coding

name	coding
description	Five specialized coding agents (linter, perf, refactor, security, test) that enforce quality gates across the development lifecycle. From lint enforcement through performance profiling, refactoring, security auditing, and test coverage. Use when working with coding agents.
domain	agents
author	oyi77
license	Apache-2.0
subdomain	coding-agents
tags	["agent","ai-agent","automation","coding","linter","perf","refactor","security","test","quality","money"]
version	1.0.0

Coding Agents

Money-Making Overview

Agent	Revenue Impact	Avg. Savings	Best For
Linter Agent	Enforces standards at scale	$300–1,000/project	Bulk rule application, migration, cleanup
Perf Agent	Cuts infra costs 20–40%	$2,000–20,000/year	Bottleneck profiling, query tuning, cost reduction
Refactor Agent	Reduces maintenance debt 50%	$3,000–15,000/refactor	Complexity reduction, modernization, splitting monoliths
Security Agent	Prevents P1 production incidents	$5,000–50,000/incident	Bug bounty, vulnerability scanning, pentest automation
Test Agent	Cuts regression bugs 80%	$2,000–8,000/release	Coverage gaps, regression tests, e2e flows

Combined ROI: A single pass through all five agents on a medium codebase (50K LOC) saves $15,000–50,000 by preventing production bugs, reducing cloud costs, and slashing maintenance overhead.

---

When to Use

Linter first — before every PR, after merge conflicts, when adopting new rules, migrating linters.

Perf when it hurts — app is slow, memory is growing, queries lag, infra costs too high, capacity planning.

Refactor before features — make the change easy before making the easy change. High cyclomatic complexity, duplicated code, monolithic files.

Security before deploy — every commit touching auth, payments, PII, or external APIs requires a security gate.

Test always — new features (TDD), regression tests for bugs, coverage gaps, integration tests, e2e.

When NOT to Use

• Trivial one-liner changes — just make the edit.
• Real-time human judgment — agents cannot decide product or business trade-offs.
• Agent lacks access to required tools, credentials, or data.

---

Combined Capabilities

                    ┌──────────────┐
                    │  Linter       │  ← Style enforcement → Convention rules
                    │  Agent        │  ← Bulk fixes → Migration
                    └──────┬───────┘
                           │ clean code
                    ┌──────┴───────┐
                    │  Perf         │  ← Profiling → Benchmarking
                    │  Agent        │  ← Bottleneck identification → Optimization
                    └──────┬───────┘
                           │ profiled
                    ┌──────┴───────┐
                    │  Refactor     │  ← Complexity reduction → Pattern extraction
                    │  Agent        │  ← Dead code removal → Modernization
                    └──────┬───────┘
                           │ restructured
                    ┌──────┴───────┐
                    │  Security     │  ← Vulnerability scan → Exploit validation
                    │  Agent        │  ← Bug bounty → POC generation
                    └──────┬───────┘
                           │ hardened
                    ┌──────┴───────┐
                    │  Test         │  ← Unit tests → Integration tests
                    │  Agent        │  ← E2E tests → Coverage enforcement
                    └──────────────┘

Gate Matrix

Gate	When	Tool	Fail Criteria
Lint	Pre-commit, pre-PR	eslint, ruff, revive, prettier	Any error-level rule violation
Perf	Pre-release, monthly	py-spy, valgrind, k6, lighthouse	P95 > threshold, memory leak detected
Refactor	Before feature work	cyclomatic-complexity, sloc	Complexity > 15 per function
Security	Pre-deploy, bug bounty	semgrep, trufflehog, zap	Any P1/P2 vulnerability
Test	Post-commit, pre-merge	pytest, vitest, go test	Coverage < 80%, any test failure

---

Concrete Action Flow

Full Quality Pipeline

# 1. LINT: Clean up before PR
agent linter-agent \
    --path "src/" \
    --config ".eslintrc.cjs" \
    --fix \
    --require "no-unused-vars, no-console"

# 2. PERF: Profile the hot path
agent perf-agent \
    --profile "GET /api/users/:id" \
    --benchmark "1000 req/s" \
    --target "p95 < 200ms" \
    --output perf-report.md

# 3. REFACTOR: Clean up before feature work
agent refactor-agent \
    --target "src/legacy/users.ts" \
    --complexity-threshold 15 \
    --remove-dead-code \
    --modernize "callbacks->async"

# 4. SECURITY: Audit before deploy
agent security-agent \
    --target "https://staging.example.com" \
    --scan "xss, sqli, ssti, ssrf" \
    --output security-report.json

# 5. TEST: Fill coverage gaps
agent test-agent \
    --path "src/services/" \
    --target-coverage 85 \
    --type "unit, integration" \
    --output coverage-report.json

Quick Bug Fix Cycle

# 1. LINT the fix area first
agent linter-agent --path "src/buggy-file.ts" --fix

# 2. REFACTOR if the code is messy
agent refactor-agent --path "src/buggy-file.ts" --complexity-threshold 10

# 3. Add regression TEST
agent test-agent \
    --bug "SESSION-123" \
    --regression \
    --path "src/buggy-file.ts"

# 4. SECURITY check the change
agent security-agent --diff "$(git diff)"

---

First Action in 60 Minutes

1. Run linter-agent on your entire src/ directory with --fix. This removes noise immediately.
2. Run security-agent on your staging environment or a recent diff. One quick scan surfaces the top risks.
3. Run test-agent with --coverage-report to see where you are most exposed.
4. Run perf-agent on your slowest endpoint (check your APM or logs for P99).
5. Run refactor-agent on the file with the highest churn (git blame reveals it).

Total time: ~50 min. You will walk away with: clean code, known vulnerabilities patched, coverage gaps mapped, one bottleneck fixed, and one messy file cleaned.

---

Real Code Examples

Python: Full Quality Gate CI Script

#!/usr/bin/env python3
"""CI quality gate: lint → perf → refactor → security → test."""

import json, subprocess, sys
from pathlib import Path

def gate(name: str, *args) -> dict:
    """Run a coding agent gate."""
    cmd = ["agent", f"{name}-agent", "--json", *args]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return json.loads(result.stdout)

def quality_pipeline(changed_files: list[str]):
    results = {}

    # Gate 1: Lint
    results["lint"] = gate("linter",
        *[f"--path={f}" for f in changed_files],
        "--fix", "--strict")
    if results["lint"].get("errors", 0) > 0:
        print("LINT FAILED — fixing...")
        sys.exit(1)

    # Gate 2: Security (lightning scan)
    results["security"] = gate("security",
        "--scan=secrets,injection",
        "--diff", subprocess.run(
            ["git", "diff", "HEAD"],
            capture_output=, text=).stdout)
     (f[]  (, )
            f  results[].get(, [])):
        ()
        sys.exit()

    
    results[] = gate(,
        *[  f  changed_files],
        ,
        )
     results[].get(, ) > :
        ()

    
    results[] = gate(,
        ,
        )
     results[].get(, ) < :
        ()
        sys.exit()

    ()
     results

 __name__ == :
    files = sys.argv[:]  (sys.argv) >   []
    quality_pipeline(files)

Bash: One-Shot Quality Report

#!/bin/bash
# quality-report.sh — run all 5 agents and produce a summary

DIR="${1:-src}"
REPORT="quality-report-$(date +%Y%m%d).md"

echo "# Quality Report $(date)" > "$REPORT"
echo "" >> "$REPORT"

echo "## Lint" >> "$REPORT"
agent linter-agent --path "$DIR" --report --output /tmp/lint.json
jq -r '.summary' /tmp/lint.json >> "$REPORT"

echo "## Performance" >> "$REPORT"
agent perf-agent --path "$DIR" --quick-check --output /tmp/perf.json
jq -r '.hotspots[] | "- \(.file):\(.line) — \(.message)"' /tmp/perf.json >> "$REPORT"

echo "## Refactor Candidates" >> "$REPORT"
agent refactor-agent --path "$DIR" --list-candidates --output /tmp/refactor.json
jq -r '.candidates[] | "- \(.file) — complexity \(.complexity)"' /tmp/refactor.json >> "$REPORT"

echo "## Security" >> "$REPORT"
agent security-agent --path "$DIR" --quick-scan --output /tmp/security.json
jq -r '.findings[] | "- \(.severity): \(.message)"' /tmp/security.json >> 

  >> 
agent test-agent --coverage-only --output /tmp/test.json
jq -r  /tmp/test.json >> 

 

---

Anti-Rationalization Table

Rationalization	Reality
"My code doesn't have lint errors"	Linter catches the 15 things your editor highlights that you ignore
"I will profile when it's slow"	By then the bottleneck is in production costing money
"Refactoring is a waste of time"	High complexity = high bug rate. Refactoring pays for itself
"I am careful enough, no security issues"	Every developer has blind spots — adversarial review catches them
"Tests take too long to write"	Test agent writes tests 10x faster than manual TDD
"The existing test coverage is fine"	If you don't measure it, you don't know. Measure then act
"I run all these tools locally"	Agents combine + orchestrate + explain results. Tools alone don't

---

Output Format

Linter Agent Output

{
  "files_scanned": 142,
  "errors": 0,
  "warnings": 3,
  "auto_fixed": 27,
  "failed_rules": ["no-console"],
  "summary": "3 warnings remain (all intentional console.log statements)"
}

Perf Agent Output

{
  "endpoints_benchmarked": 5,
  "bottlenecks": [
    { "endpoint": "GET /api/reports", "p95": "3.2s",
      "cause": "N+1 query in reports controller",
      "fix": "Eager load associated users" }
  ],
  "optimization_savings": "~35% p95 reduction predicted",
  "capacity": { "current_rps": 200, "recommended": "Add read replica at 500 rps" }
}

Refactor Agent Output

{
  "files_analyzed": 34,
  "high_complexity": 5,
  "candidates": [
    { "file": "src/processors/payment.ts", "complexity": 28,
      "recommendation": "Split into: validation, calculation, notification processors" }
  ],
  "dead_code_found": 12,
  "unused_deps": 3
}

Security Agent Output

{
  "findings": [
    { "file": "src/api/users.ts", "line": 55, "severity": "P1",
      "type": "SQL injection",
      "evidence": "Raw string interpolation in query",
      "fix": "Use parameterized query" }
  ],
  "scan_details": { "endpoints": 22, "vulnerable": 3, "secure": 19 },
  "poc": "pocs/sqli-users.html"
}

Test Agent Output

{
  "tests_added": 18,
  "coverage_before": 64,
  "coverage_after": 86,
  "test_types": { "unit": 14, "integration": 3, "e2e": 1 },
  "regression_tests": 5,
  "all_passing": true
}

---

Verification Checklist

• All coding agents executed without errors
• Lint: zero errors after auto-fix; warnings justified
• Perf: P95 within threshold, bottlenecks identified with fixes
• Refactor: high-complexity files documented; dead code removed
• Security: no P1/P2 findings; P3 findings acknowledged
• Tests: coverage >= 80%; all tests passing
• Documentation: config changes, rule additions/removals recorded
• CI gate: quality pipeline integrated into CI workflow
• Cost impact: perf optimizations projected to reduce infra costs

Workflow

See the parent skill for authoritative workflow documentation.