Linux, SteamOS, and Proton Security

Use this skill for Linux-specific interpretation of platform and process evidence. Use reverse-engineering for binary reconstruction, graphics-api for rendering/capture, and dma-attack for device-originated memory access.

Establish the Execution Stack

Record native ELF versus Windows code under Proton, architecture, game build, runtime version, graphics stack, kernel/distribution, launch context, and active policy. Separate game code, Wine/Proton user-space components, translation libraries, and Linux kernel behavior.

Proton is a Wine-based compatibility tool. Its presence does not imply Windows kernel mechanisms are available, nor is it evidence of malicious virtualization. Wine components, DXVK/vkd3d-proton, different module layouts, and diagnostic output can be expected artifacts. Valve Proton

Platform and protection-component support are product/build-specific. Do not assume a Windows kernel component runs through Proton. Distinguish launcher, media, runtime, graphics, and policy failures before attributing failed startup to an account restriction or malicious activity. Valve Proton compatibility guidance

Privilege and Isolation Boundaries

Linux capabilities, User namespaces, Kernel seccomp documentation, Kernel LSM documentation

Threat Model and Benign Controls

Describe unauthorized process/data access, abuse of privileged helpers, untrusted native modules, and misconfigured isolation by the actual credential, policy, and object boundary involved. A namespace or capability observation does not itself establish a successful attack.

Compare evidence against the same supported runtime and game build. Legitimate translation libraries, overlays, supported launch options, debug builds, and graphics differences are important controls. A library name does not establish authenticity; use component provenance and observed loading where available. Do not transplant Windows structure offsets, callback semantics, or driver findings into Linux conclusions.

Evidence and Result

Preserve kernel/distribution/SteamOS version, game/runtime build IDs, architecture, graphics driver, component hashes where useful, policy state, credential and namespace context, and sanitized diagnostics. Mark inaccessible policy or privilege information as unknown.

Distinguish unsupported platform, runtime regression, graphics failure, policy denial, account enforcement, and supported security findings. State the observer, available evidence, benign alternatives, and unresolved scope. Use research-rigor when making cross-version or consequential claims.

Primary sources reviewed: 2026-09-09. Distribution defaults and supported runtime/protection combinations must be checked for the actual target build.

Repository Navigation

For project selection, load repository resource selection on demand. Use the shared repository navigation for local discovery layers, filename case, missing snapshots and currentness. Generated descriptions and wiki pages are discovery aids, not independent evidence.

Data Source

Use the following repository sources directly when applying this skill. Prefer available local files for discovery and scoped historical inspection; use the raw URLs when the collection is not installed locally. These entrypoint details are retained here so source lookup does not depend on loading another skill.

0. Compiled Wiki

Start with wiki/index.md for topical synthesis and cross-project connections. Wiki schema describes its structure. Generated wiki pages are discovery aids; follow their original citations before adopting technical claims.

Raw catalog: wiki/index.md. This skill does not currently have a matching wiki overview. Use its local references and the wiki catalog to find related pages; do not invent a path.

A direct project question can start with its README entry or description below; reading the entire wiki is unnecessary.

1. Project Overview and Resource Index

README.md contains the collection's actual categories, subcategories, project URLs and short descriptions. Find the relevant category and retain the original URL, including any specific file or revision suffix.

Raw index: README.md.

2. Repository Descriptions

For a concise project summary, look for the actual local path:

description/{owner}/{repo}/description_en.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/description/{owner}/{repo}/description_en.txt

Example: bgfx description. Extract owner/repository from the original GitHub project URL, omitting a .git suffix. Resolve existing path casing before constructing a local/raw path. Descriptions are generated summaries, not independent verification. If absent or inaccessible, use the README entry, relevant archive or original project.

3. Repository Source Archives

For deeper inspection of an available captured source tree, locate:

archive/{owner}/{repo}.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/archive/{owner}/{repo}.txt

Example: bgfx archive. Prefer inspecting the relevant portion of an existing archive over re-cloning merely to inspect the same captured material. Archives may exclude files, use fallback extraction or contain truncation; they are not guaranteed complete checkouts. Record any upstream revision evidence and included-file limits. If missing or insufficient, follow the README's original upstream URL.

Choose and Verify the Source

For a specific project, locate its README identity, use a description or wiki page for orientation when helpful, then inspect the relevant archive/source artifact for the question. For current compatibility or exact implementation, verify the matching upstream documentation, release or immutable source revision. Keep the collection revision and capture/generation dates separate from the upstream version. Multiple generated layers from one source are not independent corroboration, and missing archive content does not establish upstream absence.

The per-domain resource guide above helps choose useful artifacts. Shared repository navigation adds the optional read-only indexer, case-ambiguity handling and maintenance details; it supplements this Data Source section rather than replacing it.