bjornmelin/hotspot-optimizer
plugins/claude-core/skills/hotspot-optimizer/SKILL.md
Find algorithmic complexity and performance hotspots across a codebase, then optimize them safely behind tests without changing behavior. Use when asked to scan for slow code, inefficient or nested loops, repeated scans, costly re-renders or recomputation, N+1 queries, avoidable quadratic work, or to reduce complexity while preserving tests, APIs, ordering, and outputs; or when a request mentions performance hotspots, hot paths, render churn, "this is slow", or "optimize for speed". Fans out across files with Task subagents, ranks findings by impact, proves current behavior with focused tests, applies localized edits, and re-runs the narrow test plus broad type, lint, and build to verify. Defaults to an analysis-only report unless you ask to implement, fix, apply, or refactor.
$ install --global
skillsauthnpx skillsauth add bjornmelin/dev-skills hotspot-optimizerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 26, 2026, 3:14 AM63.3s5 files scanned
SKILL.md
- name:
- hotspot-optimizer
- description:
- >-
- license:
- MIT
Hotspot optimizer
Find and (on request) fix complexity/performance hotspots with behavior preserved and proven by tests. Bias toward small, verified wins over broad rewrites.
Core rule
Never change observable behavior. Every optimization preserves outputs, ordering, error semantics, and public APIs — and is proven by a test that passed before and after.
Loop: Triage → Prove → Optimize → Verify
- Triage — get candidate leads fast, then reason about them:
- First pass (cheap, optional):
python3 scripts/scan_hotspots.py <root> --format jsonfor a ranked multi-language lead list. Treat output as leads, not proof. - Confirm with
Grep/Glob/Read: nested loops over the same data, membership tests in a loop (list vs set), sort-in-loop, pairwise comparisons, repeated scans, render recomputation, N+1 queries. Rank by impact (hot path × input size), not raw count.
- First pass (cheap, optional):
- Prove — before touching hot code, run/author a focused test that pins current behavior and, if feasible, a quick timing or complexity witness.
- Optimize — apply the smallest localized
Editthat lowers complexity (seereferences/optimization-playbook.md). No drive-by refactors or formatting churn. - Verify — re-run the focused test, then the broad gates (type-check, lint, build, suite). If any regresses, revert that change.
Subagent fan-out
For large repos, shard files/dirs across Task subagents (read-only). Each returns a ranked findings
list: file:line, pattern, estimated current → target complexity, risk. The main agent dedupes and
merges into one ranked plan, then optimizes serially (it owns all edits). Cap concurrency at ~4-6
subagents; prefer fewer, broader shards over many tiny ones.
Optimization safety checklist
- Same outputs for the same inputs (including ordering and ties).
- No swallowed/altered exceptions; same error types.
- No new unbounded memory (a set/dict cache must be bounded by the same data).
- Equivalent for empty / single / duplicate / large inputs.
- Public API and call sites unchanged.
Analysis-only by default
Default to a report (see references/report-template.md): ranked findings with location, current and
target complexity, risk, and a proposed fix — but do not edit. Apply fixes only when the user says
implement / fix / apply / refactor (or pre-approves low-risk wins like list→set membership).
Resources
scripts/scan_hotspots.py— heuristic multi-language hotspot scanner (leads only).references/optimization-playbook.md— transformation catalog + correctness checks + what-not-to-do.references/report-template.md— analysis-only report skeleton.
Related Skills
bjornmelin/multi-model-review
development
VerifiedTrustedCommunity
Pre-PR multi-model review, parallel opus and codex exec adversarial lanes, then adversarial verification of merged findings. Read-only. Use before shipping nontrivial diffs.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-review
tools
VerifiedTrustedCommunity
Independent gpt-5.6 diff review via the Codex CLI, normal or steerable adversarial with JSON findings. Use before shipping nontrivial changes.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-delegate
development
VerifiedTrustedCommunity
Delegate implementation, investigation, or bulk work to gpt-5.6 codex via pinned codex exec. Use for clear-spec builds, migrations, debugging, or any task MODELS.md routes to codex.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/pre-mortem
development
VerifiedTrustedCommunity
Adversarial pre-mortem: imagine the plan failed, work backwards to surface risky assumptions + irreversible bets, then harden them. Proactively offer it (after the current request; confirm first) before a hard-to-reverse or one-way-door call (API, schema, framework, a hire), an all-upside plan, or unvalidated assumptions. Also on request.
3SKILL.mdUpdated Jul 22, 2026