How to use Claude to audit a game for crashes and cheats
@0xbobaaa gave Claude Code read-only access to Skyhold's repository. They report 13 findings in 5 minutes 38 seconds, including a bad-URL crash and unchecked daily scores, followed by same-day patches.
x.com
Original prompt
Shared by the source author. See source notes for context.
audit this repo like an attacker. read only, run nothing against production.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source poster / publisher
- @0xbobaaa
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- @0xbobaaa reports 13 findings in 5 minutes 38 seconds. A malformed-URL issue explained two earlier outages. Both critical issues were patched and deployed that day, with bad URLs returning 400 and daily scores checked server-side.
- Human involvement
- The developer set the production restriction, checked the server logs and reported the patches and deployment. The post does not establish that Claude independently deployed either fix.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- The developer gave Claude Code the repository and a read-only brief to find crash, cheating and abuse risks without touching production.
- Claude Code returned 13 severity-ranked findings in a reported 5 minutes 38 seconds.
- The developer checked server logs and connected two earlier outages to malformed URLs.
@0xbobaaa asked Claude Code to find ways to break Skyhold, their sky-island city-building game. The brief was read-only: inspect the repository, rank crash and cheating risks, and run nothing against the live site. The author reports that the audit took 5 minutes 38 seconds and returned 13 findings: two critical, two high, three medium and six low.
One critical finding involved a malformed URL that could crash the server. The other concerned daily scores that the server did not re-check, allowing an arbitrary number onto the leaderboard. After the audit, the developer inspected the server logs and found that bad URLs had already brought the live game down twice on 18 October. The post connects those outages to the URL issue, not to both critical findings.
The developer says both critical issues were patched and deployed that day. Bad URLs then returned a 400 response, while the server re-dealt the daily seed and checked every placement before accepting a score. A later same-author reply says they would add plan mode to the prompt to strengthen the read-only boundary. That reply does not establish that the original audit used it.
Who it's for: game developers who want a repository audit with explicit production restrictions and findings they can compare against logs.
Prompt
Original prompt
Source: X · @0xbobaaa
Frequently asked questions
Did Claude Code attack the live game?
The author explicitly says the task was read-only and nothing was fired at the live site. The audit used the repository; the developer then checked server logs.
What changed after the two critical findings?
The author reports same-day patches: malformed URLs returned a 400 response, and daily scores required the server to re-deal the daily seed and check each placement.
More details
Remaining steps
- Both critical issues were patched and deployed the same day, according to the developer.
About this account
Claude Code inspected the repository for ways to crash or cheat the game and returned severity-ranked findings under a read-only brief.
Platform: X. Attribution: https://x.com/0xbobaaa/status/2113910639026401525. Prompt: Original (quoted from source). Sourced by the Agents In Use pipeline. The original prompt is an exact excerpt from the longer prompt in the source, not its complete text. Source text retrieved through the public FxTwitter mirror. Results are author-reported, not independently tested. Conversation first pages were checked; further pagination was unavailable, so reply completeness is not claimed. Same-author follow-up on plan mode: https://x.com/0xbobaaa/status/2114062428560347271. No claims rely on the quoted game-building article or attached video.
Credit: @0xbobaaa on X
Source published
Added to Agents In Use
Source checked
Tools and topics
Claude Code · Skyhold repository · server logs
code audit · game security · server crashes
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.