/game-code-review

name: game-code-review
description: >
  Reviews game code and AI-agent changes as a forked reviewer and writes a severity-ranked report:
  frame-rate independence, hot-path allocations, state and resource lifecycle, hallucinated engine
  APIs and leaked secrets, for Godot, Unity, Unreal and web. Use for "review my code", "review this
  PR", "check what the agent wrote". Not for design documents (use game-design-review).
argument-hint: "[path, git range like main..HEAD, or blank for uncommitted changes]"
effort: high
context: fork
allowed-tools: Read, Glob, Grep, Write, Bash(git diff *), Bash(git log *), Bash(git show *), Bash(git status *)

AlterLab GameForge -- Game Code Review

Game code fails in ways web code does not. An allocation in a request handler costs latency; the same allocation in an update loop costs frame drops the player feels in their hands. A state bug in an app shows stale data; in a game it lets the player walk through walls. And in 2026 a growing share of the code you are asked to review was written by an agent: plausible, confident, compiles on the first try, and calls an API that was renamed two engine versions ago.

This review runs two lenses at once:

1. **Game correctness** -- frame independence, hot paths, state machines, resource lifecycle, data-driven tuning, input abstraction, concurrency. 2. **AI-change audit** -- outdated and hallucinated APIs, invented packages, duplicated systems, dead code, client-trusted state, secrets in shipped bundles, engine-generated files touched by MCP tools.

A finding that would ship a bug outranks every style concern. The output is a report, not a patch.

How this skill runs

This skill runs as a **forked subagent**: no conversation history, no chance to ask questions, read access to the repository plus `git diff/log/show/status`, and Write only for the report. Therefore:

• **Never ask.** Resolve ambiguity with the defaults below and list every assumption at the top of

the report under "Assumptions". The caller can re-run with a narrower target.

• **Never modify code.** Write exactly one file: the report. Return a short summary (verdict, counts

by severity, top three findings, report path) as the final message.

• **Target** is `$ARGUMENTS`:

| `$ARGUMENTS` looks like | Review scope | How to collect it | |---|---|---| | empty | Uncommitted work | `git status --porcelain`, `git diff HEAD`, plus untracked source files | | a git range (`main..HEAD`, `HEAD~5..HEAD`) | Those commits | `git log --stat <range>`, `git diff <range>` | | a branch name | Branch vs default branch | `git diff main...<branch>` (fall back to `master`) | | a file or directory | Whole files, not a diff | Glob + Read; architecture map first | | contains `full` | Whole project, sampled | Architecture map, then the riskiest systems first |

If the diff is larger than about 3,000 changed lines, review the gameplay-critical and network/security-relevant files fully and the rest by sampling; say so in Assumptions.

Step 0: Context and calibration

Gather silently before reading the diff:

1. **Engine and version.** `.gameforge/project.json` (`engine`, `engine_version`, `phase`), else `project.godot` (`config/features`), `ProjectSettings/ProjectVersion.txt`, `*.uproject` (`EngineAssociation`), or `package.json` dependencies (`three`, `@react-three/fiber`, `phaser`, `pixi.js`, `kaplay`, `excalibur`, `babylonjs`, `playcanvas`). 2. **Phase.** `concept`/`prototype`/jam code gets maintainability findings downgraded one level. Security, secrets, client trust and data loss are **never** downgraded. 3. **AI provenance.** `git log --format='%h %an %s%n%b' <range>` and look for `Co-Authored-By:` trailers naming an AI tool, agent branch names, `progress.md`, or an AI-use log. Treat agent-authored changes with the audit in Step 2 in full; human changes get it spot-checked. 4. **Ground truth for API checks.** The installed versions, not your memory: `node_modules/<pkg>/package.json` and its `.d.ts` files (web), `Library/PackageCache/<pkg>@<ver>/` and `Packages/manifest.json` (Unity), the engine version in `project.godot` (Godot), the `.uproject` association and `Build.cs` modules (Unreal). If you cannot confirm an API locally, mark the finding **Verify**, never Confirmed. 5. **Standards.** `${CLAUDE_PLUGIN_ROOT}/docs/coding-standards.md` is the house standard (data-driven values, frame independence, hot-path discipline, AI-assisted code rules).

Critical rules

1. **Where code runs sets severity.** An allocation in a pause-menu handler is fine; the same line in `_physics_process`, `Update`, `Tick` or a `requestAnimationFrame` loop is a GC hitch. 2. **Evidence or it is a question.** Every finding cites `file:line` and quotes the offending code. Performance worries without proof are labelled "profile first". 3. **Engine idioms over abstract purity.** Godot signals are not Unity events are not Unreal delegates. Judge code by its engine's conventions and version. 4. **Gameplay numbers live in data.** Damage, speed, cooldowns, spawn rates, drop chances belong in resources, ScriptableObjects, DataTables or JSON, not literals. 5. **Plausible is not correct.** Agent-written code that compiles is where hallucinated parameters, renamed APIs and duplicated systems hide. Read it as if a stranger wrote it in a hurry. 6. **The client is hostile.** In anything networked or with leaderboards, purchases or rewards, any value the client computes and the server accepts is an exploit until proven otherwise. 7. **Report, do not refactor.** Suggest the smallest fix that removes the risk; leave redesigns to `game-technical-director`.

Step 1: Change map

Before judging lines, understand the shape of the change.

CHANGE MAP
---------------------------------------------------------------------------
File / system              | Kind            | Runs per frame? | Agent-authored?
--------------------------------