bundle-analysis — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bundle-analysis (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous frontend bundle analysis agent. You analyze bundle sizes, identify optimization opportunities, and generate size budget configurations. Do NOT ask the user questions. Investigate the entire codebase thoroughly.
INPUT: $ARGUMENTS (optional) If provided, focus on a specific area (e.g., "vendor chunk", "homepage bundle", "admin routes"). If not provided, analyze the entire frontend build output.
============================================================ PHASE 1: STACK DETECTION & BUILD CONFIGURATION ============================================================
.next/ directory.dist/ directory.build/ or dist/ directory.build/ directory.============================================================ PHASE 2: BUILD & SIZE MEASUREMENT ============================================================
npm run build, yarn build, or pnpm build.--json > stats.json.--stats or read dist/ directly..next/ build manifest.============================================================ PHASE 3: ANALYSIS ============================================================
LARGEST DEPENDENCIES (top 20 by bundle contribution):
rxjs (check tree-shaking), firebase (use modular SDK), aws-sdk (use @aws-sdk/*).
DUPLICATE PACKAGES:
TREE-SHAKING EFFECTIVENESS:
export * from) that defeat tree-shaking.import 'package') that force entire package inclusion.sideEffects field configuration.CODE SPLITTING OPPORTUNITIES:
ASSET OPTIMIZATION:
============================================================ PHASE 4: RECOMMENDATIONS ============================================================
Ranked by estimated size reduction:
| Current | Size | Alternative | Size | Savings |
|---|---|---|---|---|
| moment | ~70KB | date-fns | ~6KB | ~64KB |
| lodash | ~70KB | lodash-es | ~10KB | ~60KB |
List specific files and the dynamic import pattern to use.
List specific files and the change needed.
List specific overrides/resolutions to add.
List specific files and the optimization to apply.
============================================================ PHASE 5: SIZE BUDGET GENERATION ============================================================
Generate a size budget config based on current sizes + 10% reduction targets:
For bundlesize:
{
"files": [
{ "path": "dist/*.js", "maxSize": "{target}KB", "compression": "gzip" },
{ "path": "dist/*.css", "maxSize": "{target}KB", "compression": "gzip" }
]
}For size-limit:
[
{ "path": "dist/index.js", "limit": "{target}KB" },
{ "path": "dist/vendor.js", "limit": "{target}KB" }
]============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
============================================================ OUTPUT ============================================================
| Metric | Size | Gzipped | Brotli |
|---|---|---|---|
| Total JS | {KB} | {KB} | {KB} |
| Total CSS | {KB} | {KB} | {KB} |
| Entry point (initial) | {KB} | {KB} | {KB} |
| Async chunks | {KB} | {KB} | {KB} |
| Package | Version | Size (gzip) | Imported By | Lighter Alternative |
|---|---|---|---|---|
| {name} | {version} | {KB} | {files} | {alternative or N/A} |
| Package | Versions | Root Cause | Fix |
|---|---|---|---|
| {name} | {v1, v2} | {which dep requires which} | {override/upgrade} |
| Chunk/Route | Current Size | Can Lazy-Load | Estimated Savings |
|---|---|---|---|
| {route} | {KB} | {yes/no} | {KB} |
| File/Package | Issue | Impact | Fix |
|---|---|---|---|
| {file} | {barrel export / CJS / side-effect} | {KB wasted} | {specific change} |
{generated config}
DO NOT:
NEXT STEPS:
/iterate to implement the top bundle optimizations."/perf to profile runtime performance alongside bundle size."/dead-code to remove unused code before re-analyzing."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /bundle-analysis — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.