How do I install the Roblox Code Review skill?

Run npx skillmds@latest add tomevault-io/roblox-code-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Roblox Code Review safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Roblox Code Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Roblox Code Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Roblox Code Review?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Roblox Code Review by tomevault-io — Agent Skill

Name: Roblox Code Review
Author: tomevault-io

File contents

/code-review - Code Quality Review

Review Roblox projects with security, performance, and monetization lenses. Apply relevant lenses based on what changed — not all every time. Full details: references/full.md.

When to Load

User runs /code-review or asks for code review on Roblox/Luau code
User asks to audit security, performance, networking, monetization, or data persistence
User asks about Roblox best practices for remotes, data saving, or code organization

Quick Reference

8-Step Review

Project Scan — scripts, folders, naming, Rojo/Wally/Studio
Organization — correct services, PascalCase modules, no orphans
Code Quality — wait()→task.wait(), spawn()→task.spawn(), delay()→task.delay(), globals
Architecture — single responsibility, no circular requires, server/client split
Security — validate remotes server-side, no client-trusted state, rate-limit
Performance — consolidate Heartbeat, cache services, disconnect events
Report — Grade A-F. Severity: Critical/High/Medium/Low
Refactor — Immediate → Short-term → Long-term

Remote Types

RemoteEvent — fire-and-forget | RemoteFunction — blocking, sparse, never per-frame
UnreliableRemoteEvent — loss-tolerant VFX/position ONLY, never currency/inventory/damage

Security

Validate remotes: typeof(), range, cooldown, authorization
State changes server-authoritative. No sensitive data in ReplicatedStorage
Rate-limit all remotes per-player

Performance

wait()/spawn()/delay() → task.*. One Heartbeat per script
Parts: <50K mobile, <200K PC. MeshParts > Unions
Disconnect every :Connect(). Batch remotes. Cache GetService()

Networking

Remotes under ReplicatedStorage.Remotes.{Category}, PascalCase VerbNoun
Separate reliable (state) from unreliable (cosmetics). FireClient > FireAllClients

Data Persistence

Always ProfileStore, never raw DataStoreService
Template: DataVersion, defaults, JSON-only types. Reconcile() after load
Session lock: AddUserId, ListenToRelease, ForceLoad
Lifecycle: PlayerAdded→load, PlayerRemoving→sync+release, BindToClose→parallel

Monetization

Map GamePasses/DevProducts. ProcessReceipt: grant then confirm
Pricing: Entry 25-49R, Mid 99-199R, Premium 499-999R
Flag: loot odds, FOMO, pay-to-win, dark patterns

Source: TabooHarmony/roblox-brain — distributed by TomeVault.

---name: roblox-code-reviewdescription: Code review with security, performance, and monetization lenses for Roblox projects Use when this capability is needed.---# /code-review - Code Quality ReviewReview Roblox projects with security, performance, and monetization lenses. Apply relevant lenses based on what changed — not all every time. Full details: `references/full.md`.## When to Load- User runs `/code-review` or asks for code review on Roblox/Luau code- User asks to audit security, performance, networking, monetization, or data persistence- User asks about Roblox best practices for remotes, data saving, or code organization## Quick Reference### 8-Step Review1. **Project Scan** — scripts, folders, naming, Rojo/Wally/Studio2. **Organization** — correct services, PascalCase modules, no orphans3. **Code Quality** — `wait()`→`task.wait()`, `spawn()`→`task.spawn()`, `delay()`→`task.delay()`, globals4. **Architecture** — single responsibility, no circular requires, server/client split5. **Security** — validate remotes server-side, no client-trusted state, rate-limit6. **Performance** — consolidate Heartbeat, cache services, disconnect events7. **Report** — Grade A-F. Severity: Critical/High/Medium/Low8. **Refactor** — Immediate → Short-term → Long-term### Remote Types- **RemoteEvent** — fire-and-forget | **RemoteFunction** — blocking, sparse, never per-frame- **UnreliableRemoteEvent** — loss-tolerant VFX/position ONLY, never currency/inventory/damage### Security- Validate remotes: `typeof()`, range, cooldown, authorization- State changes server-authoritative. No sensitive data in ReplicatedStorage- Rate-limit all remotes per-player### Performance- `wait()`/`spawn()`/`delay()` → `task.*`. One Heartbeat per script- Parts: <50K mobile, <200K PC. MeshParts > Unions- Disconnect every `:Connect()`. Batch remotes. Cache GetService()### Networking- Remotes under `ReplicatedStorage.Remotes.{Category}`, PascalCase VerbNoun- Separate reliable (state) from unreliable (cosmetics). FireClient > FireAllClients### Data Persistence- **Always ProfileStore**, never raw DataStoreService- Template: DataVersion, defaults, JSON-only types. Reconcile() after load- Session lock: AddUserId, ListenToRelease, ForceLoad- Lifecycle: PlayerAdded→load, PlayerRemoving→sync+release, BindToClose→parallel### Monetization- Map GamePasses/DevProducts. ProcessReceipt: grant then confirm- Pricing: Entry 25-49R, Mid 99-199R, Premium 499-999R- Flag: loot odds, FOMO, pay-to-win, dark patterns---> Source: [TabooHarmony/roblox-brain](https://github.com/TabooHarmony/roblox-brain) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

Roblox Code Review