steipete/native-app-performance
skills/native-app-performance/SKILL.md
Native app performance: xctrace, Time Profiler, traces, hotspots.
$ install --global
skillsauthnpx skillsauth add steipete/agent-scripts native-app-performanceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 27, 2026, 5:57 AM146.3s4 files scanned
SKILL.md
- name:
- native-app-performance
- description:
- Native app performance: xctrace, Time Profiler, traces, hotspots.
Native App Performance (CLI-only)
Goal: record Time Profiler via xctrace, extract samples, symbolicate, and propose hotspots without opening Instruments.
Quick start (CLI)
- Record Time Profiler (attach):
# Start app yourself, then attach
xcrun xctrace record --template 'Time Profiler' --time-limit 90s --output /tmp/App.trace --attach <pid>
- Record Time Profiler (launch):
xcrun xctrace record --template 'Time Profiler' --time-limit 90s --output /tmp/App.trace --launch -- /path/App.app/Contents/MacOS/App
- Extract time samples:
scripts/extract_time_samples.py --trace /tmp/App.trace --output /tmp/time-sample.xml
- Get load address for symbolication:
# While app is running
vmmap <pid> | rg -m1 "__TEXT" -n
- Symbolicate + rank hotspots:
scripts/top_hotspots.py --samples /tmp/time-sample.xml \
--binary /path/App.app/Contents/MacOS/App \
--load-address 0x100000000 --top 30
Workflow notes
- Always confirm you’re profiling the correct binary (local build vs /Applications). Prefer direct binary path for
--launch. - Ensure you trigger the slow path during capture (menu open/close, refresh, etc.).
- If stacks are empty, capture longer or avoid idle sections.
xcrun xctrace help recordandxcrun xctrace help exportshow correct flags.
Included scripts
scripts/record_time_profiler.sh: record via attach or launch.scripts/extract_time_samples.py: export time-sample XML from a trace.scripts/top_hotspots.py: symbolicate and rank top app frames.
Gotchas
- ASLR means you must use the runtime
__TEXTload address fromvmmap. - If using a new build, update the
--binarypath; symbols must match the trace. - CLI-only flow: no need to open Instruments if stacks are symbolicated via
atos.
Related Skills
steipete/npm
tools
VerifiedTrustedCommunity
npm registry ops: login, whoami, names, publish; 1Password tmux.
6,597SKILL.mdUpdated May 9, 2026
steipete/fleet-maintenance
development
VerifiedTrustedCommunity
Mac fleet inventory and upkeep with full/worker profiles: collect installed apps and packages, compare desired versus observed state, audit local-account escrow references, update Homebrew/global packages, safely sync repos and Xcode, and report disk, service, backup, update, and security health.
6,582SKILL.mdUpdated Jul 11, 2026
steipete/codex-first
tools
VerifiedTrustedCommunity
Claude Code work routing: delegate implementation, fixing, exploratory subagents, rebasing, and PR merging/landing to Codex CLI while the parent specifies, decides, reviews, and verifies. Load a private codex-next policy first when available; otherwise use the native-Claude model gate. Codex-backed autoreview is always allowed and preferred.
6,582SKILL.mdUpdated Jul 7, 2026
steipete/peekaboo
tools
VerifiedTrustedCommunity
macOS screen capture, accessibility inspection, and background-first app/window/UI automation with Peekaboo v4.
6,582SKILL.mdUpdated May 14, 2026