Not sure if i unterstood you right rackscha, but I wouldn't call this a secure solution. a hacked client could still ignore this skill (or variable) and place his player anywhere he wants.

I know 2 solutions:
1. Let the client place the entity somewhere outside of the level or at the nullvector. Let the server then place the entity at the right position, and use ent_sendnow to update the client. However, you'd have to detach the camera from the player as long as it is not inside the level and waiting for its new position.

2. use ent_create only on the server. you can't use proc_local and such then. The multiplayer plugins (gstnet and anet) don't rely on who the entity created. The native system is limited there.

Additionally, you have to make sure that the clients can only send their input to the server, and not their absolute position. Always let the server's view of the game be the one you transfer.

EDIT: it looks like you're already doing that. Sorry, I can't help you with the code, don't have much time currently..