| name | js-bundle-audit |
| description | Audit frontend build output for shipped-code waste — bundle size, dead code, missing code-splitting, hydration cost on content pages, duplicate dependencies, and polyfills for unsupported browsers. Use this skill whenever the user shares a build stats file (webpack/Vite/Rollup stats, source-map-explorer output), package.json + bundler config, or asks why the site's JavaScript is heavy or slow to load. Part of Lean Agentic AI Skills; emits lean-findings.json. |
JS Bundle Audit
Producer skill. Input: bundler stats/visualizer output, lockfile + config, or the built assets themselves. Output: lean-findings.json.
web-carbon-audit sees the served page; this skill sees the build that produced it. Shipped JavaScript is charged twice per visit — transfer (E, network) and execution (E, client CPU: parse/compile/run on every device, including the low-end ones).
Subject type: emit subject.type: "frontend-build" in findings.
Signatures
- Monolithic bundles — one entry chunk carrying the whole app; routes/features not split. High. Evidence: chunk sizes from stats. Fix: route-level code-splitting, dynamic import() for below-the-fold features.
- Dead and unused code shipped — exports bundled but never imported; entire component libraries for three components; moment.js with all locales. High. Fix: tree-shakeable imports (
import { x }), sideEffects flags, locale/feature pruning; evidence from stats treemaps.
- Duplicate dependencies — two versions of the same package via transitive pins; both lodash and lodash-es. Medium-high. Evidence: lockfile/stats. Fix: resolutions/dedupe.
- Full hydration on content pages — fully-interactive framework runtime shipped to pages that are 95% static text. Medium-high (client CPU × every visitor). Fix: static generation, islands/partial hydration, or server components where the stack supports them; named trade-off: architecture change, effort high.
- Legacy polyfills/transpilation for browsers nobody supports — ES5 output and core-js for a modern-browser audience. Medium. Fix: browserslist matched to actual analytics; dual modern/legacy builds only when the audience data demands it.
- Heavy libraries for light jobs — full charting/date/utility libraries where a small alternative or native API serves. Medium; name the specific lighter path per case.
- Source maps / dev artifacts in production — shipped .map files or unminified vendor chunks. Low-medium.
- No compression/minification gaps — modern minifier not enabled, brotli absent on the asset pipeline (overlaps web-carbon-audit's transfer view; record here when the cause is the build).
- Third-party SDK sprawl — analytics/support/AB-test SDKs each shipping their own runtime; loaded eagerly. Medium-high; fix: consolidate, defer, or facade.
Honesty rules
Byte sizes from stats are real — report before/after per recommendation where computable from the stats alone. Execution-cost claims stay directional ("less to parse and execute on every device") — measurement pointer: Lighthouse total blocking time / real-device profiling. Splitting adds request overhead — name it when recommending fine-grained chunks.
Cost signal (countable)
Cost driver: bytes served × visitors (CDN egress and client CPU time). Bundler stats give exact byte counts per chunk — quote them in cost_signal.observed; visitor multiplier belongs to the user's analytics.
Not this skill's job
Served-page concerns beyond the bundle (web-carbon-audit), CI time to build it (lean-ci-audit), CDN caching of the chunks (caching-strategy-designer).
