gamification-audit

Detects abuse of XP, points, streaks, referrals, and rewards using a trigger-condition-reward-reversal loop model.

Updated Aug 29, 2026
One-click install
npx skills add https://github.com/1arley/volibear --skill gamification-audit-1arley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gamification-audit
Source: https://github.com/1arley/volibear/tree/main/.opencode/skills/gamification-audit
Command: npx skills add https://github.com/1arley/volibear --skill gamification-audit-1arley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Gamification systems that grant XP, points, coins, reputation, achievements, streaks, likes, or referrals can be manipulated to emit rewards without the behavior they were designed to incentivize, inflating economies and rankings. This Skill gives an agent a systematic model to find where reward loops can be farmed, replayed, or self-awarded. ## Core Features & Use Cases - Reward Loop Modeling: Maps every reward as a TRIGGER → CONDITION → REWARD → REVERSAL loop and tests each phase for manipulation. - Abuse Vector Coverage: Hunts self-reward, multi-account referral farming, replay, concurrency farming, and bot automation, including the canonical ACTION → REWARD → REVERSE → ACTION → REWARD farming test. - Confidence-Graded Findings: Reports findings with evidence tiers from CONFIRMED (reproduced double reward) down to SPECULATIVE, plus false-positive checks like real reversals and unique constraints. - Use Case: While reviewing a social app, you discover users can react to their own posts and that unreacting does not remove the granted XP, enabling infinite XP farming through a react/unreact toggle. ## Quick Start Ask the agent to audit the reward and streak logic in this codebase for farming, self-reward, and replay abuse using the gamification audit.

Frequently Asked Questions about gamification-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a gamification system for reward abuse?▼

Map each reward as a TRIGGER → CONDITION → REWARD → REVERSAL loop, then run the canonical test: ACTION → REWARD → REVERSE → ACTION → REWARD. If the second action grants reward again without the reversal removing the first, the loop is farmable.

What are common XP and points farming vulnerabilities?▼

The main vectors are self-reward (reacting to your own content), multi-account referral farming, replaying the same trigger, concurrent duplicate claims, and bot automation. Missing reversals and missing unique constraints on (entity, action) pairs enable most of them.

How do I prevent referral and streak abuse with multiple accounts?▼

Enforce server-side unique constraints per user, entity, and time window, restrict rewards by identity signals like device or IP, and calculate rewards server-side rather than trusting client payloads. Rate limits and anti-bot checks mitigate automated trigger generation.

When is gamification farming not a real vulnerability?▼

It is a false positive when reversals genuinely remove the reward, unique constraints deduplicate replays, self-reward is rejected server-side, or the reward is purely cosmetic with no rank or monetary value. Streak daily resets are intentional design, not bugs.

Which audit skills pair with a gamification abuse review?▼

It composes with business-logic-audit for reward rules, idempotency-audit for duplicate rewards, race-condition-hunter for concurrent farming, api-abuse-audit for direct API reward claims, and input-trust-audit for client-supplied XP values.