claude-code-arcane 2.17.0 → 2.18.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [2.18.0](https://github.com/SebastianLuser/claude-code-arcane/compare/v2.17.0...v2.18.0) (2026-10-17)
+
+
+### Features
+
+* **skills:** rename security-audit to game-security-audit, games only ([e01d48e](https://github.com/SebastianLuser/claude-code-arcane/commit/e01d48e8c17c5393c7b8fe5672b02b50dc732f16))
+
 # [2.17.0](https://github.com/SebastianLuser/claude-code-arcane/compare/v2.16.0...v2.17.0) (2026-10-16)
 
 

package/README.md

@@ -114,7 +114,7 @@ npx claude-code-arcane install unity-dev --dry-run   # Preview without installin
 ```bash
 npx claude-code-arcane add                           # Interactive picker (same wizard as install)
 npx claude-code-arcane add api-design                # Add a single skill
-npx claude-code-arcane add security-audit owasp      # Add multiple skills
+npx claude-code-arcane add owasp-top10-check secret-management      # Add multiple skills
 npx claude-code-arcane add +security                 # Add an entire profile
 npx claude-code-arcane add +database +testing        # Add multiple profiles
 ```
@@ -192,7 +192,7 @@ Older names still install and update: `backend-ts`, `frontend`, `mobile`, `flutt
 | Profile | Stack | Skills | Agents |
 |---------|-------|--------|--------|
 | `backend-typescript` | Backend TypeScript — Fastify, Prisma, Zod, API design | 27 | engineering |
-| `backend-go` | Backend Go — Clean Arch, DB, auth, API, CI | 26 | engineering |
+| `backend-go` | Backend Go — Clean Arch, DB, auth, API, CI | 25 | engineering |
 | `backend-dotnet` | Backend .NET — ASP.NET Core, Vertical Slice/Clean, EF Core, JWT | 27 | engineering |
 | `backend-nestjs` | Backend NestJS — feature modules, DI, Prisma, JWT, microservices | 27 | engineering |
 | `backend-nextjs` | Next.js full-stack — App Router, RSC, Server Actions, SEO, AI SDK | 25 | engineering |
@@ -231,7 +231,7 @@ Older names still install and update: `backend-ts`, `frontend`, `mobile`, `flutt
 |---------|------|--------|--------|
 | `infra` | Terraform, observability, secrets, rollback, K8s | 26 | devops |
 | `database` | Indexing, migrations, seeding, replicas, optimization | 8 | — |
-| `security` | Audits, OWASP, secrets, backups | 10 | — |
+| `security` | Audits, OWASP, secrets, backups | 9 | — |
 | `testing` | Contract, performance, regression, flakiness | 11 | quality |
 | `ai` | LLM cost optimization, RAG, ML, data engineering, agent and MCP design | 10 | ai |
 
@@ -311,6 +311,17 @@ It ships the in-editor skills that operate and extend the MCP (`unreal-mcp`, `cr
 
 Building your own server? `/mcp-server-builder` scaffolds one.
 
+### Recommended complements
+
+Arcane leaves out what these already do well. Install them once, at user level, next to any profile:
+
+| Complement | What it adds | Install |
+|------------|--------------|---------|
+| [Cloudflare `security-audit`](https://github.com/cloudflare/security-audit-skill) | Security audit for any codebase. Arcane's `/game-security-audit` only covers games (saves, cheats, netcode) | `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global` |
+| [ponytail](https://github.com/DietrichGebert/ponytail) | Plugin that makes Claude write the least code that fully solves the task | `/plugin marketplace add DietrichGebert/ponytail`, then `/plugin install ponytail@ponytail` |
+
+Arcane used to ship its own `security-audit`, so a project installed before the rename would end up with two skills under that name. Run `npx claude-code-arcane update` there first: it moves the old one to `.claude/.arcane-trash/`.
+
 ---
 
 ## Examples by Project

package/agents/quality/security-architect.md

@@ -6,7 +6,7 @@ permissionMode: acceptEdits
 model: sonnet
 maxTurns: 20
 memory: project
-skills: [security-audit, security-pen-testing, soc2-compliance]
+skills: [security-pen-testing, soc2-compliance]
 ---
 
 Sos el **Security Architect**. Owner de que el sistema sea defensible.

package/docs/SKILLS-CATALOG.md

@@ -72,7 +72,7 @@ Desde cualquier proyecto que tenga Arcane configurado, escribi `/` seguido del n
 
 ---
 
-## Gamedev (25 skills)
+## Gamedev (26 skills)
 
 | Skill | Descripcion | Uso |
 |-------|-------------|-----|
@@ -84,6 +84,7 @@ Desde cualquier proyecto que tenga Arcane configurado, escribi `/` seguido del n
 | `/consistency-check` | Detecta inconsistencias cross-documento en stats/items | `[full \| since-last \| entity:<name>]` |
 | `/doc-gdd` | Genera Game Design Document completo | `[game-name]` |
 | `/doc-pas` | Documentacion PAS (Problem-Analysis-Solution) | `[problem o decision title]` |
+| `/game-security-audit` | Audit de seguridad para juegos Unity/Unreal: saves, red, cheats, input | `[full \| network \| save \| input \| quick]` |
 | `/install-mcp` | Conecta Claude con el MCP del engine: Unity (package UPM) o Unreal (plugins del engine) | `[unity\|unreal] [--secondary] [path]` |
 | `/meshy-derive` | Deriva targets (FBX, GLB web, blend, STL) desde el master GLB | `<slug> [game\|web\|edit\|print\|all]` |
 | `/meshy-generate` | Genera asset 3D con Meshy: preview -> refine, con gate de creditos | `<slug> [--from-image <path>] [--spec <path>]` |
@@ -178,7 +179,7 @@ Instalables con el perfil `unreal-dev`. Procedencia y licencias en `ATTRIBUTION.
 
 ---
 
-## General (54 skills)
+## General (53 skills)
 
 | Skill | Descripcion | Uso |
 |-------|-------------|-----|
@@ -224,7 +225,6 @@ Instalables con el perfil `unreal-dev`. Procedencia y licencias en `ATTRIBUTION.
 | `/runbooks` | Crea y gestiona runbooks operativos | `[create <name> \| list \| update <name>]` |
 | `/scope-check` | Analiza scope creep vs plan original | `[feature-name o sprint-N]` |
 | `/secret-management` | Gestion de secrets: GCP SM, Vault, SOPS | `[setup\|rotate\|audit]` |
-| `/security-audit` | Audit de seguridad para juegos | `[full \| network \| save \| input \| quick]` |
 | `/skill-improve` | Mejora un skill con loop test-fix-retest | `[skill-name]` |
 | `/skill-test` | Valida skills (estructura + comportamiento) | `static [name\|all] \| spec [name] \| audit` |
 | `/slack` | Gestiona Slack: mensajes, canales, archivos | `[send\|channel\|file\|search] <args>` |

package/docs/USER-GUIDE.md

@@ -93,7 +93,7 @@ If `.claude/` already exists, it gets backed up to `.claude.bak/` and replaced.
 npx claude-code-arcane add api-design
 
 # Add multiple skills
-npx claude-code-arcane add security-audit owasp
+npx claude-code-arcane add owasp-top10-check secret-management
 
 # Add an entire profile
 npx claude-code-arcane add +security

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-arcane",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "description": "Skills, agents, hooks and rules for Claude Code — installable via npx claude-code-arcane",
   "type": "module",
   "bin": {

package/profiles/backend-go.yaml

@@ -5,7 +5,6 @@ category: backend
 skills:
   - test-setup
   - deps-audit
-  - security-audit
   - env-sync
   - observability
   - scaffold-go

package/profiles/security.yaml

@@ -3,7 +3,6 @@ description: "Security — audits, OWASP, secrets, backups"
 category: platform
 
 skills:
-  - security-audit
   - audit-dev
   - owasp-top10-check
   - secret-management

package/profiles/unity-dev.yaml

@@ -8,7 +8,7 @@ skills:
   - optimize
   - deps-audit
   - env-sync
-  - security-audit
+  - game-security-audit
   - release-checklist
   - patch-notes
   - onboard

package/profiles/unreal-dev.yaml

@@ -52,7 +52,7 @@ skills:
   - optimize
   - deps-audit
   - env-sync
-  - security-audit
+  - game-security-audit
   - release-checklist
   - patch-notes
   - onboard

package/skills/arcane-add/SKILL.md

@@ -17,7 +17,7 @@ Add individual skills or entire profiles to the current Arcane installation with
 Examples:
 - `/arcane-add` — no args: show what can be added and ask
 - `/arcane-add docker-setup` — add a single skill
-- `/arcane-add security-audit owasp-top10-check` — add multiple skills
+- `/arcane-add owasp-top10-check secret-management` — add multiple skills
 - `/arcane-add +security` — add all skills from the +security profile
 - `/arcane-add +database` — add all skills from the +database profile
 

package/skills/{security-audit → game-security-audit}/SKILL.md

@@ -1,17 +1,17 @@
 ---
-name: security-audit
-description: "Security audit: save tampering, cheat vectors, network exploits, data exposure, input validation. Prioritized report + fixes."
+name: game-security-audit
+description: "Game security audit (Unity/Unreal): save tampering, cheat vectors, network exploits, data exposure, input validation. Prioritized report + fixes."
 category: "security"
 argument-hint: "[full | network | save | input | quick]"
 user-invocable: true
-allowed-tools: Read, Glob, Grep, Bash, Write, Task
+allowed-tools: Read, Glob, Grep, Bash, Write
 context: fork
 agent: security-architect
 ---
 
-# Security Audit
+# Game Security Audit
 
-Systematically audits codebase for common game security failures and produces prioritised remediation plan.
+Systematically audits a game codebase for common game security failures and produces prioritised remediation plan.
 
 **Run:** before public release (required for Polish→Release gate), before multiplayer features, after disk/network read systems, when security bug reported.
 
@@ -30,11 +30,7 @@ Output: `production/security/security-audit-[date].md`
 
 Detect language, platforms and, for a game, the engine (`ProjectSettings/ProjectVersion.txt` (Unity) or the `.uproject` (Unreal)) from the project files. Take multiplayer scope from the GDD, or ask.
 
-## Phase 2: Spawn Security Engineer
-
-Spawn `security-engineer` via Task with: audit mode, engine/language, manifest of source directories. Collect full findings.
-
-## Phase 3: Audit Categories
+## Phase 2: Audit Categories
 
 | Category | Key Checks |
 |----------|-----------|
@@ -47,7 +43,7 @@ Spawn `security-engineer` via Task with: audit mode, engine/language, manifest o
 
 Skip categories not applicable. Grep for relevant patterns per category.
 
-## Phase 4: Classify Findings
+## Phase 3: Classify Findings
 
 | Severity | Definition |
 |----------|-----------|
@@ -58,17 +54,17 @@ Skip categories not applicable. Grep for relevant patterns per category.
 
 Status: Open / Accepted Risk / Out of Scope.
 
-## Phase 5: Generate Report
+## Phase 4: Generate Report
 
-Executive summary (severity counts + release recommendation: CLEAR TO SHIP / FIX CRITICALS / DO NOT SHIP). Per finding: ID, category, file+line, description, attack scenario, remediation, effort. Dependency inventory (plugin/version/source/CVEs). Prioritised remediation order.
+Executive summary (severity counts + release recommendation: CLEAR TO SHIP / FIX CRITICALS / DO NOT SHIP, which read as PASS / CONCERNS / FAIL next to other audits). Per finding: ID, category, file+line, description, attack scenario, remediation, effort. Dependency inventory (plugin/version/source/CVEs). Prioritised remediation order.
 
-## Phase 6: Write Report
+## Phase 5: Write Report
 
 Present summary + CRITICAL/HIGH in conversation. "May I write full report to `production/security/security-audit-[date].md`?" Write after approval.
 
-## Phase 7: Gate Integration
+## Phase 6: Gate Integration
 
-Required for **Polish → Release gate**. After remediation: `/security-audit quick` to confirm. CRITICAL exists → "Must resolve before release." No CRITICAL/HIGH → "Clear for `/gate-check release`."
+Required for **Polish → Release gate**. After remediation: `/game-security-audit quick` to confirm. CRITICAL exists → "Must resolve before release." No CRITICAL/HIGH → "Clear for `/gate-check release`."
 
 ## Protocol
 

package/skills/ue-networking-replication/SKILL.md

@@ -446,6 +446,6 @@ Validate before considering the work done:
 ## Next Steps
 
 - `/ue-testing-debugging` — test with multiple clients and simulated latency
-- `/security-audit` — review the client-to-server trust boundary
+- `/game-security-audit` — review the client-to-server trust boundary
 - `/code-review` — architectural and quality review of the change
 - `/commit` — conventional commit once the change is verified