Performance, load, and reliability (SLO/SRE) planning for production readiness. Use when defining service level objectives, load characterization, capacity, latency budgets, stress/soak/spike test plans, false-positive baselines, and reliability targets. USE FOR: SLO/SLA definition, load testing plan, performance budget, capacity planning, reliability/SRE backlog, latency targets, error-budget policy. DO NOT USE FOR: executing load tests (use Azure Load Testing tooling), security threat modeling, RAI assessment, privacy/compliance planning, or authoring/restating PRD requirements (cite the PRD's existing NFR/FR ids instead).
npx skills add https://github.com/microsoft/hve-core --skill performance-slo-planner
Turn vague "it should be fast and reliable" expectations into measurable SLIs, SLOs, a load model, a test matrix, and a reliability backlog for production readiness. Pairs with Azure Load Testing tooling for execution. This skill plans; it does not run the tests.
Gather what exists; flag what is missing as an assumption to validate.
[ASSUMPTION] for tuning..copilot-tracking/performance-plans/<date>-performance-slo-plan.md using the Output Format.# Performance & SLO Plan: <app>
## SLOs
| SLI | Journey | Target | Window | Error budget | Source |
|-------------|-----------------|------------------|----------------|--------------|------------------------|
| p95 latency | dispatch action | ≤ 60s end-to-end | 28-day rolling | 1% | NFR-123 / [ASSUMPTION] |
## Load model
| Profile | Concurrency / rate | Duration | Purpose |
|---------------------|--------------------|----------|----------|
| Steady | ... | ... | baseline |
| Peak / Spike / Soak | ... | ... | ... |
## Test matrix
| Test | Profile | Journeys | Pass threshold | Env |
|------|---------|----------|----------------|-----|
## Observability hooks
- <metric/trace needed to measure each SLI>
## Backlog
1. <item>: priority, depends-on, SLO it protects
> [!CAUTION]
> This plan is an assistive artifact and does not replace professional performance, reliability, or SRE review. Validate SLO targets, error budgets, and rollback triggers with the owning team before acting on them.
[ASSUMPTION] for agency/environment tuning.This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
Take microsoft/performance-slo-planner from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.