ClaudeSecurityVulnerability huntingAI score · 79/100AI-assisted edit · no obvious prompt-injection riskX

Audit a Game Repo with Claude Code Read-Only, Find 13 Vulnerabilities in 5 Minutes

Input: local code repo + attacker-perspective audit prompt → Processing: Claude Code read-only analysis → Output: severity-ranked vulnerability list with file:line references and fix suggestions

Some experienceStepsPromptTip
Who
Game developer 0xbobaaa auditing their own skyhold sky-island city builder backend
You get
13 findings in 5 min 38 s (2 critical, 2 high, 3 medium, 6 low); the 2 critical bugs matched the root causes of two live server crashes on Oct 18
You need
Claude Code

Constraints

Requires Claude Code access and a locally readable code repository. The author emphasized read-only mode with no actions against production. Audit scope is defined by the prompt: crashes, cheats, and abuse vectors.

What they did

Game developer 0xbobaaa had Claude Code perform a read-only attacker-perspective audit on their skyhold game's backend codebase, with the task of finding all vulnerabilities that could crash, cheat, or abuse the system.

How it went

Author report: Claude Code produced 13 findings in 5 minutes 38 seconds, including 2 critical. Critical 1: malformed URL could crash the entire server process. Critical 2: server never re-checked daily scores, allowing arbitrary numbers on the leaderboard. The author then checked server logs and discovered two Oct 18 outages were caused by bad URLs, previously mistaken for random restarts. Both criticals were patched and deployed the same day: bad URLs now return 400 instead of killing the process; the server re-deals the daily seed and validates every placement before scoring.

Worth knowing

This case is an author-reported experience (author_report), not independently tested by this site. skyhold is the author's personal project; no repository link was provided in the post, so direct reproduction is not possible. The all-caps title is the author's original formatting. Read-only code auditing does not replace full penetration testing or dynamic security assessment; actual finding count and quality depend on codebase size, Claude Code version, and project architecture complexity. The "file:line" requirement in the prompt may produce extremely long lists for large repositories; consider running module by module.

Steps

  1. Open the target repository in Claude Code

    Launch Claude Code and navigate to your project directory. Confirm the environment is read-only and not connected to production servers. The author explicitly stated "read only, nothing fired at the live site".

  2. Paste the audit prompt and execute

    Paste the following prompt into the Claude Code conversation to start analyzing the codebase.

    Execution prompt · Source text。Claude Code conversation input

    audit this repo like an attacker. read only, run nothing against production. list every way to crash it, cheat it or abuse it, ranked by severity, with file:line and a fix

  3. Review findings and apply fixes

    Claude Code will output a severity-ranked list of findings, each with specific file paths, line numbers, and fix suggestions. The author reported 13 findings in 5 minutes 38 seconds. Pay special attention to critical issues: the author's two critical bugs were a malformed URL crashing the entire server, and missing re-validation of daily scores allowing arbitrary numbers on the leaderboard. Locate the issues from the report, implement fixes in code, and verify.

Prompt you can copy

Execution prompt · Source text。Claude Code conversation input; paste and execute directly

This block is the prompt. Ads are never placed here.

audit this repo like an attacker. read only, run nothing against production. list every way to crash it, cheat it or abuse it, ranked by severity, with file:line and a fix

Paste the prompt verbatim into Claude Code, replacing "this repo" with actual project context. Ensure read-only environment with no connection to production databases or APIs.

Source

让 Claude Code 只读审计自己的游戏仓库：5 分半找出 13 个问题，其中 2 个致命漏洞正是此前两次宕机的原因 · 0xbobaaa · X · 2026-10-24T08:29:05.000Z

Comments & feedback

Tried this method? Share results, problems or improvements. Comments appear after moderation. Please avoid sensitive information.

Loading…

    Related