performance-review
Skill4 starsChanged 8 months agoMITView on GitHub
Identify performance bottlenecks, memory leaks, and optimization opportunities by analyzing code patterns, queries, and resource usage. Use it when your application is slower than expected but profiling hasn't pinpointed the cause; before a load test to proactively find bottlenecks; when reviewing performance-critical code paths (request handlers, data processing pipelines, rendering logic); when users report latency issues and you need to find the root cause in code; during capacity planning when you need to understand scaling limits.
Files
<!-- Generated from recipes/code-review/performance-review.md by scripts/build-skills.sh. Edit the recipe, then rerun the script. -->Performance Bottleneck Finder
You are a performance engineer analyzing this codebase for bottlenecks. Your goal is to find code patterns that cause slowness, excessive memory usage, or poor scalability under load. Focus on real-world impact, not micro-optimizations.
Analyze the code and produce a report organized by severity of performance impact.
1. DATABASE & QUERY PERFORMANCE
Look for:
- N+1 queries: Loops that execute a query per iteration instead of batching
- Missing indexes: Queries that filter or sort on columns without indexes (look at WHERE clauses, ORDER BY, and JOIN conditions)
- Unbounded queries: SELECT without LIMIT, or queries that fetch all rows when only a subset is needed
- Over-fetching: SELECT * when only a few columns are needed, especially on tables with large text/blob columns
- Missing connection pooling: Creating new database connections per request instead of using a pool
- Expensive aggregations: COUNT, SUM, or GROUP BY on large tables without materialized views or caching
- Transaction scope: Transactions that hold locks longer than necessary (doing HTTP calls or file I/O inside a transaction)
- Missing pagination: Endpoints that return all records with no limit/offset or cursor-based pagination
For each finding, estimate the performance impact: how does it scale as data grows?
2. MEMORY & RESOURCE MANAGEMENT
Look for:
- Memory leaks: Event listeners added but never removed, growing Maps/Sets that are never pruned, closures that capture large objects unnecessarily, caches without eviction policies or TTLs
- Large object allocation in hot paths: Creating large arrays, buffers, or string concatenations inside loops or frequently-called functions
- Stream misuse: Loading entire files or HTTP responses into memory instead of using streaming
- Missing resource cleanup: Database connections, file handles, or HTTP connections not being closed/returned in finally blocks
- Unbounded queues or buffers: In-memory queues that grow without backpressure
3. CONCURRENCY & BLOCKING
Look for:
- Blocking the event loop (Node.js): Synchronous file I/O, CPU-heavy computation, JSON.parse on large payloads, RegExp with catastrophic backtracking
- Blocking the main thread (Frontend): Heavy computation during render, large synchronous localStorage operations, layout thrashing
- Missing parallelization: Sequential await calls that could be Promise.all / asyncio.gather / goroutines
- Thread pool exhaustion: More concurrent tasks than the thread pool can handle, causing queuing
- Lock contention: Mutexes or synchronization points that serialize work unnecessarily
- Missing debouncing/throttling: Event handlers (scroll, resize, input) that fire on every event without debouncing
4. CACHING OPPORTUNITIES
Look for:
- Repeated expensive computations: The same calculation done multiple times with the same inputs
- Repeated external calls: Fetching the same data from an API or database multiple times in one request lifecycle
- Missing HTTP caching headers: API responses that could be cached by clients/CDNs but lack Cache-Control, ETag, or Last-Modified headers
- Missing application-level caching: Frequently-read, rarely-changed data that should be in Redis/Memcached
- Stale cache risks: Caches without proper invalidation that could serve outdated data
5. NETWORK & I/O INEFFICIENCY
Look for:
- Chatty APIs: Multiple sequential HTTP calls to the same service that could be batched into one
- Missing compression: Large responses sent without gzip/brotli compression
- Synchronous external calls in request path: HTTP calls to third-party services without timeouts, circuit breakers, or fallbacks
- Missing CDN usage: Static assets served from the application server instead of a CDN
- Payload bloat: Sending unnecessary data in API responses (entire objects when the client needs 2 fields)
- Missing connection keep-alive: Opening new TCP connections for each HTTP call to the same host
6. ALGORITHM & DATA STRUCTURE ISSUES
Look for:
- O(n^2) or worse in disguise: Nested loops, repeated array includes/indexOf checks (should be a Set), repeated object key lookups on arrays (should be a Map)
- Unnecessary sorting: Sorting arrays that don't need to be sorted, or sorting repeatedly when once would suffice
- String concatenation in loops: Building strings with += instead of using join or a buffer
- Regex compilation in loops: Creating new RegExp objects inside loops instead of compiling once
OUTPUT FORMAT
For each finding:
[P0/P1/P2/P3] Short title
Location: file:line
Pattern: What the code does now
Impact: How this affects performance (quantify if possible: "O(n^2) where n = number of users", "adds ~200ms per request")
Fix: Specific code change or approach to fix it
Effort: Trivial / Small / Medium / Large
Priority levels:
- P0: Causes outages or severe degradation under normal load
- P1: Significant impact on user experience or cost at current scale
- P2: Will become a problem as the system scales 2-5x
- P3: Minor inefficiency, optimize if convenient
End with a summary table of all findings sorted by priority, and a "Top 3 Changes" section highlighting the highest-impact fixes.
The source recipe, with a worked example and customization tips, is https://github.com/Sagargupta16/agent-recipes/blob/main/recipes/code-review/performance-review.md
Other versions23 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 23
- anthropics/knowledge-work-plugins★ 34ksame name
- genspark-ai/genoffice★ 11ksame name
- microsoft/intelligent-terminal★ 2.1ksame name
- borgbase/vykar★ 713same name
- ShipSecAI/studio★ 380same name
- bis-code/claude-toolkit★ 8same name
- vikisingh23/neuraforge-ai★ 4same name
- aiimpactagency/social-media-team★ 3same name
- Cure-Consulting-Group/ProductEngineeringSkills★ 3same name
- flopperj/dotfiles-core★ 3same name
13 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use security-review.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
SentrySkillsecurity-review
Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.
Also in 8 projects that use this
In this repository22 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- api-docs-generatorSkill
- architecture-reviewSkill
- background-deploy-monitorSkill
- changelog-writerSkill
- ci-cd-pipelineSkill
- cjs-to-esmSkill
- class-to-hooksSkill
- coverage-gap-finderSkill
- dependency-auditSkill
- dockerfile-generatorSkill
- e2e-test-writerSkill
- generate-unit-testsSkill
- input-validationSkill
- js-to-tsSkill
- monitoring-setupSkill
- multi-repo-pr-checkSkill
- owasp-auditSkill
- pr-reviewSkill
- readme-generatorSkill
- secret-scannerSkill
- upgrade-dependenciesSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

