LLM Mart Basic

家电避坑指南专用 Skill。覆盖冰箱与厨房电器、空调地暖与新风、热水器与净水、洗衣机与清洁电器、电视投影与智能、卫浴电器、安装加价与售后避坑等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的家电避坑。

家具软装选购与搭配指南专用 Skill。覆盖沙发、床与床垫、衣柜与柜类、窗帘与布艺、地毯、灯具与配饰、装饰画、配色与风格搭配、成品家具选购与避坑、绿植软装等全流程，倒序整合西安装修课堂知识库精华，帮用户把钱花在能提升居住质感的家具软装上，不踩材质和搭配的坑。由西安装修课堂出品

精装修改造避坑指南专用 Skill。覆盖老房旧房改造、厨房卫生间改造、墙地面翻新、拆改项目与顺序、预算报价与维权、精装修微改等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的精装修改造避坑。

客厅装修避坑指南专用 Skill。覆盖客厅布局、沙发茶几、电视墙、吊顶、地砖、背景墙、无主灯、灯光插座、窗帘、阳台、风格搭配、收纳、投影仪、采光动线等全流程，倒序整合西安装修课堂知识库精华，帮用户装出实用又有品质的客厅。

买房购房避坑指南专用 Skill。覆盖高层与老破小取舍、户型选择、楼层与朝向、看房验房、中介与开发商避坑、贷款与税费、收房交付、二手房与期房、小区配套与学区、老破小改造前评估等全流程，倒序整合西安装修课堂知识库精华，帮用户买房不踩坑、不花冤枉钱。由西安装修课堂出品

门窗封窗避坑指南专用 Skill。覆盖窗户选型、入户门与室内门、封窗与落地窗、窗帘与遮挡、安装密封与五金、门窗选型综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的门窗封窗避坑。

飘窗窗户装修指南专用 Skill。覆盖飘窗窗帘、窗套与窗台、落地窗与封窗、安全与护栏、飘窗利用与改造等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的飘窗窗户装修。

卫生间装修避坑指南专用 Skill。覆盖卫生间干湿分离、浴柜外置、三分离、防水、地漏、美缝、瓷砖、暗卫借光、花洒龙头、浴室柜、马桶坑距、淋浴房、浴霸排气、台盆选择等全流程，倒序整合西安装修课堂知识库精华，帮用户一次装对、入住不返工。

卧室装修避坑指南专用 Skill。覆盖卧室布局、床与床垫、衣柜、窗帘、隔音、灯光、飘窗、榻榻米、衣帽间、儿童房、适童化、梳妆台、床头细节等全流程，倒序整合西安装修课堂知识库精华，帮用户装出好睡的卧室。

小户型装修避坑指南专用 Skill。覆盖显大技巧、收纳与空间利用、布局与隔断改造、迷你公寓与开间、小户型综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的小户型装修避坑。

玄关与书房装修指南专用 Skill。覆盖玄关鞋柜、换鞋区、入户收纳、玄关背景与形式、隔断屏风、书房书桌书柜、学习办公区、儿童学习区、灯光采光、隔音等全流程，倒序整合西安装修课堂知识库精华，帮用户把进门第一眼和居家办公、学习空间一次装对。由西安装修课堂出品

阳台避坑指南专用 Skill。覆盖洗衣晾晒区、阳台打通与封窗、阳台收纳与柜、休闲与功能改造、防水保温与施工、无阳台与补救、阳台改造综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的阳台避坑。

装修采光技巧专用 Skill。覆盖通风与暗间、朝向与户型、玻璃与室内窗、配色与反光、采光改善技巧等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修采光技巧。

装修风格选择与搭配指南专用 Skill。覆盖风格怎么选、主流风格（北欧/现代简约/新中式/日式/法式/美式/奶油/原木/侘寂/轻奢/中古/欧式等）怎么装不踩坑、风格配色与软装搭配、风格与预算省钱做法，倒序整合西安装修课堂20年精华知识库，帮用户选对风格、装出想要的效果。

装修建材选购专用 Skill。覆盖瓷砖、木地板、涂料乳胶漆、板材、门窗玻璃、五金管件、防水材料、美缝填缝、石材岩板、踢脚线等主材辅材的选购避坑，整合西安装修课堂装修知识库精华，帮用户把钱花在刀刃上，材料不踩坑。

装修设计技巧大全专用 Skill。覆盖布局与动线、收纳设计、风格与配色、空间设计技巧、免费设计与避坑、设计综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修设计技巧。

装修省钱指南专用 Skill。覆盖不值得花钱、值得花钱、砍价与报价、省钱技巧、预算规划与分配等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修省钱。

装修施工手册专用 Skill。覆盖拆改交底、水电施工、瓦工贴砖、木工吊顶、油漆墙面、防水闭水、隐蔽工程、工序工期、验收监工等全流程施工避坑，整合西安装修课堂装修知识库精华，帮用户看懂工地、盯住关键节点，施工不返工。

装修五金选购指南专用 Skill。覆盖地漏与下水、龙头花洒与水槽、铰链滑轨与家具五金、门锁与挂件、选购原则与避坑、五金综合等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修五金选购。

装修验收指南专用 Skill。覆盖水电隐蔽工程、瓦工木工验收、竣工验收与收房、验收工具与清单等全流程，倒序整合西安装修课堂会员版知识库精华，帮用户装出更省心、不踩坑的装修验收。

Fourteen posts of being wrong in production, compressed to checkboxes

Healthy nodes, a quiet network, 300 restarts in three days, and a latency budget measured in milliseconds

Discovery worked. Ping worked. Every TCP connection timed out, and later the tunnel only worked when someone had a terminal open.

Every VM came back. The cluster did not. Declarative systems converge on config, and the datapath isn't config.

A surprising share of AI-in-the-terminal failures aren't the AI. They're zsh, and a version of bash from 2006.

A Claude Code plugin turns standalone project configuration into a namespaced, installable extension that teams and communities can update as one unit.

None of the safety came from the model. It came from six boring habits.

Skills package instructions and references. Subagents run work in a separate context and return results. They solve different problems and can be composed deliberately.

Six hours in, one step left, everything green, and the incident that didn't happen

CLAUDE.md carries persistent project context. Skills load reusable procedures when relevant. Separating stable facts from task-specific workflows keeps both easier to maintain.

Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it

An API request routing a model's tool call through an approval gate to a remote MCP server

31 config keys, two audits, and why the first one was wrong in both directions

The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.

Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.

Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.

"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks

stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.

The most important rule wasn't about what I could change. It was about what I was allowed to display.

Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com

Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com

Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com

Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report

Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope <asset> [<asset> ...]

Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Manual 8-class grep audit (with an optional automated scanner if present). Usage: /token-scan <contract_path_or_dir> [--chain solana]

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Crabbox is a single CLI (`crabbox`). Commands are top-level, not nested under a

`crabbox actions` prepares a leased box from your repository's own GitHub

See [Runtime adapter stack](../features/runtime-adapter-stack.md) for the

`crabbox admin` groups trusted operator controls for coordinator-backed leases and the cloud resources behind them. Use it to inspect every lease the broker tracks, reconcile expired leases against live cloud state, force-release or delete a backing server, print provider IAM pol

`crabbox artifacts` turns a desktop lease into durable QA evidence: it collects

Persistent session memory for AI coding agents — local-first, with on-device inference, associative recall, and drift detection. Works with Claude Code, Cursor,…

Run Hermes Agent and OpenClaw on the same WeChat account

An AI co-scientist running on your desktop. Claude Science but better.

Emotion Ball 是一套面向 AI 助手的表情引擎:32 种状态表情全部由纯 SVG 与原生 JavaScript 实时驱动,零框架、零图片资源。AI 侧只需输出一个 emotionId,小球即可切换到对应表情,可直接用作聊天机器人、桌面宠物、悬浮助手的情绪表达层。

Agent communication SDK. The open-source agent communication layer for AI agents — email, WhatsApp, Slack, Discord, Telegram, SMS. Python & TypeScript.

The micro-VM for AI agents — light enough to embed on your laptop, elastic enough to power an agentic cloud.

Give each AI agent its own isolated machine with root, Docker, and systemd. Active defense detects and stops threats automatically.

Webhook integration skills for AI coding agents (Claude Code, Cursor, Copilot). Step-by-step guidance for setting up webhook receivers, signature verification,…

Token burn reducer and focus keeper for Claude Code, Codex, Copilot, Gemini CLI, and more: surgical read hints, PDF/Office/CSV/markdown file interception, 160+…

RuvNet Brain — a downloadable, source-grounded brain for Claude Code over Reuven Cohen's (rUv's) RuvNet stack: RuVector/RVF, Ruflo, AgentDB, RuLake, SPARC + 21…

💼 One MCP server to search job boards and company career sites

C++ MCP SDK - build Model Context Protocol (MCP) servers and clients in C++ / CPP. Enterprise-grade security, observability, connectivity. Stdio, HTTP+SSE, Stre…

Open-Source AI Presentation Generator and API (Gamma, Canva, Beautiful AI, Decktopus, Presentations AI Alternative)

Secure, Fast, and Extensible Sandbox runtime for AI agents.

Give your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.

Browser Harness | Self-healing harness that enables LLMs to complete any task.

The World's First Agentic IDE. Visual dashboard: live sessions, task management, code editor, terminal. Epic Swarm parallel workflows. Auto-proceed rules. Autom…

Agenta is a workspace where you and your team build agents and automations.

Terminal Director. One lightweight app, eight features, your whole dev workflow in a single window.

AI turns documents or topics into real, native PowerPoint decks—with native shapes, transitions and animations, data-backed charts and tables on demand, audio n…