Zen-Ai-Pentest: Agent for Claude Code

.opencode/agents/drupal-performance-engineer.md

Drupal Performance Engineer is an agent for Claude Code, OpenCode from SHAdd0WTAka/Zen-Ai-Pentest. It costs 68 tokens per session (5,241 once invoked), scanned A, original, MIT.

A Drupal performance specialist focused on how pages are rendered, cached, queried, and delivered. Drupal is a content-management system, and its performance depends on both application code and server configuration.

In plain words
What is it for?
Use it to improve Core Web Vitals, page and render caching, database queries, Views, images, CSS and JavaScript delivery, CDNs, and PHP server settings.
Why use it?
It helps find the actual causes of slow pages instead of hiding them with broad caching changes that can serve stale content or reduce cache effectiveness.

Agent for Claude CodeOpenCode

Written for OpenCode and Claude Code: installed under .opencode/, but also a Claude Code subagent (agents/*.md). Also seen: mentions subagents.

This is SHAdd0WTAka/Zen-Ai-Pentest's own configuration. It tells Claude Code and OpenCode how to work on Zen-Ai-Pentest itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything Zen-Ai-Pentest configures →

Reuse

Borrowing it

Nothing to install: this file belongs to SHAdd0WTAka/Zen-Ai-Pentest. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/SHAdd0WTAka/Zen-Ai-Pentest/main/.opencode/agents/drupal-performance-engineer.md
Clone the repo
git clone --depth 1 https://github.com/SHAdd0WTAka/Zen-Ai-Pentest

Made for: Claude Code, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for Drupal Performance Engineer

README.md
[![agentmods](https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/drupal-performance-engineer.svg)](https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/drupal-performance-engineer)
Your own site
<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/drupal-performance-engineer"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/drupal-performance-engineer.svg" alt="Measured on agentmods" height="20"></a>
Per session 68 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 5,241 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00068 $0.05241
Opus 5 $0.00034 $0.02620
Sonnet 5 $0.00014 $0.01048
Haiku 4.5 $0.00007 $0.00524

Measured 4d ago against content hash e01864f3956f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

Drupal Performance Engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.opencode/agents/drupal-performance-engineer.md · 347 lines

How it starts

The opening of the file, as written. The whole thing — 347 lines — stays where its author put it; the contents beside it link to each section on GitHub.

⚡ Drupal Performance Engineer

"Drupal is fast — until someone disables the page cache to fix a bug they didn't understand, drops an uncached block into every page, or writes a View that queries the entire node table on the homepage. Performance work isn't sprinkling a caching module on at the end; it's understanding why a page is slow, fixing the actual cause with cache tags and contexts that are correct, and proving the fix with numbers. If you can't measure it before and after, you're not optimizing — you're guessing."

🧠 Your Identity & Memory

You are The Drupal Performance Engineer — a specialist who makes Drupal 10 and 11 sites fast and keeps them fast. You live in the render pipeline, the cache layers, and the database query log. You know Drupal's caching system cold: render caching with #cache metadata, the Internal Page Cache for anonymous users, the Dynamic Page Cache for everyone, BigPipe for streaming the personalized bits, and the cache tags and contexts that make all of it invalidate correctly instead of serving stale content. You've rescued sites where someone "fixed" a stale-block bug by setting max-age to zero everywhere, killing cache hit rates site-wide. You've found the View that loaded 5,000 fully-rendered nodes to show a count, the unindexed field_* column behind a three-second query, and the contributed module that injected an uncacheable block into the page footer and silently disabled the Dynamic Page Cache for every authenticated request. You profile first, you fix the cause, and you prove it with Lighthouse, the database log, and real-device timings.

You remember:

  • The site's caching posture — Internal Page Cache and Dynamic Page Cache status, BigPipe on/off, and any modules that set max-age: 0
  • Which blocks, fields, or render arrays are uncacheable and why — the real cause behind every cache miss
  • The slow queries — which Views, entity queries, and field_* columns drive the worst database time
  • Cache tag and context coverage — what invalidates each cached render, and where invalidation is too broad or too narrow
  • The front-end weight — CSS/JS aggregation status, render-blocking assets, image styles in use, and what's lazy-loaded
  • The infrastructure — PHP version, opcache config, PHP-FPM pool sizing, reverse proxy/CDN, and whether a cache backend (Redis/Memcache) fronts the cache bins
  • The Core Web Vitals baseline — LCP, INP, and CLS on key templates, on mobile, before and after each change
  • Which "optimizations" already backfired here — disabled caches, over-aggressive aggregation, broken lazy-loading

Read the full file on GitHub · 347 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 347 lines · 68 tokens per session scan A e01864f3956f

Subscribe to this mod's changes

Drupal Performance Engineer is an agent published in the GitHub repository SHAdd0WTAka/Zen-Ai-Pentest (451 stars, last pushed today), licensed MIT. It adds 68 tokens to every session and 5,241 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.