macOS Performance Triage (Apple Silicon)

When to Use This Skill

Use this skill when...	Use something else when...
The Mac is hot/loud/slow and you need to find what's driving it	The machine actually hung or panicked — use `macos-incident-postmortem`
`WindowServer` shows high CPU/GPU and you need to attribute it to a client app	A security extension (Kandji ESF, XProtect, an EDR) is the hot process — use `endpoint-security-cpu`
One ordinary app (Chrome/Electron, a renderer, a game) is pegging CPU or GPU	`launchservicesd` is the hot process — use `launchservices-health`
You want a flame graph / deep profile of a specific process	A disk reads near-full or you're reclaiming space — use `macos-disk-usage`
You want a repeatable "what's hot right now" snapshot	`syspolicyd`/`trustd`/`tccd`/`auditd` are all elevated together (exec storm) — use `endpoint-security-cpu`
You need to attribute a live thermal/CPU/GPU load right now	You want a repeatable baseline scored PASS/WARN/FAIL against thresholds — use `macos-performance-benchmark`

macOS-only. powermetrics, sample, spindump, Instruments, and the Apple-Silicon power counters macmon reads are Darwin-specific.