Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-audit-perfgit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-perf)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-perf"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-audit-perf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-perf"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-audit-perf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.00791 |
| Opus 5 | $0.00061 | $0.00396 |
| Sonnet 5 | $0.00024 | $0.00158 |
| Haiku 4.5 | $0.00012 | $0.00079 |
Grade A, and why
x-audit-perf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
x-audit-perf · 性能巡检
x-audit-perf 是独立巡检 skill，不在 x-dev → x-verify → x-qa-gate 主流程内。它由用户手动触发或大里程碑后调用，做全项目视角的性能审查。
为什么独立
性能问题通常需要全局视角才有意义——单个任务级别揪 N² 是过度工程，得看整个调用链；缓存失效要看跨服务流。塞进每个任务的 gate 是噪音，所以剥离出来。
流程
- 用户触发（手动调用 / 大里程碑）。
- dispatch 一个子 agent，prompt 包含本 SKILL.md 的检查清单 + 项目代码。
- 子 agent 输出 audit-perf 报告。
- 写到
reports/audit/audit-perf-YYYYMMDD-HHmmss.md。 - 不自动触发 x-fix——由用户决定哪些问题进入 backlog。
子 agent dispatch
Agent({
description: "Performance audit",
subagent_type: "general-purpose",
prompt: <本 SKILL.md 的"检查清单"段 + 项目代码 + 输出格式>
})
报告顶部必须填写 Completed by model。
检查清单
1. 算法复杂度
- 嵌套循环：O(n²) 以上是否必要？能否用 hash / index 降到 O(n)?
- 在循环内做 I/O / 重复扫描数据？
- 排序 / 查找算法选择是否合理？
2. 数据结构使用
- 用 list 做频繁查找（应该用 set / dict）？
- 大对象拷贝（应传引用 / 用 slice）？
- 频繁字符串拼接（应用 builder / join）？
3. I/O 模式
- 同步阻塞 I/O 在异步上下文中？
- 数据库 N+1（在循环里查数据库）？
- 文件 / 网络请求未批量化？
4. 缓存与状态
- 重复计算未缓存（纯函数 expensive call）？
- 缓存失效策略缺失或过激进？
- 内存泄漏（持有不必要的引用）？
5. 并发与并行
- 不必要的 await / lock 串行化？
- 临界区过大？
- 能并行的串行执行了？
输出
写入 reports/audit/audit-perf-YYYYMMDD-HHmmss.md，模板见 templates/audit-perf-template.md。
不在范围
- 单任务级别的 perf 审查（应在 x-qa-gate R2 boundary 里捎带 P1 即可）
- 微优化（编译器能搞定的事）
- 硬件相关（CPU 缓存、SIMD 等，不在 AI 评审范围）
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 73 lines · 122 tokens per session scan A dc70b069fc4f
x-audit-perf is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed yesterday), licensed MIT. It adds 122 tokens to every session and 791 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codebase-audit
A read-only method for auditing an entire codebase across contracts, data integrity, errors, security, architecture, technical debt, configuration, and caching. It produces prioritized findings and a repair roadmap.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
project-health-auditor
Comprehensive codebase health analysis. Use when reviewing code quality, identifying technical debt, checking dependencies, or assessing project structure.
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…
explain
Guided code tour of a file or subsystem this session touched — entry point, the load-bearing pieces, the edges, and what connects to it.
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke holes in this", "what am…