Game development and reverse-engineering Agent Skills

The original Gemini HTML report builds on morluto/rea and surveys 9 GitHub projects for game-engine inspection, byte-matching decompilation and security auditing. This edition keeps the original table order and A/B/C technical scenarios, and corrects file paths, module counts and setup commands against official README, license, skill-file and script snapshots fetched on 2026-11-08. The byte-identical original HTML and hash receipt are stored in the same folder for comparison.

Entry numbers follow the table order in the original report; they do not rank quality or adoption priority.

Static metadata and archive support in morluto/rea

morluto/rea handles general native binaries and adds two static parsers for game engines, so an Agent can collect structured evidence without launching the game executable:

1. Unity IL2CPP metadata parsing: the MCP tool inspect_il2cpp_metadata and CLI command rea inspect-il2cpp-metadata <global-metadata.dat> decode global-metadata.dat directly (versions 24, 27, 29, 31 and 39) to extract assemblies, types, fields and method signatures. Passing --binary <GameAssembly.dll|libil2cpp.so> at the same time links metadata entries to native function addresses.

2. Godot PCK archive inspection and extraction: rea inspect-artifact and rea extract-artifact read standalone .pck archives or PCK sections appended to an executable (format versions 1, 2, 3 and 4), and compute SHA-256 digests for extracted assets as provenance records.

Game assets, full reconstruction and crash triage in REA_Skill

The upstream HTML labeled smartworldarafath/REA_Skill as "21 skills"; the 6642a0c official README now lists 243 SKILL.md files across 41 categories (with 16 rea-* modules plus reverse-engineer-anything totaling 17 core skills inside skills/rea-core/). Three modules target game engineering directly:

• rea-game-asset-recovery: defines asset inventory steps for Unity (Managed .dll and IL2CPP GameAssembly.dll + global-metadata.dat), Godot .pck and Unreal .pak, and uses spirv-cross, dxc and fxc to decompile DXBC, DXIL, SPIR-V, GLSL or Metal shader bytecode into .hlsl, .glsl or .wgsl.

• rea-full-code-recovery: enforces a Zero Skeleton / Zero Placeholder Law during source reconstruction. It forbids // TODO comments or simplified pseudocode, and requires complete boundary conditions per function plus a passing compile check.

• rea-performance-crash-triage: standardizes crash and frame-drop diagnosis across Windows Minidump (.dmp), Linux core and macOS .ips crash reports, combining call-stack recovery with Frida, GDB, Rizin and flameox flamegraphs to isolate memory corruption or thread deadlocks.

Unity and Unreal workflows across rev-skills and secskills

.claude/skills/re-game/SKILL.md in dslsdzc/rev-skills picks tools from the build directory layout: Game_Data/Managed/Assembly-CSharp.dll routes to .NET decompilation; Game_Data/il2cpp_data/ with global-metadata.dat runs Il2CppDumper to generate dump.cs and script.json; Unreal builds containing Engine/Binaries/, *.pak and <Game>-Win64-Shipping.exe use UnrealFinder or Dumper-7 to locate the global GObjects, GNames and GWorld pointers.

For Android and iOS Unity builds, secskills-core/skills/reversing-unity-il2cpp/SKILL.md in trilwu/secskills covers libil2cpp.so and iOS UnityFramework.framework, walking through Il2CppDumper, Il2CppInspector, importing script.json into IDA Pro or Ghidra to restore symbol names, and attaching Frida hooks for runtime checks.

The 7 byte-matching modules in Game-Decompilation-Skill-For-Claude

Preservation research and cross-platform ports of classic C/C++ games often use byte-matching decompilation: rewritten C/C++ compiled with the original toolchain must produce machine code identical byte-for-byte to the reference binary. lemiur/Game-Decompilation-Skill-For-Claude ships 7 specialized modules under .claude/skills/ (the upstream report listed 3) and binds to eight action verbs (build, match, diff, disasm, xref, class, gate, rules) in the target game repository's root AGENTS.md:

Zero-dependency triage and headless Ghidra in claude-reverse-engineering-skill

EncidXVII/claude-reverse-engineering-skill runs through headless scripts and plain-text exports instead of interactive GUI disassemblers. Its bundled scripts/triage.py uses only the Python 3.8+ standard library to read magic bytes and PE, ELF, Mach-O and CLR headers, fingerprint over 25 frameworks and packers (including Unity, Godot, Flutter, Electron and UPX), compute section entropy and route the task to 14 domain playbooks (including frameworks-packagers.md, managed-bytecode.md and mcp-servers.md).

For static decompilation, the skill ships DecompileExport.java and decompile_export.py tested in CI against Ghidra 12.1.4 (exporting up to 4000 functions by default) to write decompiled C, imports and strings to text files. It runs Python with python -I to block import hijacking and treats strings inside binaries as untrusted data so analyzed samples cannot trigger prompt injection.

Security auditing and deobfuscation in awesome-game-security and reverse-skill

For anti-tamper review and internal security self-audits, gmh5225/awesome-game-security includes 13 research modules under .claude/skills/:

• reverse-engineering and research-rigor keep static disassembly inferences separate from runtime evidence so isolated strings or dead functions are not misreported as vulnerabilities.

• graphics-api maps swap-chain and render-pipeline interception points across Direct3D, DXGI, OpenGL and Vulkan to check overlay and visual-tampering exposure.

• game-server-security audits server-authoritative state calculation, RPC parameter bounds, game-economy transactions and replay-attack defenses.

When native game modules use commercial protectors or Obfuscator-LLVM (OLLVM) control-flow flattening, zhaoxuya520/reverse-skill provides two field references: skills/field-journal/seed-014_unity-il2cpp-reverse.md records memory-dump timing when global-metadata.dat is encrypted (capturing after il2cpp_init maps the decrypted buffer) alongside frida-il2cpp-bridge hook patterns; skills/reverse-engineering/references/ollvm-deobfuscation.md compares tool choices (d810-ng, obpo-plugin, ollvm-breaker, deollvm) across OLLVM forks including Hikari, goron, Arkari, Pluto (including its Trap Angr pass that stalls symbolic execution), Polaris and O-MVLL. Its global RULES.md requires creating work/<case>/scope.md to record explicit authorization before running target checks.

Clean-room game mechanics and Godot 4 reconstruction in saschb2b/skills

Teams studying gameplay pacing to build a new title in a lawful clean-room environment can use three modules in saschb2b/skills, each signed with a Sigstore skill card (CARD.md.sigstore): skills/productivity/game-design/SKILL.md distills core loops, MDA framing and economy models from 17 dissected games; skills/engineering/godot/SKILL.md targets Godot 4.x/4.7 with 23 reference guides on nodes, physics, GDScript and rendering; and skills/engineering/reverse-engineering/SKILL.md defines a seven-phase (phases 0 through 6) input/output differential testing loop to check external behavior parity without copying proprietary source code.

Three setup commands in the upstream report no longer match current repository layouts (including a * copy glob that skips the hidden .claude/skills/ directory, and nested subdirectory paths in saschb2b/skills). The commands below follow the 2026-11-08 official snapshots; these steps were not run against game builds during this review.

1. morluto/rea and REA_Skill (MCP server and game-asset skills)

Install rea-agents and check local reverse-engineering backends, then load the core REA_Skill modules via the skills CLI or a sparse checkout:

2. Game-Decompilation-Skill-For-Claude (corrected hidden-directory copy path)

All 7 skills in this repository sit inside the hidden .claude/skills/ folder; pass .claude/skills/* explicitly instead of Game-Decompilation-Skill-For-Claude/*:

3. claude-reverse-engineering-skill, rev-skills and secskills

These three projects support the Claude Code plugin marketplace or npx installers, so you do not need to clone whole repositories into ~/.claude/skills/:

4. awesome-game-security, reverse-skill and saschb2b/skills

awesome-game-security stores over fifty thousand archived reference files, so use a sparse checkout when you only want its skills; saschb2b/skills installs individual modules via --skill:

Use this route for lost source recovery on first-party legacy builds, authorized technical due diligence or lawful compatibility debugging. Combine EncidXVII/claude-reverse-engineering-skill, morluto/rea, smartworldarafath/REA_Skill and dslsdzc/rev-skills (adding trilwu/secskills for mobile targets).

1. Run python -I triage.py <target> on the build directory to identify the binary format (PE/ELF/Mach-O/CLR), check whether the build uses Unity Mono, Unity IL2CPP, Godot PCK or Unreal Shipping layout, and flag packers or high-entropy compressed sections.

2. For Unity IL2CPP or Godot builds, call rea inspect-il2cpp-metadata or rea inspect-artifact to generate SHA-256-backed type tables and asset manifests; for Unreal builds, follow re-game in rev-skills to locate .pak mounts and GObjects/GNames offsets; when inspecting rendering pipelines, follow rea-game-asset-recovery with spirv-cross or dxc to decompile shaders back into high-level source.

3. On mobile or large native binaries, follow reversing-unity-il2cpp in secskills to import script.json into your disassembler and align method names; when diagnosing production crashes, use rea-performance-crash-triage to parse .dmp or .ips call stacks.

Use this route for authorized preservation research, engine upgrades or cross-platform native ports of classic C/C++ games. Combine EncidXVII/claude-reverse-engineering-skill, morluto/rea, lemiur/Game-Decompilation-Skill-For-Claude and rea-full-code-recovery from REA_Skill.

1. Run decompile_export.py from claude-reverse-engineering-skill with headless Ghidra to export initial C drafts, strings and import tables from the reference executable, then build function cross-references (Xrefs) and struct baselines through morluto/rea.

2. Create AGENTS.md in the decompilation workspace binding the target compiler and build, match, diff and disasm commands. Let orchestrator schedule leaf functions first and iterate in matcher; when register or stack diffs stall, run wall-identifier and permute to test compiler flags or struct alignment, and check output against decomp-code-rules and rea-full-code-recovery so no // TODO stubs remain.

3. Once core gameplay loops pass byte-matching or behavioral equivalence checks, load native-platform-porting to inventory filesystem, windowing, audio and graphics API call sites and replace them with a cross-platform abstraction layer.

This route covers two lawful internal engineering scenarios: white-box/gray-box security self-audits before launching your own game, and clean-room gameplay prototyping that never touches third-party proprietary code.

Pre-launch anti-tamper and server-authority audits on first-party builds

1. Following RULES.md in zhaoxuya520/reverse-skill, create work/<case>/scope.md first to record your own test build hashes, network isolation rules and authorized test scope.

2. Combine secskills (reversing-unity-il2cpp) and reverse-skill (seed-014, ollvm-deobfuscation.md) to check whether critical economy or combat method names, constants and sections remain directly exposed in your release APK or PC build when server checks are toggled off.

3. Walk through graphics-api and game-server-security in awesome-game-security to verify that match settlement, loot drops, cooldowns and economy trades are computed authoritatively on the server, without treating client memory guards or obfuscation as the primary check.

Clean-room mechanic analysis and Godot 4 prototyping

1. From lawful gameplay observation, public design talks and external input/output logs only, apply game-design from saschb2b/skills to document core loops, feedback pacing and economy balance sheets without decompiling or copying competitor code or art assets.

2. Load the godot skill from saschb2b/skills to design the Godot 4 scene tree, Signals and state machines; when migrating your own legacy rules engine to Godot 4, pair the seven-phase reverse-engineering skill to compare old and new output states under identical test inputs.