audit-performance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-performance (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Systematic approach to finding and fixing performance issues. Research-driven, data-backed.
Before optimizing, measure. Collect data from multiple sources.
If Sentry performance monitoring is enabled, fetch real production metrics:
CallMcpTool(server: "plugin-sentry-sentry", toolName: "search_events", arguments: {
"organizationSlug": "<ORG_SLUG>",
"projectSlug": "<PROJECT_SLUG>",
"regionUrl": "<REGION_URL>",
"naturalLanguageQuery": "slowest transactions by p95 duration in last 7 days",
"limit": 20
})CallMcpTool(server: "plugin-sentry-sentry", toolName: "search_events", arguments: {
"organizationSlug": "<ORG_SLUG>",
"projectSlug": "<PROJECT_SLUG>",
"regionUrl": "<REGION_URL>",
"naturalLanguageQuery": "web vitals LCP INP CLS performance scores in last 7 days",
"limit": 20
})Check for performance-related issues:
CallMcpTool(server: "plugin-sentry-sentry", toolName: "search_issues", arguments: {
"organizationSlug": "<ORG_SLUG>",
"projectSlugOrId": "<PROJECT_SLUG>",
"regionUrl": "<REGION_URL>",
"naturalLanguageQuery": "performance issues slow queries N+1 in last 30 days",
"limit": 20
})Fetch current performance targets:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_search", arguments: {
"query": "web vitals thresholds good score <current year>",
"limit": 3,
"sources": [{ "type": "web" }]
})| Metric | Good | Needs Work | Poor |
|---|---|---|---|
| LCP (Largest Contentful Paint) | <2.5s | 2.5-4s | >4s |
| INP (Interaction to Next Paint) | <200ms | 200-500ms | >500ms |
| CLS (Cumulative Layout Shift) | <0.1 | 0.1-0.25 | >0.25 |
npm run build -- --analyze # framework-specific
npx source-map-explorer 'dist/**/*.js'Checklist:
lazy() / dynamic())loading="lazy" on below-fold imagessrcSet for different screen sizesmemo() on expensive components that receive stable propsuseMemo() for expensive computationsuseCallback() for callbacks passed to memoized childrentransform/opacity (GPU-accelerated)@import chains (bundled instead)<link rel="preload">)N+1 Detection:
// BAD: N+1
const users = await User.findAll();
for (const user of users) {
const orders = await Order.findByUserId(user.id);
}
// GOOD: eager loading
const users = await User.findAll({ include: [Order] });Checklist:
SELECT *)Index verification:
EXPLAIN ANALYZE SELECT * FROM orders WHERE user_id = '123';Cache-Control, ETag)| Layer | Tool | TTL | Use For |
|---|---|---|---|
| Browser | Cache-Control headers | Varies | Static assets, API responses |
| CDN | Vercel/CloudFront/Cloudflare | 1h-1d | Static pages, images |
| API | Redis/Memcached | 5m-1h | Expensive queries, computed data |
| ORM | Query cache | 1m-5m | Repeated identical queries |
<link rel="preconnect">)For specific performance bottlenecks, research current solutions:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_search", arguments: {
"query": "<framework> <specific bottleneck> performance optimization <current year>",
"limit": 5,
"sources": [{ "type": "web" }]
})Then deep-read the best result:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_scrape", arguments: {
"url": "<best-result-url>",
"formats": ["markdown"],
"onlyMainContent": true
})Check official framework docs via Context7:
CallMcpTool(server: "context7", toolName: "resolve-library-id", arguments: {
"libraryName": "<framework>",
"query": "performance optimization"
})| Issue | Solution | Impact |
|---|---|---|
| Large bundle | Code split routes, lazy load heavy libs | High |
| Slow images | WebP + lazy load + responsive | High |
| No caching | Add Cache-Control headers | High |
| N+1 queries | Eager load / batch | High |
| Missing indexes | Add database indexes | High |
| Unoptimized fonts | Subset + preload + font-display:swap | Medium |
| No compression | Enable gzip/brotli | Medium |
| Expensive re-renders | React.memo + useMemo | Medium |
| Layout shifts | Set explicit width/height on images/embeds | Medium |
## Performance Audit: [Project Name]
### Production Metrics (from Sentry)
- LCP: [value] — [good/needs work/poor]
- INP: [value] — [good/needs work/poor]
- CLS: [value] — [good/needs work/poor]
- Slowest transactions: [list with p95 times]
### Critical Issues (fix immediately)
| # | Area | Issue | Impact | Fix |
|---|------|-------|--------|-----|
| 1 | DB | N+1 on /users endpoint | p95 = 2.3s | Eager load orders relation |
### Optimizations (prioritized)
| # | Area | Issue | Impact | Effort | Fix |
|---|------|-------|--------|--------|-----|
| 1 | FE | Bundle 450KB gzipped | High | Low | Code split routes |
### Already Optimized
- [list of performance areas that are well-implemented]
### Monitoring Recommendations
- [what to add to track performance over time]
### Research Sources
- [URL] — [what optimization pattern it provided]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.