Borrowing it
Nothing to install: this file belongs to a9a4k/tour. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/a9a4k/tour/main/.agents/skills/webapp-perf-cross-check/SKILL.mdgit clone --depth 1 https://github.com/a9a4k/tourWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/a9a4k/tour/webapp-perf-cross-check)<a href="https://agentmods.dev/skills/a9a4k/tour/webapp-perf-cross-check"><img src="https://agentmods.dev/badge/skills/a9a4k/tour/webapp-perf-cross-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/a9a4k/tour/webapp-perf-cross-check"><img src="https://agentmods.dev/badge/skills/a9a4k/tour/webapp-perf-cross-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.01245 |
| Opus 5 | $0.00061 | $0.00622 |
| Sonnet 5 | $0.00024 | $0.00249 |
| Haiku 4.5 | $0.00012 | $0.00125 |
Grade A, and why
webapp-perf-cross-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Webapp perf cross-check
Prerequisites
The React-renders instrument requires agent-browser to be opened with React DevTools enabled:
agent-browser open <url> --enable react-devtools
Without this flag, react renders start fails with a non-obvious error about the DevTools hook not being installed. Chrome trace and MutationObserver work without it.
The trap
React DevTools' render profile reports a DOM column per component (e.g. 320/325). It counts fiber commits, not browser DOM mutations. A component can show "320 DOM updates" while the actual browser performed zero. React schedules a commit, the reconciler diffs the new tree against the old, finds nothing to update, but the profiler still ticks the counter.
Treat React DevTools render counts as a hypothesis, never as evidence of real cost. Confirm with browser-side signals before writing any patch.
Cross-check pattern
Run all three before deciding a cascade is real. agent-browser supports all three.
1. React renders (fiber commits — often inflated)
agent-browser react renders start
# ... do the action ...
agent-browser react renders stop --json
Note the Re-renders and DOM columns and the change reasons — they tell you which prop / state changed, which is the actual diagnostic value.
2. Chrome trace (real browser work)
agent-browser trace start
# ... do the action ...
agent-browser trace stop
# trace is saved under ~/.agent-browser/tmp/traces/trace-<ts>.json
python3 scripts/aggregate-trace.py <path-to-trace.json> "<label>"
scripts/aggregate-trace.py sums main-thread cost per event name and per EventDispatch:<type>, then prints the cross-check targets summary.
Targets per interaction:
EventDispatch:click/keydown< 50 ms → no long taskLayoutcount ≤ 2 per interaction (more = layout thrash)Paint< 16 ms → frame budget intact
3. MutationObserver (real DOM mutations)
agent-browser eval "
window.__mut = 0;
const o = new MutationObserver((muts) => { window.__mut += muts.length });
o.observe(document.body, {childList:true, subtree:true, attributes:true, characterData:true});
'observing'
"
# ... do the action ...
agent-browser eval "window.__mut"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 114 lines · 122 tokens per session scan A c8c0b3db2a29
webapp-perf-cross-check is a skill published in the GitHub repository a9a4k/tour (5 stars, last pushed 2mo ago), licensed MIT. It adds 122 tokens to every session and 1,245 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
react-tanstack-router
Use when implementing routing in a React app (NOT Next.js) with TanStack Router — file-based routes, loaders, search params.
react-19
Use when implementing React 19.2 patterns — use(), useOptimistic, useActionState, useEffectEvent, Activity component, React Compiler.
react-effects-audit
Use when auditing React or Next.js components for unnecessary or unsafe useEffect usage -- detects 9 anti-patterns from "You Might Not Need an Effect".
nextjs-16
Use when building Next.js 16 apps — Turbopack, App Router, Cache Components, proxy.ts, v15 migration. Not for stack scaffolding (nextjs-stack) or React SPA (react-expert).
nextjs-shadcn
Use when building UI components in Next.js App Router with shadcn/ui — forms, dialogs, tables, toasts, accessible components.
nextjs-zustand
Use when implementing global state, stores, persist, or hydration in Next.js 16 App Router Client Components with Zustand v5.