Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Performance Optimization Skill Security Audit

What the author says it does (original text)

Optimizes application performance across frontend, backend, queries, and databases. Use when performance requirements exist, when you suspect performance regressions, when Core Web Vitals or load times need improvement, when N+1 query patterns need fixing, or when profiling reveals bottlenecks.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

CI examples execute unpinned packages through npx

Source references: 1
What we found

The Skill recommends `npx bundlesize` and `npx lhci` without pinning package versions, verifying their source, or requiring lockfile-controlled project dependencies. If a package is absent locally, npx may download and immediately execute it from a package registry.

Why this matters

A substituted, compromised, or unexpectedly changed package could run with developer or CI permissions, potentially accessing source code, environment variables, and CI credentials or altering build results.

The source recommends running two unversioned npx packages in CI and does not require a locked local dependency near those commands. When a local package is absent, npx may download and execute registry code, creating supply-chain risk and possible exposure of the CI environment. This supports a plausible risk, not a claim that malicious code was executed.

SKILL.md:432In the instructionsOpen original file
**Enforce in CI:**```bash# Bundle size checknpx bundlesize --config bundlesize.config.json# Lighthouse CInpx lhci autorun```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Generic public-cache example can place API responses in shared caches

Source references: 5
What we found

The example directly sets `public, max-age=300` for “API responses” without limiting the adjacent code to public, user-independent responses. Although later text gives the correct warning, copying or automatically applying the snippet can omit that restriction.

Why this matters

If an endpoint returns user-, tenant-, or permission-specific content, a browser, proxy, or CDN cache could serve one user's response to another for up to five minutes.

The example directly marks unspecified “API responses” as publicly cacheable for five minutes, without showing authentication or personalization conditions. If copied onto an endpoint containing user, tenant, or permission-dependent data, another user could receive cached content. Later warnings correctly require viewer-aware keys and reject unsafe per-user caching, which reduces—but does not remove—the risk of the generic snippet. A user can require the example to be limited to explicitly public, identical responses.

SKILL.md:344In the instructionsOpen original file
// HTTP caching headers for static assetsapp.use('/static', express.static('public', {  maxAge: '1y',           // Cache for 1 year  immutable: true,        // Never revalidate (use content hashing in filenames)}));// Cache-Control for API responsesres.set('Cache-Control', 'public, max-age=300'); // 5 minutes```
Show 4 other places
SKILL.md:327In the instructionsOpen original file
| Shared (Redis, Memcached) | All instances | Instances must agree, or the value is expensive to recompute | A network hop, and another service to run and monitor || CDN / edge | Everyone, per URL | Responses are public and identical for a given key | Invalidation is the hard part; assume you cannot recall a bad response quickly |
SKILL.md:354In the instructionsOpen original file
**Key design decides correctness.** Every input that changes the response belongs in the key: tenant, locale, permissions, feature flags. A key that omits the viewer is how one user's data gets served to another, and that ships as a performance win.
SKILL.md:366In the instructionsOpen original file
**Do not cache:** anything whose staleness is a correctness bug (balances, permissions, inventory at checkout), or per-user data under a key that does not identify the user. See `../../references/performance-checklist.md` for request coalescing, write strategies, negative caching, and the cache checklist.
SKILL.md:350In the instructionsOpen original file
// Cache-Control for API responsesres.set('Cache-Control', 'public, max-age=300'); // 5 minutes```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 4
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is an actionable CI command, not merely a textual mention. It runs an unversioned `bundlesize` package through `npx`; if no locked local copy exists, npx may download and execute whatever the registry provides at that time. A user can ask the author to pin the version and require the dependency to be present in the project's lockfile.

This CI example executes an unversioned Lighthouse CI package through `npx`. If the package is not already installed and locked in the project, execution may fetch and immediately run a different version with access to the CI environment and any credentials available there. A user can restrict it to a pinned local dependency recorded in the lockfile.

SKILL.md:435In the instructionsOpen original file
# Bundle size checknpx bundlesize --config bundlesize.config.json
Show 3 other places
SKILL.md:432In the instructionsOpen original file
**Enforce in CI:**```bash# Bundle size checknpx bundlesize --config bundlesize.config.json
SKILL.md:438In the instructionsOpen original file
# Lighthouse CInpx lhci autorun```
SKILL.md:437In the instructionsOpen original file
# Lighthouse CInpx lhci autorun```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill's main workflow is to measure performance, locate the bottleneck, make a targeted change, remeasure it, and add monitoring or tests; changes that miss the threshold or break tests are to be reverted.

View source
SKILL.md:33In the instructionsOpen original file
```1. MEASURE  → Establish baseline with real data2. IDENTIFY → Find the actual bottleneck (not assumed)3. FIX      → Address the specific bottleneck4. VERIFY   → Measure again; keep or revert5. GUARD    → Add monitoring or tests to prevent regression```

It may recommend changes to application code, database indexes, connection pools, caching, and CI configuration, so actual use can extend beyond read-only analysis.

View source
SKILL.md:172In the instructionsOpen original file
```sqlCREATE INDEX idx_tasks_owner_created ON tasks (owner_id, created_at DESC);```
SKILL.md:195In the instructionsOpen original file
// GOOD: one pool per process, sized against the database's ceilingconst pool = new Pool({  max: 10,                        // instances × max must stay under max_connections  idleTimeoutMillis: 30_000,  connectionTimeoutMillis: 5_000, // fail fast instead of queueing forever});```
SKILL.md:432In the instructionsOpen original file
**Enforce in CI:**```bash# Bundle size checknpx bundlesize --config bundlesize.config.json# Lighthouse CInpx lhci autorun```

The caching guidance explicitly warns that keys must include every response-affecting input, such as tenant, locale, permissions, and viewer, and says not to cache correctness-sensitive data or per-user data without a user-specific key.

View source
SKILL.md:354In the instructionsOpen original file
**Key design decides correctness.** Every input that changes the response belongs in the key: tenant, locale, permissions, feature flags. A key that omits the viewer is how one user's data gets served to another, and that ships as a performance win.
SKILL.md:366In the instructionsOpen original file
**Do not cache:** anything whose staleness is a correctness bug (balances, permissions, inventory at checkout), or per-user data under a key that does not identify the user. See `../../references/performance-checklist.md` for request coalescing, write strategies, negative caching, and the cache checklist.
Start here · InstructionsSKILL.md
performance-optimization
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:48In the instructionsOpen original file
**Frontend:**```bash# Synthetic: Lighthouse in Chrome DevTools (or CI)
SKILL.md:62In the instructionsOpen original file
**Backend:**```bash# Response time logging
SKILL.md:433In the instructionsOpen original file
**Enforce in CI:**```bash# Bundle size check
Install extra software packages
SKILL.md:435In the instructionsOpen original file
# Bundle size checknpx bundlesize --config bundlesize.config.json
SKILL.md:438In the instructionsOpen original file
# Lighthouse CInpx lhci autorun```
Lines read
497
File checksum (to compare versions)
4183fc2e0ee955f525433f93d030a62154f44d9b4ea0ac0d6c0ce312720e91f0