Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TabooHarmony/roblox-brain --skill roblox-code-reviewgit clone --depth 1 https://github.com/TabooHarmony/roblox-brainWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tabooharmony/roblox-brain/roblox-code-review)<a href="https://agentmods.dev/skills/tabooharmony/roblox-brain/roblox-code-review"><img src="https://agentmods.dev/badge/skills/tabooharmony/roblox-brain/roblox-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tabooharmony/roblox-brain/roblox-code-review"><img src="https://agentmods.dev/badge/skills/tabooharmony/roblox-brain/roblox-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00487 |
| Opus 5 | $0.00014 | $0.00244 |
| Sonnet 5 | $0.00006 | $0.00097 |
| Haiku 4.5 | $0.00003 | $0.00049 |
Grade A, and why
roblox-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Roblox Code Review
Route a Roblox code review to the right domain skills and produce a structured report. Apply relevant lenses based on what changed, not all every time.
When to Load
- User asks for code review on Roblox/Luau code
- User asks to audit security, performance, networking, monetization, or data persistence
- User asks about Roblox best practices for remotes, data saving, or code organization
Quick Reference
Routing: Load These Skills for Each Lens
| Lens | Load |
|---|---|
| Security audit | roblox-security |
| Remote validation | roblox-networking |
| Data persistence | roblox-data |
| Cross-server state | roblox-server-data |
| Monetization | roblox-monetization |
| Performance | roblox-performance |
| Luau correctness | roblox-luau-core, roblox-luau-types |
| Architecture | roblox-architecture |
Static-Analysis Limits
- Static scans can flag numeric
requirecalls, dynamic-code markers, obfuscation-like names, cleanup tokens, and duplicate files; these are provenance or review signals, not verdicts. - Trace the containing function, authority boundary, reachability, and lifecycle before assigning severity.
- Label search-only findings separately from observed runtime behavior, test results, and unavailable evidence.
- Vertical slice review: For a player-facing change, trace input → UI/world feedback → remote or simulation → authoritative state → persistence → cleanup. Review the real path; file or class co-occurrence is not proof that a runtime connection exists.
Output Format
- READY / NOT READY
- Critical blockers (security, data loss, crashes)
- Warnings (leaks, bottlenecks, deprecated APIs)
- Unverified risks and unavailable evidence
- Findings with specific fixes
Severity: Critical / High / Medium / Low. For each finding: file + line, what's wrong, impact, and the smallest correct fix. The routed domain skill owns detailed checks.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 50 lines · 28 tokens per session scan A fc658e64ec59
roblox-code-review is a skill published in the GitHub repository TabooHarmony/roblox-brain (42 stars, last pushed 5d ago), licensed MIT. It adds 28 tokens to every session and 487 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
godot-code-review
Use when reviewing GDScript or C# Godot code — checklist of best practices, common anti-patterns, and Godot-specific pitfalls.
apple-polish
Design and keynote-readiness craftsmanship review of an iOS app. Evaluates through Jony Ive (visual obsession) and Steve Jobs (demo readiness) perspectives, presents prioritized findings, then orchestrates parallel agents to fix selected issues and push a TestFlight build. Use for design polish, not engineering bugs.
apple-patterns-check
Validate iOS code against Apple's best practices. Run during /ship, before commits, or when reviewing code for Apple-specific compliance. Triggers on "check patterns", "apple check", "pre-commit check", or "validate swift code".
architecture-fit-check
Audit a design or subsystem for primitive/problem fit — catch the wrong-primitive trap where a powerful or opaque Apple framework (CloudKit sharing/CKShare, NSPersistentCloudKitContainer mirroring, NSFileCoordinator, App Intents graphs, widget timelines) is adopted to enforce an elegant invariant instead of fitting…
code-review
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use…
improve-codebase-architecture
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.