steipete/native-app-performance
skills/native-app-performance/SKILL.md
Native app performance: xctrace, Time Profiler, traces, hotspots.
$ install --global
skillsauthnpx skillsauth add steipete/agent-scripts native-app-performanceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 27, 2026, 5:57 AM146.3s4 files scanned
SKILL.md
- name:
- native-app-performance
- description:
- Native app performance: xctrace, Time Profiler, traces, hotspots.
Native App Performance (CLI-only)
Goal: record Time Profiler via xctrace, extract samples, symbolicate, and propose hotspots without opening Instruments.
Quick start (CLI)
- Record Time Profiler (attach):
# Start app yourself, then attach
xcrun xctrace record --template 'Time Profiler' --time-limit 90s --output /tmp/App.trace --attach <pid>
- Record Time Profiler (launch):
xcrun xctrace record --template 'Time Profiler' --time-limit 90s --output /tmp/App.trace --launch -- /path/App.app/Contents/MacOS/App
- Extract time samples:
scripts/extract_time_samples.py --trace /tmp/App.trace --output /tmp/time-sample.xml
- Get load address for symbolication:
# While app is running
vmmap <pid> | rg -m1 "__TEXT" -n
- Symbolicate + rank hotspots:
scripts/top_hotspots.py --samples /tmp/time-sample.xml \
--binary /path/App.app/Contents/MacOS/App \
--load-address 0x100000000 --top 30
Workflow notes
- Always confirm you’re profiling the correct binary (local build vs /Applications). Prefer direct binary path for
--launch. - Ensure you trigger the slow path during capture (menu open/close, refresh, etc.).
- If stacks are empty, capture longer or avoid idle sections.
xcrun xctrace help recordandxcrun xctrace help exportshow correct flags.
Included scripts
scripts/record_time_profiler.sh: record via attach or launch.scripts/extract_time_samples.py: export time-sample XML from a trace.scripts/top_hotspots.py: symbolicate and rank top app frames.
Gotchas
- ASLR means you must use the runtime
__TEXTload address fromvmmap. - If using a new build, update the
--binarypath; symbols must match the trace. - CLI-only flow: no need to open Instruments if stacks are symbolicated via
atos.
Related Skills
steipete/openclaw-relay
data-ai
VerifiedTrustedCommunity
OpenClaw session relay: prompts/posts via local/remote acpx over SSH.
4,005SKILL.mdUpdated Apr 26, 2026
steipete/wrangler
tools
VerifiedTrustedCommunity
Wrangler CLI: Workers, KV, tail, deploy, account routing.
3,701SKILL.mdUpdated May 27, 2026
steipete/twilio-sms
tools
VerifiedTrustedCommunity
Twilio SMS CLI: buy/list/keep numbers, send/check messages, credential routing.
3,701SKILL.mdUpdated May 27, 2026
steipete/skill-cleaner
development
VerifiedTrustedCommunity
Audit Codex/OpenClaw skills: loaded roots, duplicate skills, unused skills, prompt-budget costs, compact descriptions.
3,701SKILL.mdUpdated May 27, 2026