Coding

Coding Agents

Money-Making Overview

Combined ROI: A single pass through all five agents on a medium codebase (50K LOC) saves $15,000–50,000 by preventing production bugs, reducing cloud costs, and slashing maintenance overhead.

When to Use

Linter first — before every PR, after merge conflicts, when adopting new rules, migrating linters.

Perf when it hurts — app is slow, memory is growing, queries lag, infra costs too high, capacity planning.

Refactor before features — make the change easy before making the easy change. High cyclomatic complexity, duplicated code, monolithic files.

Security before deploy — every commit touching auth, payments, PII, or external APIs requires a security gate.

Test always — new features (TDD), regression tests for bugs, coverage gaps, integration tests, e2e.

When NOT to Use

• Trivial one-liner changes — just make the edit.
• Real-time human judgment — agents cannot decide product or business trade-offs.
• Agent lacks access to required tools, credentials, or data.

Combined Capabilities

                    ┌──────────────┐
                    │  Linter       │  ← Style enforcement → Convention rules
                    │  Agent        │  ← Bulk fixes → Migration
                    └──────┬───────┘
                           │ clean code
                    ┌──────┴───────┐
                    │  Perf         │  ← Profiling → Benchmarking
                    │  Agent        │  ← Bottleneck identification → Optimization
                    └──────┬───────┘
                           │ profiled
                    ┌──────┴───────┐
                    │  Refactor     │  ← Complexity reduction → Pattern extraction
                    │  Agent        │  ← Dead code removal → Modernization
                    └──────┬───────┘
                           │ restructured
                    ┌──────┴───────┐
                    │  Security     │  ← Vulnerability scan → Exploit validation
                    │  Agent        │  ← Bug bounty → POC generation
                    └──────┬───────┘
                           │ hardened
                    ┌──────┴───────┐
                    │  Test         │  ← Unit tests → Integration tests
                    │  Agent        │  ← E2E tests → Coverage enforcement
                    └──────────────┘

Gate Matrix

Concrete Action Flow

Full Quality Pipeline

# 1. LINT: Clean up before PR
agent linter-agent \
    --path "src/" \
    --config ".eslintrc.cjs" \
    --fix \
    --require "no-unused-vars, no-console"

# 2. PERF: Profile the hot path
agent perf-agent \
    --profile "GET /api/users/:id" \
    --benchmark "1000 req/s" \
    --target "p95 < 200ms" \
    --output perf-report.md

# 3. REFACTOR: Clean up before feature work
agent refactor-agent \
    --target "src/legacy/users.ts" \
    --complexity-threshold 15 \
    --remove-dead-code \
    --modernize "callbacks->async"

# 4. SECURITY: Audit before deploy
agent security-agent \
    --target "https://staging.example.com" \
    --scan "xss, sqli, ssti, ssrf" \
    --output security-report.json

# 5. TEST: Fill coverage gaps
agent test-agent \
    --path "src/services/" \
    --target-coverage 85 \
    --type "unit, integration" \
    --output coverage-report.json

Quick Bug Fix Cycle

# 1. LINT the fix area first
agent linter-agent --path "src/buggy-file.ts" --fix

# 2. REFACTOR if the code is messy
agent refactor-agent --path "src/buggy-file.ts" --complexity-threshold 10

# 3. Add regression TEST
agent test-agent \
    --bug "SESSION-123" \
    --regression \
    --path "src/buggy-file.ts"

# 4. SECURITY check the change
agent security-agent --diff "$(git diff)"

First Action in 60 Minutes

1. Run linter-agent on your entire src/ directory with --fix. This removes noise immediately.
2. Run security-agent on your staging environment or a recent diff. One quick scan surfaces the top risks.
3. Run test-agent with --coverage-report to see where you are most exposed.
4. Run perf-agent on your slowest endpoint (check your APM or logs for P99).
5. Run refactor-agent on the file with the highest churn (git blame reveals it).

Total time: ~50 min. You will walk away with: clean code, known vulnerabilities patched, coverage gaps mapped, one bottleneck fixed, and one messy file cleaned.

Real Code Examples

Python: Full Quality Gate CI Script

#!/usr/bin/env python3
"""CI quality gate: lint → perf → refactor → security → test."""

import json, subprocess, sys
from pathlib import Path

def gate(name: str, *args) -> dict:
    """Run a coding agent gate."""
    cmd = ["agent", f"{name}-agent", "--json", *args]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return json.loads(result.stdout)

def quality_pipeline(changed_files: list[str]):
    results = {}

    # Gate 1: Lint
    results["lint"] = gate("linter",
        *[f"--path={f}" for f in changed_files],
        "--fix", "--strict")
    if results["lint"].get("errors", 0) > 0:
        print("LINT FAILED — fixing...")
        sys.exit(1)

    # Gate 2: Security (lightning scan)
    results["security"] = gate("security",
        "--scan=secrets,injection",
        "--diff", subprocess.run(
            ["git", "diff", "HEAD"],
            capture_output=True, text=True).stdout)
    if any(f["severity"] in ("P1", "P2")
           for f in results["security"].get("findings", [])):
        print("SECURITY FAILED — aborting")
        sys.exit(1)

    # Gate 3: Refactor (complexity check)
    results["refactor"] = gate("refactor",
        *[f"--path={f}" for f in changed_files],
        "--complexity-threshold=12",
        "--dry-run")
    if results["refactor"].get("high_complexity", 0) > 0:
        print(f"REFACTOR: {results['refactor']['high_complexity']} complex functions")

    # Gate 4: Coverage check
    results["test"] = gate("test",
        "--coverage-only",
        "--min-coverage=80")
    if results["test"].get("coverage", 0) < 80:
        print(f"COVERAGE: {results['test']['coverage']}% — below 80%")
        sys.exit(1)

    print("All quality gates passed")
    return results

if __name__ == "__main__":
    files = sys.argv[1:] if len(sys.argv) > 1 else ["src/"]
    quality_pipeline(files)

Bash: One-Shot Quality Report

#!/bin/bash
# quality-report.sh — run all 5 agents and produce a summary

DIR="${1:-src}"
REPORT="quality-report-$(date +%Y%m%d).md"

echo "# Quality Report $(date)" > "$REPORT"
echo "" >> "$REPORT"

echo "## Lint" >> "$REPORT"
agent linter-agent --path "$DIR" --report --output /tmp/lint.json
jq -r '.summary' /tmp/lint.json >> "$REPORT"

echo "## Performance" >> "$REPORT"
agent perf-agent --path "$DIR" --quick-check --output /tmp/perf.json
jq -r '.hotspots[] | "- \(.file):\(.line) — \(.message)"' /tmp/perf.json >> "$REPORT"

echo "## Refactor Candidates" >> "$REPORT"
agent refactor-agent --path "$DIR" --list-candidates --output /tmp/refactor.json
jq -r '.candidates[] | "- \(.file) — complexity \(.complexity)"' /tmp/refactor.json >> "$REPORT"

echo "## Security" >> "$REPORT"
agent security-agent --path "$DIR" --quick-scan --output /tmp/security.json
jq -r '.findings[] | "- \(.severity): \(.message)"' /tmp/security.json >> "$REPORT"

echo "## Test Coverage" >> "$REPORT"
agent test-agent --coverage-only --output /tmp/test.json
jq -r '. | "- Coverage: \(.coverage)%"' /tmp/test.json >> "$REPORT"

echo "Report written to $REPORT"

Anti-Rationalization Table

Output Format

Linter Agent Output

{
  "files_scanned": 142,
  "errors": 0,
  "warnings": 3,
  "auto_fixed": 27,
  "failed_rules": ["no-console"],
  "summary": "3 warnings remain (all intentional console.log statements)"
}

Perf Agent Output

{
  "endpoints_benchmarked": 5,
  "bottlenecks": [
    { "endpoint": "GET /api/reports", "p95": "3.2s",
      "cause": "N+1 query in reports controller",
      "fix": "Eager load associated users" }
  ],
  "optimization_savings": "~35% p95 reduction predicted",
  "capacity": { "current_rps": 200, "recommended": "Add read replica at 500 rps" }
}

Refactor Agent Output

{
  "files_analyzed": 34,
  "high_complexity": 5,
  "candidates": [
    { "file": "src/processors/payment.ts", "complexity": 28,
      "recommendation": "Split into: validation, calculation, notification processors" }
  ],
  "dead_code_found": 12,
  "unused_deps": 3
}

Security Agent Output

{
  "findings": [
    { "file": "src/api/users.ts", "line": 55, "severity": "P1",
      "type": "SQL injection",
      "evidence": "Raw string interpolation in query",
      "fix": "Use parameterized query" }
  ],
  "scan_details": { "endpoints": 22, "vulnerable": 3, "secure": 19 },
  "poc": "pocs/sqli-users.html"
}

Test Agent Output

{
  "tests_added": 18,
  "coverage_before": 64,
  "coverage_after": 86,
  "test_types": { "unit": 14, "integration": 3, "e2e": 1 },
  "regression_tests": 5,
  "all_passing": true
}

Verification Checklist

• All coding agents executed without errors
• Lint: zero errors after auto-fix; warnings justified
• Perf: P95 within threshold, bottlenecks identified with fixes
• Refactor: high-complexity files documented; dead code removed
• Security: no P1/P2 findings; P3 findings acknowledged
• Tests: coverage >= 80%; all tests passing
• Documentation: config changes, rule additions/removals recorded
• CI gate: quality pipeline integrated into CI workflow
• Cost impact: perf optimizations projected to reduce infra costs

Workflow

See the parent skill for authoritative workflow documentation.