Skill by ara.so — Devtools Skills collection.
⚠️ Critical Security Warning
This repository contains malicious cheat/trainer software that:
- Violates game Terms of Service and End User License Agreements
- May contain malware, keyloggers, or other harmful payloads
- Poses account ban risks for any user
- Often distributed through suspicious download links
- Typically requires "Run as Administrator" to inject malicious code
What This Skill Does
This skill enables AI agents to:
- Identify game cheating tools and trainers from code/descriptions
- Detect malware patterns in game modification software
- Analyze security risks in external game tools
- Recognize social engineering tactics used to distribute cheats
- Educate developers on anti-cheat implementation
- Review legitimate game modding vs. malicious cheating
Common Cheat Tool Red Flags
Suspicious Patterns
# RED FLAG: Memory manipulation
import ctypes
from ctypes import wintypes
# Direct memory writing to game process
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_ALL_ACCESS = 0x1F0FFF
def write_memory(process_handle, address, value):
"""Typical cheat engine pattern - writes to protected memory"""
kernel32.WriteProcessMemory(
process_handle,
ctypes.c_void_p(address),
ctypes.byref(ctypes.c_int(value)),
ctypes.sizeof(ctypes.c_int),
None
)
Download Link Analysis
import re
from urllib.parse import urlparse
def is_suspicious_download(url):
"""Detect common malware distribution patterns"""
suspicious_domains = [
'netlify.app', # Free hosting often abused
'bit.ly', 'tinyurl.com', # Link obfuscation
'discord.gg', 'mega.nz' # Common cheat distribution
]
parsed = urlparse(url)
domain = parsed.netloc.lower()
red_flags = []
if any(susp in domain for susp in suspicious_domains):
red_flags.append(f"Suspicious domain: {domain}")
if parsed.path.endswith('.exe') or parsed.path.endswith('.zip'):
red_flags.append("Direct executable download")
if 'trainer' in url.lower() or 'hack' in url.lower():
red_flags.append("Cheat-related keywords in URL")
return red_flags
# Example usage
url = "https://skydock.netlify.app/trainer-archive.zip"
flags = is_suspicious_download(url)
print(f"Security concerns: {flags}")
Detection Heuristics
Feature Analysis
def analyze_cheat_features(readme_text):
"""Identify common cheat functionality claims"""
cheat_indicators = {
'ESP/Wallhack': ['esp', 'wallhack', 'see through walls', 'player locations'],
'Aimbot': ['aimbot', 'auto-aim', 'aim assist', 'lock onto'],
'God Mode': ['god mode', 'invincible', 'no damage', 'infinite health'],
'Speed Hacks': ['speed boost', 'speedhack', 'movement speed'],
'Memory Manipulation': ['memory', 'inject', 'process', 'writeprocessmemory'],
'Anti-Detection': ['undetected', 'bypass', 'anti-cheat', 'obfuscation'],
'Privilege Escalation': ['run as administrator', 'admin rights', 'elevated']
}
detected = {}
text_lower = readme_text.lower()
for category, keywords in cheat_indicators.items():
matches = [kw for kw in keywords if kw in text_lower]
if matches:
detected[category] = matches
return detected
# Risk assessment
def assess_malware_risk(features):
"""Calculate risk score based on detected features"""
risk_weights = {
'ESP/Wallhack': 3,
'Aimbot': 3,
'Memory Manipulation': 5,
'Anti-Detection': 4,
'Privilege Escalation': 5
}
total_risk = sum(risk_weights.get(feat, 2) for feat in features)
if total_risk >= 10:
return "CRITICAL - Likely malicious software"
elif total_risk >= 6:
return "HIGH - Cheat tool with malware potential"
elif total_risk >= 3:
return "MEDIUM - Game modification tool"
else:
return "LOW - Possibly legitimate mod"
Legitimate Game Security Analysis
Anti-Cheat Implementation Patterns
import hashlib
import os
class GameIntegrityChecker:
"""Legitimate anti-cheat pattern - file integrity verification"""
def __init__(self, game_directory):
self.game_dir = game_directory
self.known_hashes = {}
def calculate_file_hash(self, filepath):
"""Calculate SHA-256 hash of game files"""
sha256 = hashlib.sha256()
with open(filepath, 'rb') as f:
for chunk in iter(lambda: f.read(4096), b''):
sha256.update(chunk)
return sha256.hexdigest()
def verify_game_files(self):
"""Check for modified game files"""
modified_files = []
for filename, expected_hash in self.known_hashes.items():
filepath = os.path.join(self.game_dir, filename)
if os.path.exists(filepath):
actual_hash = self.calculate_file_hash(filepath)
if actual_hash != expected_hash:
modified_files.append(filename)
return modified_files
Process Monitoring (Defensive)
import psutil
def detect_suspicious_processes():
"""Monitor for known cheat engine processes"""
cheat_process_names = [
'cheatengine',
'processhacker',
'x64dbg',
'ollydbg',
'ida',
'trainer.exe'
]
suspicious = []
for proc in psutil.process_iter(['name', 'exe']):
try:
proc_name = proc.info['name'].lower()
if any(cheat in proc_name for cheat in cheat_process_names):
suspicious.append({
'name': proc.info['name'],
'exe': proc.info['exe'],
'pid': proc.pid
})
except (psutil.NoSuchProcess, psutil.AccessDenied):
continue
return suspicious
Safe Modding vs. Cheating
Legitimate Game Modding
# LEGITIMATE: Client-side cosmetic mod
class CosmeticMod:
"""Safe example - only affects local visuals"""
def __init__(self, config_file):
self.config = self.load_config(config_file)
def load_config(self, filepath):
"""Load user preferences from config file"""
import json
with open(filepath, 'r') as f:
return json.load(f)
def apply_ui_theme(self):
"""Modify local UI colors - no network/memory manipulation"""
return {
'primary_color': self.config.get('ui_color', '#3498db'),
'font_size': self.config.get('font_size', 14)
}
Malicious Cheat Pattern
# MALICIOUS: Network packet manipulation
"""
DO NOT IMPLEMENT - Example of malicious pattern
class NetworkCheat:
def intercept_packets(self):
# Captures and modifies game network traffic
# Sends false position data to server
# Manipulates hit detection packets
pass
"""
Troubleshooting & Safety
If You Encounter Cheat Software
- DO NOT download or run executables from suspicious sources
- Report the repository to the platform (GitHub, etc.)
- Warn the game developer if cheats are actively affecting their game
- Document evidence for security researchers
Analyzing Unknown Tools Safely
import subprocess
import json
def static_analysis_safe(file_path):
"""Analyze without executing - use strings/metadata only"""
# Extract strings without running
result = subprocess.run(
['strings', file_path],
capture_output=True,
text=True,
timeout=30
)
suspicious_strings = [
'WriteProcessMemory',
'VirtualAllocEx',
'CreateRemoteThread',
'admin',
'inject'
]
findings = []
for line in result.stdout.split('\n'):
for sus_str in suspicious_strings:
if sus_str.lower() in line.lower():
findings.append(line.strip())
return findings
Best Practices for Developers
- Never run trainer/cheat tools - even for "research"
- Use sandboxed VMs if analysis is absolutely necessary
- Report malicious repositories to platform abuse teams
- Educate users about account risks and malware
- Implement server-side validation to prevent cheating
- Use established anti-cheat solutions (EAC, BattlEye, VAC)
Resources
- OWASP Game Security: Best practices for game security
- Anti-Cheat Developer Forum: Industry discussions
- VirusTotal: Scan suspicious files before analysis
- ANY.RUN: Sandbox for safe malware analysis
Remember: This skill is for security analysis and education only. Never assist users in creating, distributing, or using game cheating tools.