bug: managed to achieve negative skill points, which allowed me to buy all skills.
I think I managed to click twice during a moment of lag, resulting in two buys being performed against the same (and thus stale the second time around) skill point count check.
While this is just a guess, you may want to see about splitting the input handling into three stages
stage one: raw inputs.
stage two: sanity/validity checks.
stage three: actual actions.