awesome-game-security is a curated collection focused on security research for games and game software, including cheating, anti-cheat systems, debugging, and anti-debugging. It is intended for security researchers and developers studying or building game-protection tools. The catalogue entries provide skills for AI coding agents related to the repository’s security workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gmh5225/awesome-game-security --skill mobile-securitygit clone --depth 1 https://github.com/gmh5225/awesome-game-securityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gmh5225/awesome-game-security/mobile-security)<a href="https://agentmods.dev/skills/gmh5225/awesome-game-security/mobile-security"><img src="https://agentmods.dev/badge/skills/gmh5225/awesome-game-security/mobile-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gmh5225/awesome-game-security/mobile-security"><img src="https://agentmods.dev/badge/skills/gmh5225/awesome-game-security/mobile-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.04701 |
| Opus 5 | $0.00049 | $0.02351 |
| Sonnet 5 | $0.00020 | $0.00940 |
| Haiku 4.5 | $0.00010 | $0.00470 |
Grade A, and why
mobile-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 574 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mobile Game Security
Overview
This skill covers Android and iOS game-security analysis across package provenance, runtime integrity, local data, platform policy, attestation, and backend trust. Describe attacker capabilities and defense limits separately at each boundary.
Mobile behavior is strongly version-, OEM-, entitlement-, signing-, kernel-,
and policy-dependent. Verify the exact device/build and use
research-rigor before treating a root, hook,
emulator, or integrity signal as attribution.
Mobile Trust Boundaries and Integrity Evidence
Use game-server-security for verified purchases, entitlement transitions, account authorization and retries. Use game-supply-chain-security when the question concerns build provenance, updates or third-party content.
Separate app package/signing, process isolation, platform/device integrity, and server authorization/game rules. Repackaging, privileged instrumentation, local-data exposure, request replay, and reliance on client assertions affect different boundaries. State whether the scenario requires ordinary app access, a developer build, privileged runtime access, kernel control, or server access.
Keep local indicators, verified attestation, backend decisions, and sanctions separate. A root indicator is not proof of cheating; a valid integrity response does not validate arbitrary game logic. Record the exact build and signing identity with the observation source and available counterevidence.
- Android SELinux mandatory access control also applies to root processes. Record enforcement state, domain, build, and relevant policy denials instead of assigning universal trust or stealth ratings to framework names. AOSP SELinux
- Validate Play Integrity request details, identity, binding, and freshness before interpreting app/device/account verdicts on the backend. Android integrity verdicts
- App Attest requires server verification of attestations/assertions, including challenge and counter handling. Keep development and production context separate. Apple server validation
- For owned-app transport tests, distinguish debug-only trust anchors from release configuration and verify the packaged result. Android network security configuration
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +32 lines · +28 tokens per session 1074f17d520d
- 10d ago First seen · 542 lines · 71 tokens per session scan A 0228cdebbd10
mobile-security is a skill published in the GitHub repository gmh5225/awesome-game-security (3,495 stars, last pushed today), licensed MIT. It adds 99 tokens to every session and 4,701 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kotlin-coroutines-flows
Kotlin Coroutines and Flow patterns for Android and KMP — structured concurrency, Flow operators, StateFlow, error handling, and testing.
gamepad
Add on-screen touch controls (virtual joystick + buttons) to browser games using @vibedgames/gamepad. Use when the user wants mobile/touch controls, a virtual joystick or d-pad, on-screen action buttons, or to make a desktop game playable on phones. Triggers on: 'add touch controls', 'mobile controls', 'make it work…
vfx
Real-time 2D VFX cookbook — layered explosions, hit sparks, muzzle flashes, trails, smoke, pickups, heals, shockwaves, weather — with particle parameter recipes, color/readability rules, and mobile-browser performance budgets, from Diablo's VFX talk, Riot's style guide, saint11, and the GDC VFX bootcamps. Use when…
appcircle-automation
Automate Appcircle tasks via Rube MCP (Composio). Always search tools first for current schemas.
revenuecat
RevenueCat manages mobile in-app purchases (Apple/Google) seamlessly. The REST API allows your backend to verify user subscription status and grant entitlements.
ttb-skill-init
TTBaseUIKit project initialization skill: scaffold MVVM-C folder structure, setup TTBaseUIKitConfig, configure localization, integrate TTBDebugPlus. Run BEFORE any other TTBaseUIKit skill.