Coding

Coding Agents

Money-Making Overview

| Agent | Revenue Impact | Avg. Savings | Best For | |---|---|---|---| | Linter Agent | Enforces standards at scale | $300–1,000/project | Bulk rule application, migration, cleanup | | Perf Agent | Cuts infra costs 20–40% | $2,000–20,000/year | Bottleneck profiling, query tuning, cost reduction | | Refactor Agent | Reduces maintenance debt 50% | $3,000–15,000/refactor | Complexity reduction, modernization, splitting monoliths | | Security Agent | Prevents P1 production incidents | $5,000–50,000/incident | Bug bounty, vulnerability scanning, pentest automation | | Test Agent | Cuts regression bugs 80% | $2,000–8,000/release | Coverage gaps, regression tests, e2e flows |

Combined ROI: A single pass through all five agents on a medium codebase (50K LOC) saves $15,000–50,000 by preventing production bugs, reducing cloud costs, and slashing maintenance overhead.

---

When to Use These Agents

Linter first — before every PR, after merge conflicts, when adopting new rules, migrating linters.

Perf when it hurts — app is slow, memory is growing, queries lag, infra costs too high, capacity planning.

Refactor before features — make the change easy before making the easy change. High cyclomatic complexity, duplicated code, monolithic files.

Security before deploy — every commit touching auth, payments, PII, or external APIs requires a security gate.

Test always — new features (TDD), regression tests for bugs, coverage gaps, integration tests, e2e.

When NOT to Use

• Trivial one-liner changes — just make the edit.
• Real-time human judgment — agents cannot decide product or business trade-offs.
• Agent lacks access to required tools, credentials, or data.

---

Combined Capabilities

                    ┌──────────────┐
                    │  Linter       │  ← Style enforcement → Convention rules
                    │  Agent        │  ← Bulk fixes → Migration
                    └──────┬───────┘
                           │ clean code
                    ┌──────┴───────┐
                    │  Perf         │  ← Profiling → Benchmarking
                    │  Agent        │  ← Bottleneck identification → Optimization
                    └──────┬───────┘
                           │ profiled
                    ┌──────┴───────┐
                    │  Refactor     │  ← Complexity reduction → Pattern extraction
                    │  Agent        │  ← Dead code removal → Modernization
                    └──────┬───────┘
                           │ restructured
                    ┌──────┴───────┐
                    │  Security     │  ← Vulnerability scan → Exploit validation
                    │  Agent        │  ← Bug bounty → POC generation
                    └──────┬───────┘
                           │ hardened
                    ┌──────┴───────┐
                    │  Test         │  ← Unit tests → Integration tests
                    │  Agent        │  ← E2E tests → Coverage enforcement
                    └──────────────┘

Gate Matrix

| Gate | When | Tool | Fail Criteria | |---|---|---|---| | Lint | Pre-commit, pre-PR | eslint, ruff, revive, prettier | Any error-level rule violation | | Perf | Pre-release, monthly | py-spy, valgrind, k6, lighthouse | P95 > threshold, memory leak detected | | Refactor | Before feature work | cyclomatic-complexity, sloc | Complexity > 15 per function | | Security | Pre-deploy, bug bounty | semgrep, trufflehog, zap | Any P1/P2 vulnerability | | Test | Post-commit, pre-merge | pytest, vitest, go test | Coverage async"

4. SECURITY: Audit before deploy

agent security-agent \ --target "https://staging.example.com" \ --scan "xss, sqli, ssti, ssrf" \ --output security-report.json

5. TEST: Fill coverage gaps

agent test-agent \ --path "src/services/" \ --target-coverage 85 \ --type "unit, integration" \ --output coverage-report.json

### Quick Bug Fix Cycle

```bash
# 1. LINT the fix area first
agent linter-agent --path "src/buggy-file.ts" --fix

# 2. REFACTOR if the code is messy
agent refactor-agent --path "src/buggy-file.ts" --complexity-threshold 10

# 3. Add regression TEST
agent test-agent \
    --bug "SESSION-123" \
    --regression \
    --path "src/buggy-file.ts"

# 4. SECURITY check the change
agent security-agent --diff "$(git diff)"

---

First Action in 60 Minutes

1. Run linter-agent on your entire src/ directory with --fix. This removes noise immediately.
2. Run security-agent on your staging environment or a recent diff. One quick scan surfaces the top risks.
3. Run test-agent with --coverage-report to see where you are most exposed.
4. Run perf-agent on your slowest endpoint (check your APM or logs for P99).
5. Run refactor-agent on the file with the highest churn (git blame reveals it).

Total time: ~50 min. You will walk away with: clean code, known vulnerabilities patched, coverage gaps mapped, one bottleneck fixed, and one messy file cleaned.

---

Real Code Examples

Python: Full Quality Gate CI Script

#!/usr/bin/env python3
"""CI quality gate: lint → perf → refactor → security → test."""

import json, subprocess, sys
from pathlib import Path

def gate(name: str, *args) -> dict:
    """Run a coding agent gate."""
    cmd = ["agent", f"{name}-agent", "--json", *args]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return json.loads(result.stdout)

def quality_pipeline(changed_files: list[str]):
    results = {}

    # Gate 1: Lint
    results["lint"] = gate("linter",
        *[f"--path={f}" for f in changed_files],
        "--fix", "--strict")
    if results["lint"].get("errors", 0) > 0:
        print("LINT FAILED — fixing...")
        sys.exit(1)

    # Gate 2: Security (lightning scan)
    results["security"] = gate("security",
        "--scan=secrets,injection",
        "--diff", subprocess.run(
            ["git", "diff", "HEAD"],
            capture_output=True, text=True).stdout)
    if any(f["severity"] in ("P1", "P2")
           for f in results["security"].get("findings", [])):
        print("SECURITY FAILED — aborting")
        sys.exit(1)

    # Gate 3: Refactor (complexity check)
    results["refactor"] = gate("refactor",
        *[f"--path={f}" for f in changed_files],
        "--complexity-threshold=12",
        "--dry-run")
    if results["refactor"].get("high_complexity", 0) > 0:
        print(f"REFACTOR: {results['refactor']['high_complexity']} complex functions")

    # Gate 4: Coverage check
    results["test"] = gate("test",
        "--coverage-only",
        "--min-coverage=80")
    if results["test"].get("coverage", 0)  1 else ["src/"]
    quality_pipeline(files)

Bash: One-Shot Quality Report

#!/bin/bash
# quality-report.sh — run all 5 agents and produce a summary

DIR="${1:-src}"
REPORT="quality-report-$(date +%Y%m%d).md"

echo "# Quality Report $(date)" > "$REPORT"
echo "" >> "$REPORT"

echo "## Lint" >> "$REPORT"
agent linter-agent --path "$DIR" --report --output /tmp/lint.json
jq -r '.summary' /tmp/lint.json >> "$REPORT"

echo "## Performance" >> "$REPORT"
agent perf-agent --path "$DIR" --quick-check --output /tmp/perf.json
jq -r '.hotspots[] | "- \(.file):\(.line) — \(.message)"' /tmp/perf.json >> "$REPORT"

echo "## Refactor Candidates" >> "$REPORT"
agent refactor-agent --path "$DIR" --list-candidates --output /tmp/refactor.json
jq -r '.candidates[] | "- \(.file) — complexity \(.complexity)"' /tmp/refactor.json >> "$REPORT"

echo "## Security" >> "$REPORT"
agent security-agent --path "$DIR" --quick-scan --output /tmp/security.json
jq -r '.findings[] | "- \(.severity): \(.message)"' /tmp/security.json >> "$REPORT"

echo "## Test Coverage" >> "$REPORT"
agent test-agent --coverage-only --output /tmp/test.json
jq -r '. | "- Coverage: \(.coverage)%"' /tmp/test.json >> "$REPORT"

echo "Report written to $REPORT"

---

Anti-Rationalization

| Rationalization | Reality | |---|---| | "My code doesn't have lint errors" | Linter catches the 15 things your editor highlights that you ignore | | "I will profile when it's slow" | By then the bottleneck is in production costing money | | "Refactoring is a waste of time" | High complexity = high bug rate. Refactoring pays for itself | | "I am careful enough, no security issues" | Every developer has blind spots — adversarial review catches them | | "Tests take too long to write" | Test agent writes tests 10x faster than manual TDD | | "The existing test coverage is fine" | If you don't measure it, you don't know. Measure then act | | "I run all these tools locally" | Agents combine + orchestrate + explain results. Tools alone don't |

---

Output Format

Linter Agent Output

{
  "files_scanned": 142,
  "errors": 0,
  "warnings": 3,
  "auto_fixed": 27,
  "failed_rules": ["no-console"],
  "summary": "3 warnings remain (all intentional console.log statements)"
}

Perf Agent Output

{
  "endpoints_benchmarked": 5,
  "bottlenecks": [
    { "endpoint": "GET /api/reports", "p95": "3.2s",
      "cause": "N+1 query in reports controller",
      "fix": "Eager load associated users" }
  ],
  "optimization_savings": "~35% p95 reduction predicted",
  "capacity": { "current_rps": 200, "recommended": "Add read replica at 500 rps" }
}

Refactor Agent Output

{
  "files_analyzed": 34,
  "high_complexity": 5,
  "candidates": [
    { "file": "src/processors/payment.ts", "complexity": 28,
      "recommendation": "Split into: validation, calculation, notification processors" }
  ],
  "dead_code_found": 12,
  "unused_deps": 3
}

Security Agent Output

{
  "findings": [
    { "file": "src/api/users.ts", "line": 55, "severity": "P1",
      "type": "SQL injection",
      "evidence": "Raw string interpolation in query",
      "fix": "Use parameterized query" }
  ],
  "scan_details": { "endpoints": 22, "vulnerable": 3, "secure": 19 },
  "poc": "pocs/sqli-users.html"
}

Test Agent Output

{
  "tests_added": 18,
  "coverage_before": 64,
  "coverage_after": 86,
  "test_types": { "unit": 14, "integration": 3, "e2e": 1 },
  "regression_tests": 5,
  "all_passing": true
}

---

Verification Checklist

• [ ] All coding agents executed without errors
• [ ] Lint: zero errors after auto-fix; warnings justified
• [ ] Perf: P95 within threshold, bottlenecks identified with fixes
• [ ] Refactor: high-complexity files documented; dead code removed
• [ ] Security: no P1/P2 findings; P3 findings acknowledged
• [ ] Tests: coverage >= 80%; all tests passing
• [ ] Documentation: config changes, rule additions/removals recorded
• [ ] CI gate: quality pipeline integrated into CI workflow
• [ ] Cost impact: perf optimizations projected to reduce infra costs

Workflow

See the parent skill for authoritative workflow documentation.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: oyi77
• Source: oyi77/1ai-skills
• License: MIT
• Homepage: https://oyi77.github.io/1ai-skills

Install and usage instructions live in the source repository linked above.