cwilliams5/review-resource-leaks-open
.claude/skills/review-resource-leaks-open/SKILL.md
Open Audit for memory leaks, handle leaks, GDI leaks, and CPU churn
$ install --global
skillsauthnpx skillsauth add cwilliams5/Alt-Tabby review-resource-leaks-openInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 1:16 AM19.1s1 file scanned
SKILL.md
- name:
- review-resource-leaks-open
- description:
- Open Audit for memory leaks, handle leaks, GDI leaks, and CPU churn
- user-invocable:
- true
- disable-model-invocation:
- true
Enter planning mode. Systematically audit the codebase for resource/memory leaks and unnecessary CPU churn. Use maximum parallelism — spawn explore agents for independent areas.
Known Safe Patterns (Do NOT Flag)
gD2D_Resbrush/font cache — intentional lifetime cache, cleaned up on exitstaticbuffers in hot-path functions — intentional reuse perahk-patterns.md- Flight recorder ring buffer — pre-allocated, fixed size, overwrites oldest entries
- Stats
.baksentinel files — intentional crash-safety pattern
Validation
After explore agents report back, validate every finding yourself. Resource "leaks" are frequently false positives where cleanup happens in a different function, on a timer, or at process exit.
For each candidate:
- Cite evidence: "I verified by reading
file.ahklines X–Y" with actual code quoted. - Trace the lifecycle: Where is the resource created? Where is it supposed to be freed? Is there a cleanup function called on exit/disconnect/error?
- Counter-argument: "What would make this fix unnecessary?" — Is the resource freed at process exit anyway? Is the "leak" actually a cache with bounded size? Does AHK's garbage collector handle this?
- Observed vs inferred: State whether you saw a missing cleanup directly, or inferred it from the absence of a delete call (absence of evidence is not evidence — the cleanup may be elsewhere).
- Impact assessment: Is this a per-paint leak (catastrophic), per-window leak (slow burn), or per-session leak (negligible)?
Plan Format
Group by severity (per-paint > per-event > per-session > theoretical):
| File | Lines | Resource Type | Leak Description | Impact | Fix |
|------|-------|--------------|-----------------|--------|-----|
| file.ahk | 42–58 | D2D Brush | D2D brush created in paint loop, never released | ~60 handles/sec | Use D2D_GetCachedBrush or static |
For CPU churn findings, use a separate table:
| File | Lines | Pattern | Frequency | Fix |
|------|-------|---------|-----------|-----|
| file.ahk | 100–120 | Timer polls every 100ms, no-ops 99% of the time | 10/sec idle | Adaptive interval or event-driven |
Ignore any existing plans — create a fresh one.
Related Skills
cwilliams5/worktree
tools
VerifiedTrustedCommunity
Create a new git worktree and switch the session into it
1SKILL.mdUpdated Apr 16, 2026
cwilliams5/trace
tools
VerifiedTrustedCommunity
Spawn agent to trace code flow via query tools — answer only, no context cost
1SKILL.mdUpdated Apr 16, 2026
cwilliams5/ship
tools
VerifiedTrustedCommunity
Commit, push, and create a PR for the current branch
1SKILL.mdUpdated Apr 16, 2026
cwilliams5/shader-retire
tools
VerifiedTrustedCommunity
Retire a shader by moving its files to legacy/shaders_retired
1SKILL.mdUpdated Apr 16, 2026