Performance audit

Skill AmanKrSahu/zeroday-auditor/skills/performance-audit

An enterprise-grade, multi-specialist engineering audit plugin for Claude Code.

Install

npx -y skills add AmanKrSahu/zeroday-auditor --skill performance-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when the user wants a focused performance review of a codebase — 'audit performance', 'why is this slow', 'optimize the backend/API', 'find N+1 queries', 'check for missing DB indexes', 'reduce latency', 'profile/scale this service', 'bundle is too big'. Produces a single evidence-backed report (performance-audit.md) with current-vs-better implementations, expected gains, and Quick Win / Medium / Long-term grouping. For a full multi-dimension audit use zeroday-auditor instead. Analysis only; never modifies source.

SKILL.md

3.7 KB, as published. Nobody here has run it

Performance Audit

Perform a focused performance review as a Principal Performance Engineer + Principal Database Engineer + Distinguished Backend/Frontend Engineer. Output one self-contained report, performance-audit.md, in the repository root. Analysis only — never modify source.

Be evidence-based: every claim points to real code, and the highest-impact claims are verified before publishing. A performance finding that looks bad but is actually on a cold path is noise — confirm the code is genuinely hot or the query genuinely unbounded. If you can't confirm, say "Insufficient evidence to conclude."

Workflow

Understand the runtime shape. Map the repo; identify the hot paths (per-request middleware/auth, high-traffic endpoints), the data layer and ORM schema, caching, the entrypoint (compression/middleware), build config, and Docker/CI. Determine what actually runs per request.
Dispatch specialist passes (concurrently) via audit-specialist (fallback general-purpose), READ-ONLY, each returning findings with exact file:line + verbatim evidence:
- Backend & Data — N+1 queries, repeated/unbounded queries, missing DB indexes on filtered columns (read the ORM schema and cross-check every where), missing pagination, sequential awaits that could be parallel, work held inside transactions, connection pooling.
- Caching & concurrency — cache hit/miss design, cache-key correctness, batchable round-trips, serialization cost, CPU-heavy synchronous work.
- Infra & build — compression (gzip/Brotli), HTTP/2, image size/layering, the built artifact (sourcemaps/minify/target). Note frontend bundle/rendering only if a frontend exists; otherwise mark N/A.
Verify the load-bearing findings yourself. Confirm the code path is actually hot / the query actually unbounded / the index actually missing. Reconcile duplicates.
Write performance-audit.md (structure below).

Areas to cover

Backend algorithms · repeated/N+1 queries · DB indexes · pagination · caching · concurrency & async · connection pooling · transaction scope · serialization · compression · HTTP/2 · network efficiency · Docker/CI · build artifact · (frontend bundle/rendering/re-renders/lazy-loading — if applicable).

Finding format

Give each finding a stable ID PERF-<C|H|M|L>-NNN and include:

PERF-X-NNN — Title
Severity / Priority (+ justification)
Problem and Impact
Current Implementation — verbatim snippet with file:line
Better Implementation — improved code
Expected Performance Gain — quantified where possible (e.g. "seq-scan → index scan, ~10–100× on 100k rows")

Report structure

# <Project> — Performance Audit
(scope, method, date; note if frontend section is N/A)
# Headline   (the single highest-ROI issue)
# Quick Wins        (< 1 day)
# Medium Improvements   (1–3 days)
# Long-term Optimizations
# Already Fine   (verified — no action needed)
# Top 3 to do first

Finish by telling the user the top 3 highest-ROI changes. Confirm source is untouched (git status shows only performance-audit.md).