act-sdk-js: Skill for Codex

.agents/skills/gstack-benchmark/SKILL.md

benchmark is a skill for Codex from act-sdk/act-sdk-js. It costs 88 tokens per session (4,972 once invoked), scanned C, a copy of benchmark, MIT.

A manually triggered workflow for detecting website performance regressions, meaning cases where a change makes a site slower or heavier.

In plain words
What is it for?
Use it after typing /benchmark to establish or compare performance baselines and track changes over time. It is intended for page-speed and frontend performance checks.
Why use it?
It compares page-load times, Core Web Vitals, and resource sizes before and after pull requests, helping identify performance declines.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: names the AskUserQuestion tool; installed under .agents/ (shared by several agents); mentions Codex.

This is act-sdk/act-sdk-js's own configuration. It tells Codex how to work on act-sdk-js itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything act-sdk-js configures →

Reuse

Borrowing it

Nothing to install: this file belongs to act-sdk/act-sdk-js. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/act-sdk/act-sdk-js/main/.agents/skills/gstack-benchmark/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/act-sdk/act-sdk-js

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for benchmark

README.md
[![agentmods](https://agentmods.dev/badge/skills/act-sdk/act-sdk-js/gstack-benchmark/github.svg)](https://agentmods.dev/skills/act-sdk/act-sdk-js/gstack-benchmark)
Your own site
<a href="https://agentmods.dev/skills/act-sdk/act-sdk-js/gstack-benchmark"><img src="https://agentmods.dev/badge/skills/act-sdk/act-sdk-js/gstack-benchmark/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for benchmark

Your own site · 80×15
<a href="https://agentmods.dev/skills/act-sdk/act-sdk-js/gstack-benchmark"><img src="https://agentmods.dev/badge/skills/act-sdk/act-sdk-js/gstack-benchmark.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 88 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,972 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 94% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00088 $0.04972
Opus 5.5 $0.00035 $0.01989
Sonnet 5.5 $0.00018 $0.00994
Haiku 4.5 $0.00009 $0.00497

Measured 1mo ago against content hash 523fcfa2dcdd, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

benchmark scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

3. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash`

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

3. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash`
Origin

This is a copy

94% identical to benchmark — 47 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.agents/skills/gstack-benchmark/SKILL.md · 438 lines

How it starts

The opening of the file, as written. The whole thing — 438 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Preamble (run first)

_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
GSTACK_ROOT="$HOME/.codex/skills/gstack"
[ -n "$_ROOT" ] && [ -d "$_ROOT/.agents/skills/gstack" ] && GSTACK_ROOT="$_ROOT/.agents/skills/gstack"
GSTACK_BIN="$GSTACK_ROOT/bin"
GSTACK_BROWSE="$GSTACK_ROOT/browse/dist"
_UPD=$($GSTACK_BIN/gstack-update-check 2>/dev/null || .agents/skills/gstack/bin/gstack-update-check 2>/dev/null || true)
[ -n "$_UPD" ] && echo "$_UPD" || true
mkdir -p ~/.gstack/sessions
touch ~/.gstack/sessions/"$PPID"
_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true
_CONTRIB=$($GSTACK_BIN/gstack-config get gstack_contributor 2>/dev/null || true)
_PROACTIVE=$($GSTACK_BIN/gstack-config get proactive 2>/dev/null || echo "true")
_BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
echo "BRANCH: $_BRANCH"
echo "PROACTIVE: $_PROACTIVE"
source <($GSTACK_BIN/gstack-repo-mode 2>/dev/null) || true
REPO_MODE=${REPO_MODE:-unknown}
echo "REPO_MODE: $REPO_MODE"
_LAKE_SEEN=$([ -f ~/.gstack/.completeness-intro-seen ] && echo "yes" || echo "no")
echo "LAKE_INTRO: $_LAKE_SEEN"
_TEL=$($GSTACK_BIN/gstack-config get telemetry 2>/dev/null || true)
_TEL_PROMPTED=$([ -f ~/.gstack/.telemetry-prompted ] && echo "yes" || echo "no")
_TEL_START=$(date +%s)
_SESSION_ID="$$-$(date +%s)"
echo "TELEMETRY: ${_TEL:-off}"
echo "TEL_PROMPTED: $_TEL_PROMPTED"
mkdir -p ~/.gstack/analytics
echo '{"skill":"benchmark","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true
# zsh-compatible: use find instead of glob to avoid NOMATCH error
for _PF in $(find ~/.gstack/analytics -maxdepth 1 -name '.pending-*' 2>/dev/null); do [ -f "$_PF" ] && $GSTACK_BIN/gstack-telemetry-log --event-type skill_run --skill _pending_finalize --outcome unknown --session-id "$_SESSION_ID" 2>/dev/null || true; break; done

If PROACTIVE is "false", do not proactively suggest gstack skills — only invoke them when the user explicitly asks. The user opted out of proactive suggestions.

If output shows UPGRADE_AVAILABLE <old> <new>: read $GSTACK_ROOT/gstack-upgrade/SKILL.md and follow the "Inline upgrade flow" (auto-upgrade if configured, otherwise AskUserQuestion with 4 options, write snooze state if declined). If JUST_UPGRADED <from> <to>: tell user "Running gstack v{to} (just updated!)" and continue.

If LAKE_INTRO is no: Before continuing, introduce the Completeness Principle. Tell the user: "gstack follows the Boil the Lake principle — always do the complete thing when AI makes the marginal cost near-zero. Read more: https://garryslist.org/posts/boil-the-ocean" Then offer to open the essay in their default browser:

open https://garryslist.org/posts/boil-the-ocean
touch ~/.gstack/.completeness-intro-seen

Only run open if the user says yes. Always run touch to mark as seen. This only happens once.

If TEL_PROMPTED is no AND LAKE_INTRO is yes: After the lake intro is handled, ask the user about telemetry. Use AskUserQuestion:

Help gstack get better! Community mode shares usage data (which skills you use, how long they take, crash info) with a stable device ID so we can track trends and fix bugs faster. No code, file paths, or repo names are ever sent. Change anytime with gstack-config set telemetry off.

Options:

  • A) Help gstack get better! (recommended)
  • B) No thanks

If A: run $GSTACK_BIN/gstack-config set telemetry community

If B: ask a follow-up AskUserQuestion:

How about anonymous mode? We just learn that someone used gstack — no unique ID, no way to connect sessions. Just a counter that helps us know if anyone's out there.

Options:

  • A) Sure, anonymous is fine
  • B) No thanks, fully off

Read the full file on GitHub · 438 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 438 lines · 88 tokens per session scan C 523fcfa2dcdd

Subscribe to this mod's changes

benchmark is a skill published in the GitHub repository act-sdk/act-sdk-js (3 stars, last pushed 4mo ago), licensed MIT. It adds 88 tokens to every session and 4,972 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). It is 94% identical to benchmark, differing in 47 lines, and is treated as a copy.

Related

Other skills, from other repositories

memora

Use when working with persistent memory across sessions, storing/retrieving knowledge, managing TODOs/issues, or when context from previous sessions would be helpful.

agentic-box/memora · 33 tokens

darto-add-route

Add or modify HTTP endpoints in a Darto (Dart) web app — verbs, path/query params, request-body reading, route groups, and Context response helpers. Use when building or changing API routes in a project that depends on the darto package (import 'package:darto/darto.dart'). Not for Express/Node — Darto handlers take a…

evandersondev/darto · 90 tokens

darto-validate-request

Validate the body, query, params, or headers of a Darto (Dart) request using the zValidator middleware and zard (Zod-style) schemas. Use when adding input validation to a Darto endpoint, defining a z.map/z.string/z.int schema, reading validated data with c.req.valid, or customizing the validation error response.…

evandersondev/darto · 83 tokens

darto-write-middleware

Write and register middleware in a Darto (Dart) app — the Middleware factory pattern, global/path-scoped/route-level registration, short-circuiting, per-request state, and global error/404 handlers. Use when adding cross-cutting behavior (auth, logging, CORS, timing) or configuring app.onError / app.notFound in a…

evandersondev/darto · 86 tokens

darto-scaffold-project

Scaffold, run, and build a Darto (Dart) web project using the dartocli — create a new project with a NestJS-style module structure, run a hot-reload dev server, compile a production binary, and generate a typed API client. Use when starting a new Darto app, setting up the project layout, or configuring dev/build…

evandersondev/darto · 81 tokens

backend

Backend development with Node.js, Express, NestJS, and server patterns.

miles990/claude-software-skills · 16 tokens