SKILL.md
Roblox code review
Review in severity order. Report each finding with file:line, severity, what breaks, and the fix. Verify claims against the code (and the engine reference when unsure) — don't pattern-match blindly.
Severity guide
| Severity | Examples |
|---|---|
| Critical | Client-authoritative rewards/damage/currency; unvalidated remote args (NaN, instance spoofing); purchases granted outside ProcessReceipt or non-idempotent; data saved with SetAsync from multiple servers without session locking; secrets/API keys in replicated code; unfiltered player text shown to others. |
| High | Data loss paths (no BindToClose, saving default data after a failed load, no retry); memory leaks (connections, player-keyed tables); InvokeClient; per-frame remotes; infinite yields (WaitForChild without timeout on optional instances, RemoteFunction handlers that can yield forever); streaming-unsafe client indexing. |
| Medium | Deprecated/superseded APIs; wait/spawn/delay; polling loops; server-side tweens; missing pcall on network/yielding APIs; missing late-joiner handling; race conditions on CharacterAdded. |
| Low | Style, naming, missing types, magic numbers, dead code, minor inefficiencies. |