Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arcasilesgroup/ai-engineering --skill perf-auditgit clone --depth 1 https://github.com/arcasilesgroup/ai-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arcasilesgroup/ai-engineering/perf-audit)<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/perf-audit"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/perf-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/perf-audit"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/perf-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01784 |
| Opus 5.5 | $0.00027 | $0.00714 |
| Sonnet 5.5 | $0.00014 | $0.00357 |
| Haiku 4.5 | $0.00007 | $0.00178 |
Grade A, and why
perf-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Performance audit
Find work the system does that it does not need to do, where the cost is user-visible. Micro-optimizations that save a microsecond are not findings; 120KB of JavaScript shipped to render static text is, and so is an N+1 query that turns one page load into 200 round trips.
Read .claude/review/CONVENTIONS.md first — stack detection, scope,
false-positive gate, report format. The installed-version rule matters
especially here: caching semantics, lazy-loading defaults, and compiler behavior
change between versions, and a stale mental model produces confident, wrong
findings. Confirm the installed version's default is not already doing what you
are about to recommend.
1. Find the biggest cost centre first
Do not run a fixed checklist top to bottom. Establish what kind of system this is and go where the cost actually lives:
| System | Usually dominated by |
|---|---|
| Client-heavy web app | shipped bytes, hydration, render cost |
| Server-rendered app | data fetching, cache correctness, time to first byte |
| API / service | database access patterns, serialization, connection handling |
| Batch / data pipeline | I/O per record, memory footprint, algorithmic complexity |
| CLI / desktop | startup time, blocking I/O on the main path |
Order the work by expected impact for that shape, and say in the report which you assessed and why.
2. Universal checks
These apply regardless of stack, in rough order of how often they matter.
1. Data access — the most common real finding in anything with a database
- N+1 patterns — a query inside a loop over results of another query. Look for lazy relation access inside an iteration.
- Waterfalls — sequential awaits with no data dependency between them. They should run concurrently.
- Over-fetching — selecting every column to use two, loading a whole collection to count it, fetching a relation nobody reads.
- Missing indexes on columns used in filters, joins, and sorts. Check the schema and migrations against the queries the change introduces.
- Unbounded result sets — no limit, no pagination, "there will never be many rows" as an unstated assumption.
- The same data fetched several times in one request.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 164 lines · 68 tokens per session scan A e36b272a7646
perf-audit is a skill published in the GitHub repository arcasilesgroup/ai-engineering (61 stars, last pushed 2d ago), licensed Apache-2.0. It adds 68 tokens to every session and 1,784 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.
Other skills, from other repositories
spk-admin-setup-doctor
Install, verify, and repair Spec Kitty commands, skills, agent paths, runtime prerequisites, and common setup failures.
022-root-cause-analysis
Use when a framed problem needs root-cause investigation rather than a symptom-level fix, applying Five Whys, Fishbone (Ishikawa), Current Reality Tree, and constraint identification. This should trigger when an issue's Root Cause Analysis point of view needs evaluation, or when a maintainer directly asks to find the…
126-java-exception-handling
Use when you need to apply Java exception handling best practices — including using specific exception types, managing resources with try-with-resources, securing exception messages, preserving error context via exception chaining, validating inputs early with fail-fast principles, handling thread interruption…
extracting-code-structure
Use when listing all methods, functions, or classes in a file, exploring unfamiliar code, getting API overviews, or deciding what to read selectively without loading entire files.
skill-performance
AL performance optimization patterns for Business Central. Use when optimizing queries with SetLoadFields, working with FlowFields and CalcFields, profiling codeunits, or resolving performance issues.
performance-optimization
Spring Boot 4 / JVM performance work — measure first, then fix. Profiling (async-profiler, JFR, JMH), Micrometer, common Spring antipatterns (N+1, unbounded lists, HikariCP sizing, virtual-thread pinning), caching, GC, and SLO-driven work. Used by /plan for risk callouts and by /review to flag perf regressions.