, "url": original,
                                "repository_url": "https://github.com/" + slug,
                                "section": section["title"], "subsection": subsection,
                                "line": number})
                section["github_entries"] += 1
    return sections, entries


def matching_children(parent, name, directory):
    if not parent.is_dir():
        return []
    return sorted(
        (path for path in parent.iterdir()
         if path.name.casefold() == name.casefold()
         and (path.is_dir() if directory else path.is_file())),
        key=lambda path: path.name,
    )


def layer_paths(root, slug):
    """Resolve layers independently and expose every case-only match."""
    owner, repo = slug.split("/")
    descriptions, archives = [], []
    for owner_dir in matching_children(root / "description", owner, True):
        for repo_dir in matching_children(owner_dir, repo, True):
            descriptions.extend(matching_children(repo_dir, "description_en.txt", False))
    for owner_dir in matching_children(root / "archive", owner, True):
        archives.extend(matching_children(owner_dir, repo + ".txt", False))

    def result(paths):
        return {
            "status": "missing" if not paths else "present" if len(paths) == 1 else "ambiguous",
            "paths": [path.relative_to(root).as_posix() for path in paths],
        }

    return {"description": result(descriptions), "archive": result(archives)}


def find_root():
    candidates = [Path.cwd(), *Path.cwd().parents, *Path(__file__).resolve().parents]
    for candidate in candidates:
        if (candidate / "README.md").is_file() and (candidate / ".claude/skills").is_dir():
            return candidate
    raise ValueError("Repository checkout not found; pass --root explicitly.")


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--root", type=Path, help="awesome-game-security checkout")
    mode = parser.add_mutually_exclusive_group()
    mode.add_argument("--section", help="Exact README H2 title (case-insensitive)")
    mode.add_argument("--repo", help="owner/repository or GitHub repository URL")
    parser.add_argument("--subsection", help="Exact blockquote title; requires --section")
    parser.add_argument("--limit", type=int, default=20, help="Maximum section entries (default 20)")
    args = parser.parse_args()
    if args.subsection and not args.section:
        parser.error("--subsection requires --section")
    if args.limit < 1:
        parser.error("--limit must be positive")
    try:
        root = args.root.resolve() if args.root else find_root()
        raw = (root / "README.md").read_bytes()
        sections, entries = parse_readme(raw.decode("utf-8"))
        report = {"root": str(root), "readme_sha256": hashlib.sha256(raw).hexdigest(),
                  "scope": "local discovery metadata; no upstream verification or code execution"}
        if args.repo:
            slug = repo_slug(args.repo)
            matches = [entry for entry in entries if entry["repo"].casefold() == slug.casefold()]
            report.update(repo=slug, occurrences=matches, layers=layer_paths(root, slug))
        elif args.section:
            selected = [section for section in sections
                        if section["title"].casefold() == args.section.casefold()]
            if not selected:
                raise ValueError("Unknown section; run without filters to list current headings.")
            if args.subsection and not any(
                sub["title"].casefold() == args.subsection.casefold()
                for section in selected for sub in section["subsections"]
            ):
                raise ValueError("Unknown subsection in the selected section.")
            matches = [entry for entry in entries
                       if entry["section"].casefold() == args.section.casefold()
                       and (not args.subsection or
                            (entry["subsection"] or "").casefold() == args.subsection.casefold())]
            report.update(sections=selected, total_matches=len(matches),
                          truncated=len(matches) > args.limit, entries=matches[:args.limit])
        else:
            report.update(section_count=len(sections), sections=sections)
        print(json.dumps(report, ensure_ascii=False, indent=2))
    except (OSError, UnicodeError, ValueError) as error:
        print(str(error), file=sys.stderr)
        return 1
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

"""Functional checks for local discovery; no network, archived code or maintenance jobs."""

import hashlib
import json
import subprocess
import sys
import tempfile
import unittest
from pathlib import Path

import repository_index as index


class RepositoryIndexTests(unittest.TestCase):
    def test_fences_do_not_create_categories_or_entries(self):
        fence = "\x60" * 4
        text = (
            "## First\n> Source\n- https://github.com/Owner/One\n"
            + fence + "markdown\n## Fake\n- https://github.com/No/Entry\n"
            + "\x60" * 3 + "\n## Also Fake\n"
            + fence + "\n## Second\n- https://github.com/Owner/Two\n"
        )
        sections, entries = index.parse_readme(text)
        self.assertEqual([s["title"] for s in sections], ["First", "Second"])
        self.assertEqual([e["repo"] for e in entries], ["Owner/One", "Owner/Two"])
        self.assertEqual(entries[1]["subsection"], None)
        self.assertEqual(sections[0]["end_line"], sections[1]["line"] - 1)

    def test_deep_link_and_multiple_occurrences_keep_identity(self):
        text = (
            "## Tools\n> Source\n"
            "- [Example](https://github.com/Owner/Repo/blob/abc/file.cc#L2)\n"
            "- https://github.com/owner/repo.git\n"
        )
        _, entries = index.parse_readme(text)
        self.assertEqual(len(entries), 2)
        self.assertEqual(entries[0]["repo"], "Owner/Repo")
        self.assertTrue(entries[0]["url"].endswith("/blob/abc/file.cc#L2"))
        self.assertEqual(entries[1]["repo"], "owner/repo")

    def test_organization_navigation_and_non_github_are_not_repos(self):
        text = (
            "## Tools\n- https://github.com/game-ci\n"
            "- https://github.com/stars/someone/lists/debugger\n"
            "- https://github.com/orgs/example/repositories\n"
            "- https://example.org/Owner/Repo\n"
            "- https://github.com/Owner/Repo\n"
        )
        _, entries = index.parse_readme(text)
        self.assertEqual([e["repo"] for e in entries], ["Owner/Repo"])

    def test_invalid_identity_is_rejected(self):
        for value in ("../repo", "owner/..", "owner/repo/extra",
                      "https://example.org/owner/repo", "stars/someone"):
            with self.subTest(value=value), self.assertRaises(ValueError):
                index.repo_slug(value)

    def test_layers_resolve_independently_and_preserve_actual_case(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            desc = root / "description/Owner/Repo/description_en.txt"
            archive = root / "archive/OWNER/REPO.txt"
            desc.parent.mkdir(parents=True)
            archive.parent.mkdir(parents=True)
            desc.write_text("summary", encoding="utf-8")
            archive.write_text("snapshot", encoding="utf-8")
            result = index.layer_paths(root, "owner/repo")
            self.assertEqual(result["description"]["paths"], ["description/Owner/Repo/description_en.txt"])
            self.assertEqual(result["archive"]["paths"], ["archive/OWNER/REPO.txt"])
            self.assertEqual(index.layer_paths(root, "owner/missing")["archive"]["status"], "missing")

    def test_cli_limit_hash_and_no_checkout_mutation(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            raw = b"## Tools\n> Source\n- https://github.com/One/Repo\n- https://github.com/Two/Repo\n"
            (root / "README.md").write_bytes(raw)
            script = Path(index.__file__).resolve()
            run = subprocess.run(
                [sys.executable, str(script), "--root", str(root), "--section", "tools",
                 "--subsection", "source", "--limit", "1"],
                capture_output=True, text=True, check=True,
            )
            report = json.loads(run.stdout)
            self.assertEqual(report["readme_sha256"], hashlib.sha256(raw).hexdigest())
            self.assertEqual(report["total_matches"], 2)
            self.assertTrue(report["truncated"])
            self.assertEqual(len(report["entries"]), 1)
            self.assertEqual(list(root.iterdir()), [root / "README.md"])
            self.assertEqual((root / "README.md").read_bytes(), raw)
            invalid = subprocess.run(
                [sys.executable, str(script), "--root", str(root), "--section", "missing"],
                capture_output=True, text=True,
            )
            self.assertNotEqual(invalid.returncode, 0)
            self.assertIn("Unknown section", invalid.stderr)


if __name__ == "__main__":
    unittest.main()

# Repository Navigation and Resource Identity

Use this guide to connect a skill question to the actual collection. Local
structure reviewed on 2026-09-09. Paths below are relative to the repository root.
This is a discovery workflow, not an instruction to run a listed project.

## Choose a Layer for the Question

| Need | Start here | What to verify next |
|---|---|---|
| Where a resource is listed | `README.md` section and blockquote subcategory | Preserve the original URL, including any file, release or discussion suffix |
| Topic vocabulary and connections | Matching `wiki/overviews/`, then selected concepts/entities | Follow the cited primary source; generated pages may repeat older claims |
| Short project summary | `description/{owner}/{repo}/description_en.txt` | Confirm capability, platform and limitations upstream |
| Historical source inspection | `archive/{owner}/{repo}.txt` | Identify included files, revision evidence, truncation and provenance |
| Current support or exact implementation | Maintainer documentation, release or source at a known revision | Match the precise claim and deployed version |

Do not load the whole wiki, every description or an entire large archive to
answer a narrow question. A direct project query can start at its README entry
and relevant primary material without reading the wiki first.

The archiver excludes many asset/binary formats and has snapshot, lightweight
and truncation fallbacks. A text archive is not guaranteed to be a complete
checkout. A project-path header is not an upstream commit identifier. Do not
infer that an absent file, symbol or binary never existed upstream.
See the actual [archiver](../../../../scripts/archive-repos.py).

## Locate Actual Paths

README spellings, description directories and archive filenames can differ in
case. Resolve the two layers independently. Report multiple case-only matches
as ambiguous; do not silently select whichever file is largest. The existing
[description path helper](../../../../scripts/description_paths.py) documents
the repository's write-path convention; discovery should expose actual matches.

Use the bundled read-only helper from the repository root:

```bash
python3 .claude/skills/overview/scripts/repository_index.py
python3 .claude/skills/overview/scripts/repository_index.py --section "Game Network" --subsection "Source" --limit 5
python3 .claude/skills/overview/scripts/repository_index.py --repo bkaradzic/bgfx
```

When installed outside a checkout, pass `--root /path/to/awesome-game-security`.
The helper uses only the Python standard library. It reads README metadata and
directory entries; it does not fetch, import archived code, execute projects,
modify files or verify upstream behavior.

Its JSON includes current H2/subcategory locations, GitHub repository occurrences,
original URLs, actual description/archive paths and a README SHA-256. Limits and
truncation are explicit. It follows this README's bullet-list convention, not a
general Markdown parser: organization-only URLs, prose/table links and non-GitHub
resources are outside its repository-entry result. Read the selected section
itself for those resources. Counts describe discovery entries, not unique tools,
coverage, quality or total links.

Missing means not found in this checkout. Sparse checkouts and separately
installed skills may omit the wiki, description, archive or sibling skills.
Check what exists before constructing a path. If local material is absent, use
the verified original URL or the
[public collection](https://github.com/gmh5225/awesome-game-security).
Do not claim that installing one skill also installs the repository data layers.

## Preserve Identity and Evidence

- Keep collection membership separate from technical capability. A category
  placement or generated description does not certify the resource.
- Distinguish repository, organization, article, file and release URLs. A root
  repository URL identifies a project; it does not preserve a deep link's evidence.
- For renamed, moved, mirrored or forked projects, record the observed redirect
  and upstream relationship. A matching name or replacement owner is insufficient.
- Record the collection revision or README hash separately from the upstream
  revision. A description generation date is not a source-code revision.
- Treat a wiki page, description and archive derived from one source as one
  provenance chain, not three independent confirmations.

For conflicting claims, use
[repository evidence reconciliation](../../research-rigor/references/repository-evidence.md).

## Keep Maintenance Separate from Retrieval

The current repository contains archiving, link repair, description generation
and wiki update programs. Some paths invoke external services or commit/push
changes. Read the selected script and its options before a maintenance task;
do not run a bulk maintenance program merely to answer a resource question.
There is no current `scripts/generate-toc.py` or `scripts/remove-forks.py`;
older skill references to them do not establish their availability.

# Game Security Skill Coverage and Quality Roadmap

Review baseline: 2026-09-09, following the initial 10-skill enrichment.
This is a prioritized gap assessment of this repository, not a ranking against
all other skill libraries. Source quantity and document length are not quality scores.

## Coverage Status

| Area | Gap found in the baseline | This iteration | Further evidence needed |
|---|---|---|---|
| Server authority and backend economy | Mostly topic names and general server-authority advice | Dedicated operation, authorization, purchase and transaction review skill | Owned-service fixtures and provider/version-specific case studies |
| Time, ordering and replay | General retry advice without clock or recording-fidelity analysis | Versioned engine references for timelines, ordering, resimulation and replay effects | Game-specific capture fidelity and authoritative-state fixtures |
| Detector operational reliability | Statistical rules without a separate collector-health and decision-recovery workflow | Coverage/health states, rollout controls and correction evidence | Incident exercises and production cohort evaluation |
| Build/update/mod supply chain | Plugin provenance and package signing without an end-to-end release model | Dedicated release-authority, update, provenance and content-boundary skill | Implementation-specific update/recovery and release-pipeline evidence |
| Desktop Linux and Proton | Scattered tool/platform mentions without a coherent trust model | Dedicated runtime, credential, namespace and policy skill | Representative distro/runtime/game compatibility matrix |
| Robustness and remediation | Tool names without a shared diagnostic-evidence workflow | Owned-build contracts, sanitizer limits and artifact-triage reference | Project-specific regression artifacts and reviewed fixes |
| Skill behavior | No checked-in routing and answer-quality case suite | Public scenario suite, local validator and evaluation rubric | Repeated model runs, comparison baselines and separately held-out cases |
| Repository-grounded selection | Repeated source templates, stale category counts and weak tool-role distinctions | Per-domain resource guides, shared provenance rules and an offline section/layer index | Ongoing upstream/version checks and held-out retrieval tasks |
| Legacy technical claims | New evidence rules coexist with older detailed catalogs | Corrections to input/trajectory and callback evidence plus targeted firmware, attestation, virtualization, kernel/mobile and graphics claims; see the recorded quality review | Further claim-by-claim review of historical thresholds, layouts, compatibility and detectability claims |

## Priorities Beyond This Iteration

1. **Evidence debt:** audit high-impact legacy assertions first. Record exact
   versions and direct support; remove universal rankings and unsupported
   certainty. Review contradictions where new rules meet old examples.
2. **Entry-point size:** seven baseline entrypoints exceed 500 lines; DMA is
   1,800 lines and Windows kernel 1,178. Refactor by actual task only after
   identifying necessary references and verifying routing/answer regressions.
   Direct Data Source sections are retained in every entrypoint by project
   requirement; shared navigation supplements them. The remaining domain
   catalogs still need task-based refactoring without removing those sections.
   Preserve source provenance and working links during any extraction.
3. **Portable naming:** nine baseline `name` values differ from their containing
   folder names. Existing names are preserved in this iteration. Agent Skills
   portability requires evaluating a naming migration and its invocation/link
   impact before claiming strict cross-client compatibility.
4. **Independent evaluation:** compare the same cases with and without relevant
   skills and alongside unrelated skills. Track useful task completion,
   unsupported claims, references loaded, latency and context cost. Published
   regression cases are not a hidden benchmark.
5. **Remaining domain breadth:** assess concrete demand for macOS/Apple Silicon,
   console/cloud-streaming boundaries, script/WASM mod isolation, incident
   response and disclosure coordination before adding more entrypoints.

The line-budget and naming guidance comes from the
[Agent Skills specification](https://agentskills.io/specification) and
[Claude Code skill documentation](https://code.claude.com/docs/en/skills).
These are portability and authoring concerns, not proof that a large skill
always performs poorly. Runtime-specific behavior needs testing.

## Quality Claims Must Have a Comparison

For a claim of improved effectiveness, report the task population, model and
settings, repository revision, selected skills/references, baseline, raw outputs,
review rubric, reviewer independence, and observed failures. Evaluate correct
selection, appropriate non-selection, overlap, and ambiguous questions.
[Skill authoring and evaluation guidance](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices)

Use the [evaluation guide](../../research-rigor/references/skill-evaluation.md)
for this repository's local case format. Do not turn a validator pass, one
reviewer's score, or a small smoke sample into a world-leading quality claim.

See the [recorded 2026-09-09 review](quality-review-2026-09-09.md) for concrete
corrections and actual limited evaluation results.

# Skill Quality Review — 2026-09-09

This review found and corrected material errors. It does not establish perfection
or a world-leading rank. The supported outcome is a more consistent research
library with inspected source contracts and recorded, limited model evaluations.
Baseline: [ddf9d7f](https://github.com/gmh5225/awesome-game-security/commit/ddf9d7fea2d8e802ef532f235f02fca63ae8c49a).

## Corrections to Existing Guidance

| Finding | Corrected interpretation and location |
|---|---|
| Informal firmware tiers predicted certain detection or a mandatory TPM path | Device labels require observed dimensions and evaluated coverage; see [DMA assurance boundaries](../../dma-attack/references/assurance-boundaries.md) and [anti-cheat](../../anti-cheat/SKILL.md) |
| EPT events, device DMA, platform-feature flags and complete protection were conflated | Distinguish requester, CPU/device translation, supported/configured/running state, policy authority and observed enforcement |
| TPM/PCR summaries overgeneralized reset rules, key trust and runtime coverage | Preserve profile, selected measurements, enrollment, freshness and appraisal scope; do not certify unmeasured behavior |
| Generic live device-register changes were recommended as classification or containment | Follow documented platform ownership and lifecycle; require isolation-completion and recovery evidence |
| Root privileges and tool names implied kernel execution or fixed concealment rankings | [Mobile security](../../mobile-security/SKILL.md) separates credentials, components, tool modes, observation scope and actual TLS configuration |
| Historical kernel layouts, thresholds and pool tags were promoted to universal interfaces or identity | [Windows kernel](../../windows-kernel/SKILL.md) now uses public allocation contracts, matched symbols and corroborated attribution; Pool2 has no automatic old-kernel fallback |
| WHP was described as a user-process hypervisor with a generic syscall exit | Windows and [reverse engineering](../../reverse-engineering/SKILL.md) now agree on host/guest scope, API-specific support, capabilities and documented exit context |
| Instrumentation and binary-diff tools received unsupported best-tool or completeness claims | Evaluate semantic fidelity, input/coverage scope, observer effects and independently checked matches |
| Screenshot methods, Present calls and physical display contents were equated | [Graphics evidence](../../graphics-api/SKILL.md) distinguishes capture and presentation stages, missing data and relevant controls |
| Pixel color/alpha was said to establish depth-test bypass | Shader output requires pipeline, depth/stencil, blending and event context before a visibility conclusion |
| Firmware/DMA and input-device categories implied universal concealment advantages | [Game threat analysis](../../game-hacking/SKILL.md) records prerequisites, observation channels, benign uses and unresolved coverage |

The relevant skills cite primary contracts beside the corrected claims. This was
a targeted audit of these families, including duplicate assertions in related
skills. Remaining historical examples are not thereby revalidated.

## Actual Evaluation Results

[Inputs, raw outputs and judgments](../../research-rigor/assets/review-2026-09-09.json)
are retained for inspection. Expected routes and reviewer rubrics were withheld
from the answering agents; each evaluator started without conversation history.

| Evaluation | Result | Meaning and limit |
|---|---|---|
| Description-only routing on the original 40 public cases | 38 primary choices matched the predefined acceptable set | Routing agreement, not task-answer accuracy |
| Review of the two mismatches | One underspecified generic sanitizer question; one capability omitted from the description | Choosing no game-security skill for the original generic question was reasonable |
| Targeted follow-up after description/fixture edits | 5/5 agreed, including three unrelated controls | Small follow-up; not a repeated full 40-case comparison |
| Six separate document-based technical answers | No material error identified in the bounded review | Firmware, EPT/DMA, attestation, presentation, depth state and trace/diff scope; no hardware experiments |
| Expanded public suite | 48 cases: 13 positive, 32 boundary, 3 unrelated | Metadata validation is separate from model execution; all 48 were not run as a new batch |

The sanitizer fixture now specifies a game-asset parser review. The research-rigor
description exposes owned-game diagnostics, sanitizer limits and untrusted
retrieved instructions already supported by its body. Keep the original mismatch
and changed fixture visible; do not report these edits as a clean paired increase
from 38/40 to 40/40.

The evaluation used inherited model/settings without an override. Exact backend
revision and sampling settings were not independently recorded. There was no
skills-disabled, competing-library or cross-model baseline, repeated trial, or
held-out population. These limits prevent comparative leadership or production
error-rate claims.

## Structural Review and Preserved Requirements

All 13 skill entrypoints retain their original invocation names. Their complete
Data Source suffixes were compared with the baseline and preserved byte-for-byte,
including direct wiki/README links, description/archive URL templates and fallback
guidance. Supporting references supplement those sections.

Frontmatter and changed local links were checked; the offline repository indexer's
six functional tests and the evaluation metadata validator passed. These checks
cover document structure and local helper behavior, not every external link or
every old technical assertion.

## Remaining Work Before Stronger Claims

- Nine frontmatter names differ from their containing folder names. Strict
  Agent Skills portability is not established; preserve existing invocations
  while planning and checking a migration.
- Seven entrypoints still exceed 500 lines, including the required direct
  Data Source material. Refactor conditional catalogs by task without removing
  those source sections, and measure the resulting reference use and behavior.
- Historical protocol fields, hardware parameters, driver/tool inventories,
  VMCS tables, mobile platform compatibility and old code examples still need
  version-specific review. Public repository availability is not verification.
- Use representative owned artifacts, legitimate edge cases, repeated runs,
  separately held-out tasks and matched baselines for broader effectiveness
  claims. Device, runtime and production behavior remain unevaluated here.

The naming and progressive-disclosure criteria come from the
[Agent Skills specification](https://agentskills.io/specification). The emphasis
on realistic evaluations follows
[Claude skill-authoring guidance](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices).
Neither source is a certification or a ranking of this collection.

# Catalog Workflow

## Select a Domain

Folder IDs below locate skills; installed invocation names come from each
SKILL.md frontmatter. Existing names and folders are not all identical.

| Question or artifact | Primary skill | Boundary / related work |
|---|---|---|
| Detector architecture, input evidence, telemetry faults or decisions | [anti-cheat](../../anti-cheat/SKILL.md) | Platform signals need the relevant platform contract; conclusions need research-rigor |
| Physical-memory source, PCIe/USB bridge, FPGA, IOMMU or host acquisition | [dma-attack](../../dma-attack/SKILL.md) | Separate memory initiator, transport and analysis backend |
| Engine source, runtime metadata, plugins or asset boundaries | [game-engine](../../game-engine/SKILL.md) | Editor tools are distinct from shipped runtime; persistent state goes to server security |
| Attack classes, prerequisite access and defensive coverage | [game-hacking](../../game-hacking/SKILL.md) | Identify the boundary before choosing a specialized domain |
| Rendering API, capture, translation or frame/performance artifacts | [graphics-api](../../graphics-api/SKILL.md) | Timing output, captured pixels and game-state evidence differ |
| Binary identity, static analysis, symbols, dumps or code comparison | [reverse-engineering](../../reverse-engineering/SKILL.md) | Recovered structure does not by itself prove runtime behavior |
| Windows drivers, callbacks, telemetry and platform policy | [windows-kernel](../../windows-kernel/SKILL.md) | Runtime privileges, observation scope and preventive policy are separate |
| Android/iOS package, device-integrity or mobile runtime evidence | [mobile-security](../../mobile-security/SKILL.md) | Local root observations, remote attestations and enforcement differ |
| Linux, SteamOS, Proton, credentials or namespaces | [linux-platform-security](../../linux-platform-security/SKILL.md) | Compatibility layers and isolation mechanisms have different roles |
| RPC authorization, sessions, economy, timing and replay consistency | [game-server-security](../../game-server-security/SKILL.md) | Transport reliability does not authorize a gameplay effect |
| CI, dependencies, launchers, update trust, mods or content distribution | [game-supply-chain-security](../../game-supply-chain-security/SKILL.md) | Build provenance, artifact signing and runtime safety are distinct |
| Conflicting claims, source lineage, evaluation or uncertain attribution | [research-rigor](../../research-rigor/SKILL.md) | Pair with the domain that supplies the actual technical contract |

Resource discovery can finish here when the user only needs locations or a
shortlist. Do not force a security review onto ordinary graphics, game-development
or library-usage questions merely because their resources occur in this collection.

## Use the Actual Repository

Read [repository navigation](repository-navigation.md) for current
layer roles, exact-path lookup, archive limitations and the read-only indexer.
Each domain entrypoint links a focused repository resource guide; load only the
one relevant to the question.

The top-level README uses H2 categories, blockquote subcategories and resource
bullets. Category names are current data, not a fixed count to memorize. Important
cross-category relationships include:

| README area | Typical routing |
|---|---|
| Game Engine; Game Develop; Game Assets; Game Hot Patch | Engine/runtime, package and release boundaries |
| Renderer; DirectX; OpenGL; Vulkan; Game Testing | Rendering, capture, compatibility and performance evidence |
| Game Network; Game CI | Transport/session contracts and release authority |
| Cheat; Anti Cheat; Some Tricks; Windows Security Features | Threat classes, observation mechanisms and platform controls |
| Platform/console emulator categories; WSL; WSA | Match the actual host, guest, compatibility layer and target format |
| Mathematics; AI; Image Codec; Wavefront Obj; PhysX SDK | Supporting algorithms, measurement and parser/asset context |

Do not flatten a resource's category into a capability claim. Some Linux kernel
references are listed in Android-related subcategories; organizations and sample
projects can appear alongside libraries. Read the actual entry and its scope.

Current root layers are README.md, .claude/skills/, wiki/, description/, archive/,
scripts/ and .github/workflows/. Individual skill installation may omit the rest.
Check available files and use verified upstream sources when a local layer is absent.
A corresponding wiki page is not guaranteed for every skill. Check
[the catalog](../../../../wiki/index.md) or the directory before constructing a path.

## Produce a Useful Selection

For each chosen resource, provide the original identity/URL, README location,
reason it fits this task, expected artifact, version/platform scope, and a material
limitation. Use a small comparative table when alternatives serve different roles.
Distinguish resources already listed from supplemental sources discovered upstream.

For exact capability claims, inspect primary documentation or a source file at a
known revision. Follow [repository evidence reconciliation](../../research-rigor/references/repository-evidence.md)
when generated layers or historical snapshots disagree. A popular project, working
link or large archive does not settle technical quality.

## Maintain the Collection When Requested

Check existing occurrences, original/fork relationships and the chosen category
before adding an entry. Preserve deep links and document meaningful redirects;
changing the owner is not enough to establish equivalent source identity.

Use the existing bullet convention:

```markdown

## Category
> Subcategory
- https://github.com/owner/project [Purpose; platform/scope; distinctive value or limitation]
```

Keep the public skills table aligned with actual frontmatter names. Check links,
category placement and the exact diff. Repository maintenance scripts can call
services and write or publish data; inspect the chosen script instead of running
bulk automation as a retrieval shortcut.

For skill-library changes, use the [coverage roadmap](coverage-roadmap.md)
and [evaluation guide](../../research-rigor/references/skill-evaluation.md). Structural
validation and a successful lookup are not evidence of superior model performance.

## Recorded Quality Review

Read the [2026-09-09 quality review](quality-review-2026-09-09.md) for
corrected legacy claims, actual evaluation outputs, preserved Data Source
requirements and unresolved portability/coverage limits.

## Data Source

Use the following repository sources directly when applying this skill. Prefer
available local files for discovery and scoped historical inspection; use the
raw URLs when the collection is not installed locally. These entrypoint details
are retained here so source lookup does not depend on loading another skill.

### 0. Compiled Wiki

Start with [wiki/index.md](../../../../wiki/index.md) for topical synthesis and
cross-project connections. [Wiki schema](../../../../wiki/AGENTS.md) describes its
structure. Generated wiki pages are discovery aids; follow their original
citations before adopting technical claims.

Raw catalog: [wiki/index.md](https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/wiki/index.md).
For this domain, read [wiki/overviews/overview.md](../../../../wiki/overviews/overview.md).
Raw URL: [overview overview](https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/wiki/overviews/overview.md).

A direct project question can start with its README entry or description below;
reading the entire wiki is unnecessary.

### 1. Project Overview and Resource Index

[README.md](../../../../README.md) contains the collection's actual categories,
subcategories, project URLs and short descriptions. Find the relevant category
and retain the original URL, including any specific file or revision suffix.

Raw index: [README.md](https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/README.md).

### 2. Repository Descriptions

For a concise project summary, look for the actual local path:

```text
description/{owner}/{repo}/description_en.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/description/{owner}/{repo}/description_en.txt
```

Example: [bgfx description](https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/description/bkaradzic/bgfx/description_en.txt).
Extract owner/repository from the original GitHub project URL, omitting a .git
suffix. Resolve existing path casing before constructing a local/raw path.
Descriptions are generated summaries, not independent verification. If absent
or inaccessible, use the README entry, relevant archive or original project.

### 3. Repository Source Archives

For deeper inspection of an available captured source tree, locate:

```text
archive/{owner}/{repo}.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/archive/{owner}/{repo}.txt
```

Example: [bgfx archive](https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/archive/bkaradzic/bgfx.txt).
Prefer inspecting the relevant portion of an existing archive over re-cloning
merely to inspect the same captured material. Archives may exclude files, use
fallback extraction or contain truncation; they are not guaranteed complete
checkouts. Record any upstream revision evidence and included-file limits.
If missing or insufficient, follow the README's original upstream URL.

### Choose and Verify the Source

For a specific project, locate its README identity, use a description or wiki
page for orientation when helpful, then inspect the relevant archive/source
artifact for the question. For current compatibility or exact implementation,
verify the matching upstream documentation, release or immutable source revision.
Keep the collection revision and capture/generation dates separate from the
upstream version. Multiple generated layers from one source are not independent
corroboration, and missing archive content does not establish upstream absence.

The routing and evidence references above help choose useful artifacts. Shared
[repository navigation](repository-navigation.md) adds the optional read-only indexer,
case-ambiguity handling and maintenance details; it supplements this Data Source
section rather than replacing it.