LLM Mart Basic

Find footguns in code that already exists: swappable arguments, silent fallbacks, unguarded deletes, signatures that are easy to misuse. Use when someone asks "what could bite us here", "what is easy to misuse", "poka-yoke this repo", or wants a diff or PR reviewed for ways to ge

Multi-tenant isolation, IDOR and row-level security. Use to find every path where one tenant could read or write another tenant data: "we forgot to filter by org_id", "can users see each other data", "audit these endpoints for cross-tenant leaks", "make an unscoped query impossib

Pipelines, warehouses, dbt models and metrics, where failure is silently wrong numbers rather than a crash. Use when "the dashboard is wrong", "the numbers do not match", "add data quality checks", "safe backfill", or an upstream schema change broke a join. Covers freshness, row-

Design APIs, schemas, types and state machines so misuse cannot be expressed. Use when writing a new interface and someone asks "what should the types look like", "make invalid states unrepresentable", "so callers cannot screw it up", or wants illegal state transitions rejected.

Pre-commit hooks, CI gates, lint rules, database constraints and branch protection. Use when a rule needs enforcing rather than documenting: "set up enforcement", "unformatted or untyped code must not get merged", "gate this in CI", "we agreed to X and people still do not", "stop

AI features you ship to users: structured output, tool schemas, prompt injection, evals. Use when "the model returns bad JSON", "it hallucinates", "stop it calling the wrong tool", "add evals", or an LLM feature can trigger refunds, emails or writes. Covers schema-constrained out

Deploys, schema migrations, rollback and infrastructure. Use when "can I ship this on Friday", "this migration is scary", "what is the blast radius", "prevent accidental deletion of the database", or a change drops a column. Covers expand/contract, canary rollout, kill switches,

Mistake-proofing for anything: code, config, a schema, a process, a runbook, a form. Use when someone says "poka-yoke this", "mistake-proof it", "make this harder to get wrong", or runs /poka-yoke with no mode named. Applies Shigeo Shingo's method directly to any subject, and han

Turn a bug, outage or repeated mistake into a device that makes the whole class impossible. Use when something already broke: "make sure this never happens again", "this is the third time", "postmortem", "how did this get through". Root-causes to the missing constraint, then swee

Forms, destructive actions and flows users get wrong. Use when "users keep deleting the wrong thing", "add a confirmation dialog", "this flow is error-prone", or building a delete, bulk action, checkout or settings page. Covers undo over confirmation, type-to-confirm, safe defaul

Reviewing code that already exists for structural problems: responsibilities that have drifted together, names that no longer describe what they name, dependencies pointing the wrong way, and duplication that has hardened into divergence.

Permission and access-control code. Structure, clarity and testability of authorisation logic: where the decision lives, how it is named, and keeping it separable from the code that acts on it.

Software quality review and design guidance for any code: naming, cohesion, coupling, duplication, function size, dependency direction, and testability. Use when someone asks to improve, review, refactor, or design code, or asks what good structure looks like here. Routes to the

Designing a new interface, module, schema or type. Naming, cohesion, parameter shape, dependency direction and testability, decided before the thing has callers.

Something broke. Deciding what to change in the code so the class of problem is less likely, and writing it up so the next person understands the reasoning rather than just the outcome.

Forms, flows and screens. Structure, naming and clarity of user-facing interaction code: component boundaries, state ownership, and keeping presentation separable from the rules behind it.

Reviewing existing code for unchecked inputs, unguarded dereferences, unhandled failure paths, swallowed exceptions, missing timeouts and absent limits: the places where an unexpected value becomes an unhandled failure.

Defensive programming for any code: validating inputs at every boundary, checking for null and absent values, supplying safe fallbacks, catching and logging exceptions, and degrading gracefully rather than failing. Use when someone asks to make code robust, resilient, safer, or h

Designing a new interface, module, schema or type together with its validation and failure behaviour: what each input accepts, what happens when it does not, and what the caller gets back when something goes wrong.

微信读书读后感写作助手。帮助用户基于某本书或某个章节，生成一篇带有个人见解的读后感，正文严格控制原文摘抄，附录完整保留所有划线内容及即时感想。底层依赖 weread-skills（微信读书原子 API）和 huashu-weread-advisor（微信读书高阶顾问工作流）。当用户说「写一篇读后感」「帮我整理笔记写感想」「这本书/这章我想写篇公众号文章」时触发。

Fourteen posts of being wrong in production, compressed to checkboxes

Healthy nodes, a quiet network, 300 restarts in three days, and a latency budget measured in milliseconds

Discovery worked. Ping worked. Every TCP connection timed out, and later the tunnel only worked when someone had a terminal open.

Every VM came back. The cluster did not. Declarative systems converge on config, and the datapath isn't config.

A surprising share of AI-in-the-terminal failures aren't the AI. They're zsh, and a version of bash from 2006.

A Claude Code plugin turns standalone project configuration into a namespaced, installable extension that teams and communities can update as one unit.

None of the safety came from the model. It came from six boring habits.

Skills package instructions and references. Subagents run work in a separate context and return results. They solve different problems and can be composed deliberately.

Six hours in, one step left, everything green, and the incident that didn't happen

CLAUDE.md carries persistent project context. Skills load reusable procedures when relevant. Separating stable facts from task-specific workflows keeps both easier to maintain.

Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it

An API request routing a model's tool call through an approval gate to a remote MCP server

31 config keys, two audits, and why the first one was wrong in both directions

The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.

Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.

Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.

"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks

stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.

The most important rule wasn't about what I could change. It was about what I was allowed to display.

Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.

Design a complete multi-agent workflow from a natural language description, selecting the right orchestration pattern

Follow RED-GREEN-REFACTOR cycle approach for test-driven development

Implement secure user authentication system

Generate and maintain project changelog

Setup mutation testing for code quality

Add and configure new project dependencies

Setup application performance monitoring

Implement property-based testing framework

Add a new entry to the project's CHANGELOG.md file following Keep a Changelog format

Preflight a repo before AI agents change files

Display all available development tools

Review and improve system architecture

Explore architectural decisions through systematic scenario analysis with trade-off evaluation and future-proofing assessment.

Enable bidirectional GitHub-Linear synchronization

Interview to flesh out a plan/spec

Systematic workflow for fixing bugs including issue creation, branch management, and PR submission

Bulk import GitHub issues to Linear

Explore multiple business timeline scenarios with constraint validation and decision optimization.

Demo changelog automation features

Perform comprehensive analysis of $ARGUMENTS to identify code quality issues, security vulnerabilities, and optimization opportunities.

🤖 MateClaw — Your second brain with Multi-Agent Orchestration, MCP Protocol, Skills & Memory, Dream, and Multi-Channel Support. Built on Spring AI Alibaba.

Vibe-Research: Your Personal Trading Research Agent · A股/美股/港股 的个人投研 Agent：每日复盘、资讯雷达、个股数据、板块中心、我的持仓、研究记录、回测。Vibe-Research 把数据和功能配齐，由你自己的 Agent 驱动投资研究。基于开源的 Code…

Wayland - The AI Agent That Perceives. Reasons. Acts. Evolves.

Observability and enforcement for AI agent harnesses. Capture every run and runtime reliability with policy enforcement. 40 built-in policies, a local dashboar…

Turn your Solana Seeker (or any Android phone) into a 24/7 personal AI agent

A curated collection of offensive, defensive and AI/LLM security tools.

AI agent 通用任务治理框架：对齐目标与事实，规划和调度能力，守住授权与风险边界，治理任务执行到真实验收与交付。Governance framework for evidence-driven planning, orchestration, and verified delivery.

Open-source (Apache-2.0) PDF takeoff for construction & flooring — the first engine an AI agent drives natively over MCP, not bolted on. One-click room detectio…

Stop degrading your model's reasoning. A minimal, zero-config AI coding agent. Enforced ephemeral subagents keep context pure. From tiny local models up to Sol,…

实习.skill — 双非也能拿大厂 offer。帮你改简历、抠面经、准备面试，把真实背景翻译成面试官想要的样子。

专门为 agent 打造的 agent 搜索工具，具备多语言搜索能力，覆盖中文/英文/学术/代码/购物/金融/新闻/百科。

Local-first AI agent workspace for multi-agent collaboration, agent orchestration, scoped permissions, evidence-aware runs, and human-in-the-loop decisions.

Keyboard-first desktop Kanban workspace for AI coding agents with embedded terminals, git worktrees, and hook-driven task tracking.

Claude Code Prompt Mechanism Visualizer — Electron desktop app

Multi-repo semantic code search MCP server in Rust — hybrid vector + BM25 retrieval, tree-sitter AST chunking, fully offline. For OpenCode, Claude Code, Cursor,…

One-ink editorial print image skill — warm paper, halftone photography, active negative space, and restrained typography.

US stock market data for AI coding assistants — zero-auth, official sources. CBOE options with full Greeks + 0DTE flow, FINRA market-wide short volume, SEC EDGA…

AI-powered Werewolf (Mafia) social deduction game where every player is controlled by top LLMs like DeepSeek, Qwen, Gemini, and more

A股全栈数据工具包 · 十一层架构 · 54端点 · 19数据源 · 零鉴权 | Full-stack China A-share data toolkit for AI agents — 11 layers, 54 endpoints, 19 sources, zero-auth

Agentic desktop GUI client for Elasticsearch, OpenSearch, DynamoDB, MongoDB & EasySearch. Natural language queries, visual management, and monitoring. Privacy-f…