LLM Mart Basic

卫生间装修避坑指南专用 Skill。覆盖卫生间干湿分离、浴柜外置、三分离、防水、地漏、美缝、瓷砖、暗卫借光、花洒龙头、浴室柜、马桶坑距、淋浴房、浴霸排气、台盆选择等全流程，倒序整合西安装修课堂知识库精华，帮用户一次装对、入住不返工。

卧室装修避坑指南专用 Skill。覆盖卧室布局、床与床垫、衣柜、窗帘、隔音、灯光、飘窗、榻榻米、衣帽间、儿童房、适童化、梳妆台、床头细节等全流程，倒序整合西安装修课堂知识库精华，帮用户装出好睡的卧室。

小户型装修避坑指南专用 Skill。覆盖显大技巧、收纳与空间利用、布局与隔断改造、迷你公寓与开间、小户型综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的小户型装修避坑。

玄关与书房装修指南专用 Skill。覆盖玄关鞋柜、换鞋区、入户收纳、玄关背景与形式、隔断屏风、书房书桌书柜、学习办公区、儿童学习区、灯光采光、隔音等全流程，倒序整合西安装修课堂知识库精华，帮用户把进门第一眼和居家办公、学习空间一次装对。由西安装修课堂出品

阳台避坑指南专用 Skill。覆盖洗衣晾晒区、阳台打通与封窗、阳台收纳与柜、休闲与功能改造、防水保温与施工、无阳台与补救、阳台改造综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的阳台避坑。

装修采光技巧专用 Skill。覆盖通风与暗间、朝向与户型、玻璃与室内窗、配色与反光、采光改善技巧等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修采光技巧。

装修风格选择与搭配指南专用 Skill。覆盖风格怎么选、主流风格（北欧/现代简约/新中式/日式/法式/美式/奶油/原木/侘寂/轻奢/中古/欧式等）怎么装不踩坑、风格配色与软装搭配、风格与预算省钱做法，倒序整合西安装修课堂20年精华知识库，帮用户选对风格、装出想要的效果。

装修建材选购专用 Skill。覆盖瓷砖、木地板、涂料乳胶漆、板材、门窗玻璃、五金管件、防水材料、美缝填缝、石材岩板、踢脚线等主材辅材的选购避坑，整合西安装修课堂装修知识库精华，帮用户把钱花在刀刃上，材料不踩坑。

装修设计技巧大全专用 Skill。覆盖布局与动线、收纳设计、风格与配色、空间设计技巧、免费设计与避坑、设计综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修设计技巧。

装修省钱指南专用 Skill。覆盖不值得花钱、值得花钱、砍价与报价、省钱技巧、预算规划与分配等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修省钱。

装修施工手册专用 Skill。覆盖拆改交底、水电施工、瓦工贴砖、木工吊顶、油漆墙面、防水闭水、隐蔽工程、工序工期、验收监工等全流程施工避坑，整合西安装修课堂装修知识库精华，帮用户看懂工地、盯住关键节点，施工不返工。

装修五金选购指南专用 Skill。覆盖地漏与下水、龙头花洒与水槽、铰链滑轨与家具五金、门锁与挂件、选购原则与避坑、五金综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修五金选购。

装修验收指南专用 Skill。覆盖水电隐蔽工程、瓦工木工验收、竣工验收与收房、验收工具与清单等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修验收。

【全屋定制业主必看】你正在做全屋定制吗？不知道板材怎么选、怕被套餐套路、担心增项加钱、不知道怎么验收？这个Skill内置装修课堂知识库，直接回答你的问题——问板材、问计价、问套餐、问商家选择、问安装验收，全部覆盖。适合正在做全屋定制功课、准备签约或已经下定的业主。

【收纳储物必看】装修前不会规划收纳，入住半年家变仓库？这个 Skill 内置装修课堂会员版「📦家居收纳储物方法」152篇原创知识库，专门讲收纳储物——收纳是家的骨架、柜子不是越多越好、收纳本质是把东西藏起来、收纳加勤快缺一不可。问玄关鞋柜怎么装、问厨房9个收纳位置、问衣柜衣帽间怎么做、问小户型怎么榨干每1平米、问收纳避坑和鸡肋神器，全部覆盖。适合正在装修、准备收纳规划、家里东西多总是乱、想做满墙柜/通顶柜/800库的业主。

【老房改造业主必看】你家的房子是老房、旧房、二手房吗？担心拆除被坑、水电要不要全换、承重墙不敢动、费用比新房贵太多？这个Skill内置装修课堂知识库，直接回答你的问题——问拆除、问水电、问费用、问结构安全、问厨卫翻新、问精装房怎么改，全部覆盖。适合正在考虑老房翻新、二手房装修、精装房改造的业主。

【选装修公司必看】你正在找装修公司吗？不知道怎么选、怕被坑、担心中途加钱、想提前排查风险？这个Skill内置专业装修知识体系（5篇核心参考文献），直接教你筛选方法——问怎么选公司、问哪些公司不能选、问报价单怎么看、问合同怎么签、问中途加钱怎么办，全部覆盖。适合正在选装修公司、拿到报价单不知怎么看、担心被坑的业主。

本Skill内置从学到装｜装修课堂知识库，专门帮业主审核装修合同、识别预算陷阱、防范定金套路、避免增项偷项、看懂报价单、判断售后保障。适合准备签装修合同、拿到报价单不知怎么看、被要求交定金、遇到中途加钱的等场景使用。触发场景包括"装修合同怎么签""报价单怎么看""定金能退吗""套餐能签吗""装修增项怎么办""怎么选装修公司"等涉及装修合同审核的所有问题。

【装修最怕加钱必看】你担心装修中途不断加钱吗？报价单看不懂、增项防不住、水电开工后翻倍、拆除冒出各种刺客？这个Skill专治各种加钱套路——问增项、问加钱、问报价单、问隐形消费、问偷项漏项、问预算超了，全部覆盖。适合拿到报价单、准备签合同、担心中途被加价的业主。

【拿到报价单必看】你拿到装修报价单了吗？看不懂、怕被坑、不知道价格合不合理？这个Skill内置装修课堂知识库，直接帮你审核报价单——问报价单怎么看、问预算陷阱、问单价猫腻、问隐形消费、问水电估价、问半包全包区别、问厨卫费用，全部覆盖。适合拿到报价单不知怎么看、比较多家报价不知怎么选、被低价吸引担心有坑的业主。

Fourteen posts of being wrong in production, compressed to checkboxes

Healthy nodes, a quiet network, 300 restarts in three days, and a latency budget measured in milliseconds

Discovery worked. Ping worked. Every TCP connection timed out, and later the tunnel only worked when someone had a terminal open.

Every VM came back. The cluster did not. Declarative systems converge on config, and the datapath isn't config.

A surprising share of AI-in-the-terminal failures aren't the AI. They're zsh, and a version of bash from 2006.

A Claude Code plugin turns standalone project configuration into a namespaced, installable extension that teams and communities can update as one unit.

None of the safety came from the model. It came from six boring habits.

Skills package instructions and references. Subagents run work in a separate context and return results. They solve different problems and can be composed deliberately.

Six hours in, one step left, everything green, and the incident that didn't happen

CLAUDE.md carries persistent project context. Skills load reusable procedures when relevant. Separating stable facts from task-specific workflows keeps both easier to maintain.

Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it

An API request routing a model's tool call through an approval gate to a remote MCP server

31 config keys, two audits, and why the first one was wrong in both directions

The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.

Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.

Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.

"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks

stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.

The most important rule wasn't about what I could change. It was about what I was allowed to display.

Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com

Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com

Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com

Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report

Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope <asset> [<asset> ...]

Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Manual 8-class grep audit (with an optional automated scanner if present). Usage: /token-scan <contract_path_or_dir> [--chain solana]

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Crabbox is a single CLI (`crabbox`). Commands are top-level, not nested under a

`crabbox actions` prepares a leased box from your repository's own GitHub

See [Runtime adapter stack](../features/runtime-adapter-stack.md) for the

`crabbox admin` groups trusted operator controls for coordinator-backed leases and the cloud resources behind them. Use it to inspect every lease the broker tracks, reconcile expired leases against live cloud state, force-release or delete a backing server, print provider IAM pol

`crabbox artifacts` turns a desktop lease into durable QA evidence: it collects

A systematic AI Agent development tutorial covering LLM agents, RAG, tool use, memory systems, multi-agent systems, LangChain, LangGraph, MCP, and agentic RL.｜从…

Convert Files / Folders / GitHub Repos Into AI / LLM-ready Files

Open-source, local-first conversational AI video editor with a professional multi-track timeline, Agent Skills, MCP integration, and Remotion rendering.

Maintainer-governed agent for evidence-backed open-source contribution proposals

A Claude Code skill by Hao (駱君昊) that learns your Facebook voice and auto-posts to FB / IG / Threads / X with a 14-day content calendar. Mega-viral validated: 8…

Local-first AI agent workspace for coding, writing, design, research, and automation — one runtime for desktop GUI and TUI.

Open-source AI Agent platform for teams. Your agents don't just chat — they read files, run code, call APIs, and deliver results.

Give your AI agent eyes for PDFs — structured text, tables, OCR, visual evidence, and page-level citations via MCP. Native Rust, local-first.

Real-world AI penetration testing engineer for authorized assessments — built-in cloud module covering AWS/Azure/GCP + Aliyun/Tencent/Huawei clouds. Built on Cl…

OpenGUI is an Android GUI agent framework for phone-use AI that can see, plan, and operate real mobile apps through the GUI.

Tinybot is a lightweight personal AI Agent that is constantly evolving

Goink 桌面 AI 小说创作助手，对话式写作 + 自动状态追踪 + 本地语义搜索。跨平台开箱即用。AI Agent Novel Generator.

Pluggable DeepSeek-colored TUI for DeepSeek Harness

Entity-level git merge driver. Resolves false conflicts git invents when independent agents edit the same file. ~95% reduction vs. line-based merge.

Percho: Minimalist desktop GUI for the Pi coding agent — the same engine as the Pi CLI, in a clean visual interface. Multi-session chat, visual tool approvals,…

Run Claude Code, Codex & Gemini in parallel on Windows & macOS — git worktree fan-out with atomic hunk adoption, approval gates, reboot-surviving sessions

A hierarchical memory framework for personalized presentation agents. Try it at memslides.com.

Real-time multimodal desktop agent evolving toward a persistent AI OS interface (0.1 α).

clawdcursor compiles whatever's on screen into one UI map — accessibility tree and OCR fused into stable, addressable elements, with a screenshot only when need…

Repeatable agentic engineering. The workflow layer that turns AI coding agents into a disciplined factory: durable specs, fresh-context workers, adversarial cro…