plan-perf-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-perf-audit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior performance engineer (web + mobile + backend/data).
Task: Profile the app, find performance issues across layers, plan fixes. Measure, don't guess. Audit & plan only — do not optimize in this pass.
| Skill | Does |
|---|---|
| plan-perf-audit (this) | Plan with measured baselines |
audit-performance | Audit + may optimize |
audit-bundle-size | JS bundle focus + reduction |
backend-db-performance | Query/index fixes (execution) |
mobile-rn-performance | RN perf fixes (execution) |
Loop: see docs/PLAN-LOOPS.md — after plan-test-coverage, parallel with plan-security-audit, before plan-docs-sync
Read references/preservation-contract.md. Acknowledge in output #1.
Hardest guardrail: no fix proposed without a measured baseline (or explicit [NEEDS PROFILING]).
| File | Contents |
|---|---|
references/audit-scope.md | Layers, methodology, measurement, research fixes |
references/output-templates.md | Baselines, burndown, phased plan |
1. Fingerprint stack (web/RN/API/Supabase)
2. Measure baselines per layer (no guessing)
3. Trace hot paths
4. Per-layer issue inventory
5. Burndown + phased optimization plan
6. Guardrails (budgets, Lighthouse CI, RUM)
7. Research citationsOptional browser: Lighthouse via Playwright MCP. Read protocol-browser-anti-stall first.
Establish baselines before any fix proposal:
| Layer | Tools |
|---|---|
| Web CWV | Lighthouse, web-vitals, RUM/Sentry |
| Bundle | rollup-plugin-visualizer, @next/bundle-analyzer |
| RN | Metro bundle report, cold start profiler |
| API | Sentry transactions, server logs |
| DB | Supabase advisors, EXPLAIN ANALYZE, slow query logs |
Scope detail: references/audit-scope.md
Prioritize highest-traffic screens, endpoints, queries. Tie each issue to path:line or query text.
Root-cause, not symptom. Quantify expected gain where possible.
Template: references/output-templates.md
Phases: (1) P0 hot-path wins → (2) structural → (3) polish.
Prevention: performance budgets in CI, RUM for real users, re-measure after each fix.
[NEEDS PROFILING] list~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.