Borrowing it
Nothing to install: this file belongs to erikdarlingdata/PerformanceStudio. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/erikdarlingdata/PerformanceStudio/main/.claude/skills/maintenance/SKILL.mdgit clone --depth 1 https://github.com/erikdarlingdata/PerformanceStudioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/erikdarlingdata/performancestudio/maintenance)<a href="https://agentmods.dev/skills/erikdarlingdata/performancestudio/maintenance"><img src="https://agentmods.dev/badge/skills/erikdarlingdata/performancestudio/maintenance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/erikdarlingdata/performancestudio/maintenance"><img src="https://agentmods.dev/badge/skills/erikdarlingdata/performancestudio/maintenance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 47 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.02142 |
| Opus 5.5 | $0.00012 | $0.00857 |
| Sonnet 5.5 | $0.00006 | $0.00428 |
| Haiku 4.5 | $0.00003 | $0.00214 |
Grade A, and why
maintenance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to maintenance — 6 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Routine Maintenance Pass
A repeatable every-1-3-months health check for the .NET desktop + SQL-monitoring repos
(PerformanceMonitor = WPF, PerformanceStudio = Avalonia; same dependency/build/release shape).
$ARGUMENTS optionally scopes it (deps, build, or all — default all).
Work top to bottom. Do read-only scans first and report findings; make fixes on a feature
branch/worktree (branch protection: never commit to dev/main), build + test, then PR to dev.
Low-risk patch/minor bumps can go in one PR; majors and anything release-critical get their own.
A. Dependencies & Security
Scope — scan every project, not just the solution. A repo's
.slnmay not list every project. PerformanceStudio'sPlanViewer.slnomitsserver/PlanShare.csprojand the SSMS VSIX (PlanViewer.Ssms,PlanViewer.Ssms.Installer), so thedotnet list <Solution>.sln …scans and the solution build all silently skip them. Run the checks against those projects too. The net472 VSIX is old-style, sodotnet listis unreliable on it — read its<PackageReference>s by hand (itsMicrosoft.VSSDK.BuildToolsis intentionally held on the 17.x line; 18.x is un-restorable from nuget.org and targets VS 18, not VS 2022). Where the.slncovers all projects, the solution is enough.
- Outdated packages.
dotnet list <Solution>.sln package --outdated- Take low-risk patch/minor bumps (Microsoft.Extensions.*, Test.Sdk, etc.).
- Majors get their own effort — especially the update framework (Velopack: bump the library AND the
vpkCLI pin in the release workflow —.github/workflows/release.ymlfor PerformanceStudio — together; validate the in-app + Setup.exe update path) and anything release-critical. - Engine-wrapped bindings (e.g. DuckDB.NET) trail the native engine — bump when the binding catches up, and validate behavior (for DuckDB run
tools/CompactionReprore: the parquet-COPY memory-limit floor before changing the version). - After version edits, if the repo uses lock files (
packages.lock.json— PerformanceMonitor does; PerformanceStudio does not), regenerate them:dotnet restore <Solution>.sln --force-evaluate(CI restores--locked-mode).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed 553711312303
- 1mo ago First seen · 75 lines · 31 tokens per session scan A b9f08f042ec1
maintenance is a skill published in the GitHub repository erikdarlingdata/PerformanceStudio (245 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 2,142 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to maintenance, differing in 6 lines, and is treated as a copy.
Other skills, from other repositories
mapsui
Use when embedding interactive 2D maps in .NET desktop (WPF/WinUI/WinForms) or mobile (MAUI/Avalonia/Blazor) apps with Mapsui 5.1.0 (net8.0/net9.0) — Mapsui.Wpf/Mapsui.Maui packages, Map and Layers, OpenStreetMap.CreateTileLayer, Shapefile/GeoJSON via Mapsui.Nts, SphericalMercator.FromLonLat, or fixing a blank…
git-commit
Generate well-formatted git commit messages following conventional commit standards.
doc-coauthoring
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers.…
memory-management
Guide the agent to recall, remember, and route durable learning into Memory, Skills, Scheduled Tasks, or Tape.
grpc
Build or review gRPC services and clients in .NET. USE FOR: ASP.NET Core gRPC, protobuf contracts, unary or streaming RPC, gRPC client factory, interceptors, deadlines, cancellation, channel reuse, backend service integration. DO NOT USE FOR: broad browser-facing APIs without gRPC-Web tradeoff review, SignalR realtime…
address-review
Read PR review comments from GitHub, evaluate, address, and reply.