# Roblox Code Review

> Code review with security, performance, and monetization lenses for Roblox projects

- **Type:** Skill
- **Install:** `agentstack add skill-tabooharmony-roblox-brain-roblox-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [TabooHarmony](https://agentstack.voostack.com/s/tabooharmony)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [TabooHarmony](https://github.com/TabooHarmony)
- **Source:** https://github.com/TabooHarmony/roblox-brain/tree/main/skills/roblox-code-review

## Install

```sh
agentstack add skill-tabooharmony-roblox-brain-roblox-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# /code-review - Code Quality Review

Review Roblox projects with security, performance, and monetization lenses. Apply relevant lenses based on what changed — not all every time. Full details: `references/full.md`.

## When to Load

- User runs `/code-review` or asks for code review on Roblox/Luau code
- User asks to audit security, performance, networking, monetization, or data persistence
- User asks about Roblox best practices for remotes, data saving, or code organization

## Quick Reference

### 8-Step Review
1. **Project Scan** — scripts, folders, naming, Rojo/Wally/Studio
2. **Organization** — correct services, PascalCase modules, no orphans
3. **Code Quality** — `wait()`→`task.wait()`, `spawn()`→`task.spawn()`, `delay()`→`task.delay()`, globals
4. **Architecture** — single responsibility, no circular requires, server/client split
5. **Security** — validate remotes server-side, no client-trusted state, rate-limit
6. **Performance** — consolidate Heartbeat, cache services, disconnect events
7. **Report** — Grade A-F. Severity: Critical/High/Medium/Low
8. **Refactor** — Immediate → Short-term → Long-term

### Remote Types
- **RemoteEvent** — fire-and-forget | **RemoteFunction** — blocking, sparse, never per-frame
- **UnreliableRemoteEvent** — loss-tolerant VFX/position ONLY, never currency/inventory/damage

### Security
- Validate remotes: `typeof()`, range, cooldown, authorization
- State changes server-authoritative. No sensitive data in ReplicatedStorage
- Rate-limit all remotes per-player

### Performance
- `wait()`/`spawn()`/`delay()` → `task.*`. One Heartbeat per script
- Parts:  Unions
- Disconnect every `:Connect()`. Batch remotes. Cache GetService()

### Networking
- Remotes under `ReplicatedStorage.Remotes.{Category}`, PascalCase VerbNoun
- Separate reliable (state) from unreliable (cosmetics). FireClient > FireAllClients

### Data Persistence
- **Always ProfileStore**, never raw DataStoreService
- Template: DataVersion, defaults, JSON-only types. Reconcile() after load
- Session lock: AddUserId, ListenToRelease, ForceLoad
- Lifecycle: PlayerAdded→load, PlayerRemoving→sync+release, BindToClose→parallel

### Monetization
- Map GamePasses/DevProducts. ProcessReceipt: grant then confirm
- Pricing: Entry 25-49R, Mid 99-199R, Premium 499-999R
- Flag: loot odds, FOMO, pay-to-win, dark patterns

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [TabooHarmony](https://github.com/TabooHarmony)
- **Source:** [TabooHarmony/roblox-brain](https://github.com/TabooHarmony/roblox-brain)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-tabooharmony-roblox-brain-roblox-code-review
- Seller: https://agentstack.voostack.com/s/tabooharmony
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.