skills/code-optimizer/SKILL.md
Analyze code for performance bottlenecks, memory leaks, and algorithmic inefficiencies. Use when asked to optimize, find bottlenecks, or improve efficiency. Don't use for bug-hunting code review, security audits, or refactoring without a perf goal.
npx skillsauth add luongnv89/skills code-optimizerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Analyze code for performance issues following this priority order:
Before creating/updating/deleting files in an existing repository, sync the current branch with remote:
branch="$(git rev-parse --abbrev-ref HEAD)"
git fetch origin
git pull --rebase origin "$branch"
If the working tree is not clean, stash first, sync, then restore:
git stash push -u -m "pre-sync"
branch="$(git rev-parse --abbrev-ref HEAD)"
git fetch origin && git pull --rebase origin "$branch"
git stash pop
If origin is missing, pull is unavailable, or rebase/stash conflicts occur, stop and ask the user before continuing.
Before making any changes:
feat/, feature/, etc.)feat/optimize-<target>
feat/optimize-api-handlersFor each issue found:
### [Severity] Issue Title
**Location**: file:line_number
**Category**: Performance | Memory | Algorithm | Caching | Concurrency
**Problem**: Brief explanation of the issue
**Impact**: Why this matters (performance cost, resource usage, etc.)
**Fix**:
[Code example showing the optimized version]
After completing each major step, output a status report in this format:
◆ [Step Name] ([step N of M] — [context])
··································································
[Check 1]: √ pass
[Check 2]: √ pass (note if relevant)
[Check 3]: × fail — [reason]
[Check 4]: √ pass
[Criteria]: √ N/M met
____________________________
Result: PASS | FAIL | PARTIAL
Adapt the check names to match what the step actually validates. Use √ for pass, × for fail, and — to add brief context. The "Criteria" line summarizes how many acceptance criteria were met. The "Result" line gives the overall verdict.
Phase: Prerequisites — checks: Branch setup, Naming convention detected, Feature branch created
Phase: Analysis — checks: Issue detection, Priority categories covered, Impact estimated, Findings sorted by severity
Phase: Apply Fixes — checks: Fix application, User approval obtained, Existing tests run, No regressions introduced
Phase: Verify — checks: Performance verified, Test suite passes, Critical issues resolved, Warnings documented
go func() without context cancellation)sync.Pool, pre-allocate slices)strings.Builder)defer for resource cleanupCow<> instead)Mutex when RwLock would sufficeVec growth without with_capacity+ in loops (use StringBuilder)Solution: Report that the code is already well-optimized. Suggest profiling with runtime tools (e.g., perf, Chrome DevTools, py-spy) to find runtime-specific bottlenecks.
Solution: Ask the user to specify which functions or sections to focus on. Analyze the most performance-critical paths first.
Solution: Revert the change immediately. Re-examine the optimization and adjust the approach to preserve existing behavior.
A run is acceptable only when all of the following are verifiable:
Location, Category, Problem, Impact, and Fix — verify by checking the rendered template fields are non-empty.Edit/Write tool call.git rev-parse --abbrev-ref HEAD matching feat/* or repo equivalent.Result: PASS | FAIL | PARTIAL — assert the block is present in the transcript.Given a Node.js file src/api/handlers.js with an N+1 query in listUsers(), the skill should emit:
◆ Analysis (step 1 of 3 — src/api/handlers.js)
··································································
Issue detection: √ pass (3 issues found)
Priority categories: √ pass (Performance, Caching covered)
Impact estimated: √ pass
Findings sorted: √ pass
Criteria: 4/4 met
____________________________
Result: PASS
### [Critical] N+1 query in listUsers
**Location**: src/api/handlers.js:42
**Category**: Performance
**Problem**: `users.forEach(u => db.query(...))` issues one query per user.
**Impact**: For 1000 users, ~1000 round-trips (~2000ms) → 1 batched query (~50ms). 40x speedup.
**Fix**:
\`\`\`js
const ids = users.map(u => u.id);
const rows = await db.query('SELECT * FROM orders WHERE user_id = ANY($1)', [ids]);
\`\`\`
Expected result: a markdown report with one block per issue, sorted Critical → Low, followed by a phase completion report. See docs/README.md for a longer end-to-end example.
perf, py-spy, Chrome DevTools) — do NOT invent low-severity findings to fill the report.git checkout -- <file> after git diff confirms the scope and the user confirms the revert; never force-push, and back up the diff with git stash before discarding so work is recoverable.origin or rebase fails: stop and ask the user to confirm before any recovery; run git status and git stash --dry-run-style inspection first, take a backup branch (git branch backup/pre-recovery), and never run destructive reset --hard or rm without explicit confirmation.documentation
Manage software releases end-to-end: bump version, generate changelog, tag, push, GitHub release, publish to PyPI/npm. Use when user asks to ship, cut a release, tag a version, or list changes since last tag. Skip routine commits and marketplace publishing.
development
Review UI for usability issues using Steve Krug's principles and produce a scannable report. Use when asked for a usability audit, UX review, or UI feedback on screenshots, URLs, or code. Don't use for visual/brand design critique, accessibility (WCAG) audits, or backend/API review.
development
Validate app/startup ideas with market, feasibility, commercial, and open-source competitor analysis. Use when asked to evaluate, validate, or score a product idea. Don't use for PRDs, go-to-market plans, or investor decks.
testing
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI. Use when hardening repos or adding security hooks. Don't use for incident response or cloud security reviews.