Claude Code Game Studios is a setup that organizes Claude Code into a coordinated game-development team of specialized AI agents. It supports game projects across design, programming, art, audio, narrative, quality assurance, and production, with skills and workflows for coordinating that work.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Donchitos/Claude-Code-Game-Studios --skill security-auditgit clone --depth 1 https://github.com/Donchitos/Claude-Code-Game-StudiosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/donchitos/claude-code-game-studios/security-audit)<a href="https://agentmods.dev/skills/donchitos/claude-code-game-studios/security-audit"><img src="https://agentmods.dev/badge/skills/donchitos/claude-code-game-studios/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/donchitos/claude-code-game-studios/security-audit"><img src="https://agentmods.dev/badge/skills/donchitos/claude-code-game-studios/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 7 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.05306 |
| Opus 5.5 | $0.00012 | $0.02122 |
| Sonnet 5.5 | $0.00006 | $0.01061 |
| Haiku 4.5 | $0.00003 | $0.00531 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- security-audit — 97% identical, 245 lines differ
- security-audit — 97% identical, 245 lines differ
- security-audit — 94% identical, 245 lines differ
How it starts
The opening of the file, as written. The whole thing — 440 lines — stays where its author put it; the contents beside it link to each section on GitHub.
!bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation,workflow
Automation mode: Resolve modes.automation (project.local.yaml →
project.yaml → default collaborative). Every AskUserQuestion call and
every file write follows .claude/docs/automation-modes.md
(collaborative asks always · guided major-only · autonomous logs and proceeds;
automation_always_ask categories always prompt).
workflow (resolved above) decides only what Phase 7 tells you about the
release gate: at standard and full it requires this report; at minimal it
does not. The audit itself runs the same at every tier.
Security Audit
Security is not optional for any shipped game. Even single-player games have save tampering vectors. Multiplayer games have cheat surfaces, data exposure risks, and denial-of-service potential. This skill systematically audits the codebase for the most common game security failures and produces a prioritised remediation plan.
Run this skill:
- Before any public release (required for the Polish → Release gate at
workflow: standardandfull) - Before enabling any online/multiplayer feature
- After implementing any system that reads from disk or network
- When a security-related bug is reported
Output: production/security/security-audit-[date]-[scope].md — the scope
in the name keeps a same-day quick or save run from overwriting the full
report the release gate reads.
Phase 1: Parse Arguments and Scope
Modes:
full— all categories (recommended before release)network— network/multiplayer onlysave— save file and serialization onlyinput— input validation and injection onlyquick— high-severity checks only (fastest, for iterative use)- No argument — run
full
Read project.yaml to determine the following, falling back to .claude/docs/technical-preferences.md for engine/language/platforms when a key is absent or empty:
engine.nameandengine.language— load-bearing: they select the Phase 3 pattern set, and an engine with no sourced set for a category makes that categoryNOT ASSESSED. Ifengine.nameis absent or empty, say so in the report and treat every grep category asNOT ASSESSED; do not fall back to the Godot lists because they are the ones written out in fullplatform.targets(affects which attack surfaces apply)platform.multiplayerandplatform.online— whether multiplayer/networking is in scope.technical-preferences.mdhas no equivalent fields, so the legacy fallback cannot supply them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -2 lines 91d9c01dfed0
- 24d ago Changed · +93 lines c7ee7cf8a2e9
- 29d ago Changed 780806af70ec
- 1mo ago Changed · +103 lines · -20 tokens per session f8c2695403a3
- 1mo ago First seen · 246 lines · 49 tokens per session scan A b3d04c89f184
security-audit is a skill published in the GitHub repository Donchitos/Claude-Code-Game-Studios (27,298 stars, last pushed 5d ago), licensed MIT. It adds 29 tokens to every session and 5,306 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
game-design
How game development works as a process — roles, subtasks, workflows and role descriptions, especially (but not only) for Roblox. Use this skill when it's about the ORGANIZATION of game dev rather than concrete code: Which roles exist (Creative Director, Engineer, Artist, Polish/Audio, Business, QA-Tester, Game…
rbx-dev
Meta-skill for complete Roblox game development with Rojo — the entry point that knows and unifies the three specialist skills /rojo (filesystem→Studio sync, project setup), /rbx-studio (editor, MCP, assets, malware scan) and /game-design (roles, workflows, GDD). Use this skill for ANY Roblox game-dev undertaking…
novel-to-game
Turn a novel into a fully playable game on the selected target platform. Orchestrates the whole adaptation pipeline — requirements intake, gameable deconstruction, concept selection, world and visual design, target-runtime build, and evidence-based QA — for a novel in any language. Use for novel to game, story to…
media-higgsfield-assets
A Higgsfield workflow for creating or processing media beyond ordinary image and video generation. It covers 3D GLB models, rigging and animation, audio, video analysis, upscaling, reframing, outpainting, and background removal.
gamemaker-gml
Best practices for GameMaker Language (GML) development, covering scripts, object events, rooms, data structures, and performance-minded game code. Use when writing GML scripts or object event code in GameMaker Studio, structuring create/step/draw events, managing rooms and instances, building state machines for…
wow-assistant
Context-aware World of Warcraft lore, progressive hints, builds, and PvP/PvE guidance using the Nanocodex WoW companion's exported character snapshot.