Borrowing it
Nothing to install: this file belongs to Piyush8296/claude-workspace. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Piyush8296/claude-workspace/main/.claude/commands/perf-audit.mdgit clone --depth 1 https://github.com/Piyush8296/claude-workspaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/piyush8296/claude-workspace/perf-audit)<a href="https://agentmods.dev/commands/piyush8296/claude-workspace/perf-audit"><img src="https://agentmods.dev/badge/commands/piyush8296/claude-workspace/perf-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/piyush8296/claude-workspace/perf-audit"><img src="https://agentmods.dev/badge/commands/piyush8296/claude-workspace/perf-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.01481 |
| Opus 5 | $0.00008 | $0.00740 |
| Sonnet 5 | $0.00003 | $0.00296 |
| Haiku 4.5 | $0.00002 | $0.00148 |
Grade A, and why
perf-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Performance Audit
Audit performance: $ARGUMENTS
Instructions
1. Bundle Analysis
# Build and measure output
pnpm build 2>&1 | tail -30
# Measure build output size
find dist/ .next/ build/ -name '*.js' -type f 2>/dev/null | \
xargs du -sh 2>/dev/null | sort -rh | head -15
# Find the largest JS chunks
find dist/ .next/static/ build/static/ -name '*.js' -type f 2>/dev/null | \
while read f; do echo "$(du -k \"$f\" | cut -f1)KB $f"; done | \
sort -rn | head -10
Flag any chunk > 200KB (gzipped) as a concern.
2. Dependency Weight
# Top 20 heaviest node_modules
du -sh node_modules/* 2>/dev/null | sort -rh | head -20
# Check for duplicate packages
npm ls --all 2>/dev/null | grep -E 'deduped|UNMET' | head -10
# Find packages that could be lighter
grep -E '"(moment|lodash|date-fns|axios)"' package.json
Common replacements:
| Heavy | Lighter Alternative | Savings |
|---|---|---|
| moment.js (~300KB) | date-fns (~20KB tree-shaken) or dayjs (~2KB) | 95%+ |
| lodash (~70KB) | lodash-es (tree-shakeable) or native | 80%+ |
| axios (~14KB) | fetch (built-in) | 100% |
| classnames (~1KB) | clsx (~0.5KB) | 50% |
3. Tree-Shaking Analysis
# Find namespace imports that prevent tree-shaking
grep -rn "import \* as" src/ --include='*.ts' --include='*.tsx' | \
grep -v 'React\|next' | head -10
# Find barrel file re-exports
find src/ -name 'index.ts' -exec grep -l 'export \*' {} \; | head -10
# Check for side-effect imports
grep -rn "^import '" src/ --include='*.ts' --include='*.tsx' | head -10
4. Code Splitting
# Check for dynamic imports (good)
grep -rn 'dynamic(\|lazy(' src/ --include='*.tsx' | wc -l
# Check total page/route count vs dynamic imports
find src/app src/pages -name 'page.tsx' -o -name '*.page.tsx' 2>/dev/null | wc -l
# Find heavy components that should be code-split
find src/components -name '*.tsx' -size +10k | while read f; do
echo "$(wc -l < \"$f\") lines $(du -k \"$f\" | cut -f1)KB $f"
done | sort -rn | head -10
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 152 lines · 16 tokens per session scan A 9b8159630a88
perf-audit is a command published in the GitHub repository Piyush8296/claude-workspace (2 stars, last pushed 4mo ago), licensed MIT. It adds 16 tokens to every session and 1,481 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
perf-audit
Performance audit for web applications.
scaffold
Scaffold project components from templates.
component-scaffold
You are a React component architecture expert specializing in scaffolding production-ready, accessible, and performant components. Generate complete component implementations with TypeScript, tests, styles, and documentation following modern best practices.
style-guide
Generate comprehensive design system documentation including colors, typography, spacing, components, and usage guidelines. Outputs production-ready Tailwind/CSS configuration.
xss-scan
You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection points, unsafe DOM manipulation, and improper sanitization.
design-qa
Agent-driven design QA — walk the running app, judge design/UX, and drop a Comment-Mode comment on every issue (visible to the human as pins). Then read the session back and fix everything in bulk. Optional focus argument steers the pass.