pARADOX

[Luke Stephens (hakluke) @hakluke]

Want your hacking agents to be more accurate, faster, and use less tokens?

Follow the same unix philosophy principles that have been around for half a century.

Let me explain 👇

https://t.co/cxsmL3rYpr

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Add 42 video editing tools to Claude Code, Cursor, any MCP clients with a full local video editor powered by FFmpeg.

cutting, captions, reframe, silence removal, aspect ratio fitting, fix loudness, platform exports, and more then it verifies its own output.

No subscriptions, No API keys.
- https://t.co/DgwRRdRjFT

[Tom Dörr @tom_doerr]

Compiles raw documents into a structured wiki using reasoning-based retrieval without relying on a vector database.

https://t.co/WU9gioojt2

[bebu @bebuu_ai]

REA's big brother just dropped.
https://t.co/18mm895kqc

[GitTrend @GitTrend0x]

AI Agent 技能圈又燃爆了 🔥

Imbad0202 的学术科研全流程、Dodaios 的 STE80 去 AI 味、ywEdAi 的可动手教学图、kunchenguid 的无头机器自动装机、bookleme 的「把书编译成技能」……全网玩家把 Agent Skills 玩成了下一代「科研流水线 + 文字整形师 + 互动课堂 + 远程运维 + 读书外挂」:

1️⃣ Imbad0202/academic-research-skills（https://t.co/Eurhthexve）

Claude Code 的学术科研技能全家桶：研究、写作、审稿、修改、定稿一条龙，装好后用 /ars-plan 通过苏格拉底式对话梳理论文结构；总星 5.6 万+，今天 Python 日榜又涨 242 星。
“从选题到定稿，一个技能包全包了”！

2️⃣ Dodaios/ste80-humanizer（https://t.co/Txh9VJfXwz）

让 AI 写的文字读起来像人写的、意思不变：先去掉维基百科《AI 写作迹象》里的 26 种痕迹，再按 Karpathy 的 STE80 思路，把句子改写到「八成像」航空维修手册的简化英语。
“去掉 AI 腔，只留干货”！

3️⃣ ywEdAi/teachable-figures（https://t.co/L5pQhMxsDm）

把一节课的结论变成学生能动手的实验图：先预测结果、改变原因、读出效果，再解释新情况；带渲染示例和校验工具，Claude Code、Codex 都能装。
“看懂不算会，动手试过才算”！

4️⃣ kunchenguid/headless（https://t.co/M6WSkLOn1a）

通过 SSH 一步步把 Mac、Linux 或 Windows 机器配成无人值守：永不休眠、重启自动登录、只认 SSH 密钥，可选加入 Tailscale，管理员密码始终留在你手里。
“角落里的 Mac mini，自己把自己装好了”！

5️⃣ bookleme/bookleme（https://t.co/tPNBN8gBdh）

读了么：把一本书编译成可安装的 Agent 技能，抽出作者的提问顺序、判断条件和证据规则，从「读过」变成「会用」。
“书里最值钱的，是作者的工作方式”！

[Shlcy @CY160909]

一个给 Skill 验货的开源工具。

现在 Skill 太多了，但真正有用的又有多少？

NVIDIA 直接做了个开源项目 SkillEvaluator，专门测试 Skill 到底有没有用。

它会让同一个 Agent 完成同一组任务：

→ 一次不加载 Skill

→ 一次加载 Skill

然后对比任务正确性、完成效果、执行效率和 Token 消耗，看看这个 Skill 究竟带来了多少提升，有没有拖后腿。

NVIDIA 官方测试了 300 多个 Verified Skills，正确性平均得分从 46 提升到 87（满分 100）。

除了测试实际效果，我还拿它给自己做的 Skill 做了质量检查。

GitHub：https://t.co/pIGRFQsddk

入门教程：https://t.co/0YcrhunNKC

[Shlcy @CY160909]

把跑通的任务，自动沉淀成 Skill。

AutoHarness 这个开源插件，可以从 Claude Code 的会话中提炼经验，自动生成可复用的 Skills。

而且它不只会生成，还会自己管理：

→ 遇到相似的 Skills，尝试合并去重
→ 工作方法有变化，更新已有的 Skills
→ 长期用不到的，自动归档，需要时还能恢复

你自己手写的 Skills 也会受到保护，不会被它随意修改。

安装后正常使用，达到触发条件就会自动整理。也可以直接输入 /learn直接触发。

我已经丢给Codex让他帮我fork成Codex版了。

开源地址：https://t.co/0E5YxV4wva

[sharpeye @sharpeye_wnl]

spent the last two days in diving deep about agentic memory

these are few good resources you can start with
https://t.co/ej8lGmpWQJ
https://t.co/9t6BI22Mv0
https://t.co/YscglbxbT1

[zack0x01 @zack0x01_]

for anyone who is intrested in browser hacking here is an awesome talk by @PinkDraconian :
https://t.co/15WGy3osBY

[Daniel San @dani_avila7]

Another skill I recommend and use quite often is senior-frontend for Claude Code

(Save this post to use it later in your projects)

It has over 31K downloads and helps Claude improve frontend

Here’s what it does:

- Reads your project before writing code

- Handles loading, empty, error, and edge-case states

- Uses semantic HTML and accessibility best practices

- Checks responsive layouts down to 375px

- Uses Playwright to verify the UI in a real browser

- Reports what was tested and what couldn’t be verified

I tested it with Sonnet 5.5. Browser verification went from 0/8 without the skill to 10/10 with it

Execution takes about 3x longer, but it catches details that are easy to miss

Install:
npx claude-code-templates@latest --skill development/senior-frontend

https://t.co/alptigzC1z

[nisedo @nisedo]

Over the last few months I burned an insane amount of tokens testing every AI auditing technique and prompt I could think of and here are 5 that actually work (from my @summit_defi talk) https://t.co/uhy5UNnsIz

[pARADOX @ErragraguiA]

@mdp_sec Damn really nice tnx really

[Hacking Team @HackingTeam77]

🔥 Top XSS Tools Every Ethical Hacker Must Know
🔎 Real-world, open-source tools for discovering and exploiting XSS vulnerabilities.

1. XSStrike – (Smart XSS scanner)
https://t.co/6P7nWdmJYq
2. DalFox – (Fast and modern)
https://t.co/dnEvmgB4lD
3. OWASP ZAP – (Beginner-friendly GUI)
https://t.co/DDos74ebwd
4. BeEF – (Post-XSS control)
https://t.co/CF9UlQU5Kv
5. XSS Hunter – (Blind XSS detector)
https://t.co/tH40hiGh8i
6. XSSer – (Fuzzing brute-force tool)
https://t.co/9LsFPOKoFV
7. KXSS – (Reflection recon)
https://t.co/lt9OoqAaLz
8. PwnXSS – (Simple Python scanner)
https://t.co/wp0snodmDZ
9. FinDOM-XSS – (DOM XSS finder)
https://t.co/9p6heVBiZD
10. XSpear – (Ruby-based hybrid)
https://t.co/AHY6dqxh4R

[Shoumya Vishwakarma @Shoumya23]

🎬 Create AI videos with Claude Code & Codex!

Givemotion lets AI write animations, preview, debug, and render MP4s. Refine everything using simple text prompts.

GitHub: https://t.co/3q9s1fuSPn

[Ren @Ryrenz]

🖌️ 真好用，handraw-style 给 AI 生图备好了 365 种画风和 170 种排版，挑个编号就能出一张风格统一的配图。

handraw-style 9 月初才建仓，GitHub 上已经 7200+ star，被 fork 了 800 多次。

以前给文章配图，最费劲的是写提示词：想要手绘感，写半天出来的图风格还忽东忽西，一篇文章的几张图像是几个人画的。handraw-style 把画风编成号，排版覆盖社媒卡、信息图、漫画分镜、电商图，再配 36 种单色主题色，一组合就是一段中英双语提示词。

懒得挑也行，不报编号它会自动推荐风格和颜色，还说清楚为什么这么配。写长文时它能规划 2 到 5 个配图点位，全篇锁定同一种画风和主题色，配完直接回填进 Markdown。首发适配 gpt-image-2，Midjourney、Flux 这些模型用参考图兜底。

写完文章，再也不用为配图发愁了。

GitHub：https://t.co/s0ZghQA9Ca

[Aman @beingamanFF]

Gonna read these blogs around agentic memory and context management, evaluation of retrieval systems and memory layers, will post an update by night UwU:

1. Anthropic's guide on agent memory https://t.co/LAJY6YBTUC
2. Langchain docs on memory: https://t.co/iMSVwpBImh
3. Late chunking from @JinaAI_ and @weaviate_io https://t.co/Gu1lZPaVJQ, https://t.co/yY5UC03FWm and https://t.co/A24qAH2yrC, https://t.co/znnqYTkjp6
4. See how needle in the hay datasets are structured for agentic retrieval benchmarking

[Akshay 🚀 @akshay_pachaar]

Stanford researchers did it again.

They just built the agent-native version of Git.

When an agent works on a longer task, the run builds up a lot of state.

This includes files edited/created, a dev server, a database, installed packages, KV cache, etc.

Say the agent is at step 10 and makes a mistake, maybe it misreads a traceback and rewrites a file that was actually fine.

The tests start failing, and the run goes off track, although everything through step eight was correct.

By default, the agent just tries to fix it, which creates more edits and tool calls. This burns more tokens and grows the context.

The other options are a person stepping in to redirect it or restarting the whole run from step one.

That's wasteful, because it pays for every model/tool call again and re-prefills the context. Moreover, since an agent's run is non-deterministic, it doesn't reproduce the same early steps anyway.

The reason it's hard to just jump back exactly to a previous correct step and resume from there is that the trajectory is only a message log.

It records what the agent said and which tools it called, but not the live state underneath.

That state includes things like memory, open file handles, child processes, installed packages, /tmp, and KV cache. None of that is in the log.

Git can version the files, but it doesn't snapshot the running process or the KV cache. Checking out step eight moves the files back, but the process is still sitting in step-ten memory with a cold cache.

Shepherd is a runtime layer by Stanford that records the run as a trace of typed events rather than a flat log.

Each agent-environment interaction becomes a commit, similar to Git, but it tracks the live run.

Its commit includes the agent process and the filesystem together, copy-on-write, so a branch carries the actual state and not just the files.

Going back to a previous step is then a single call that forks from that commit and continues from the exact state.

The copy-on-write fork is roughly five times faster than docker commit, and because the prompt prefix through step eight is unchanged, the KV cache is reused over 95% on replay, so early steps aren't reprocessed again.

Once the run can be forked, a meta-agent can sit on top and operate it. It watches the trace and reverts as soon as it looks wrong, before the bad write is committed.

In practice, it's just Python calling fork, replay, and revert on the trace, rather than a separate control plane wired into the harness.

Not everything is reversible though.

Files and sandbox changes undo themselves, but a database write has no automatic undo, so it needs a matching undo step set up in advance.

Something external, like a sent email or a real charge, can't be undone, so the supervisor's job there is to catch it before it fires.

They tested this on a few public benchmarks. On CooperBench, where two agents work on the same codebase, adding a live supervisor took the pair-coding pass rate from 28.8% to 54.7%.

It's still early and labeled alpha. The benefit mostly shows up when a run gets branched a lot over a heavy sandbox state, which is exactly where restarting wastes the most tokens and time.

If Git was made to make file changes reversible, Shepherd is trying to do the same thing for a live agent run.

Shepherd Repo: https://t.co/uUIS57te6g

(don't forget to star it ⭐ )

That said, Shepherd reverts a bad step inside a run. The harness around it, the prompts, tools, and checks the supervisor relies on, still drifts across runs as models and dependencies change.

I wrote about making that harness repair itself, where a failing trace gets diagnosed, the fix is verified against the exact input that failed, and the failure is locked as a regression test so it can't recur. all of this is done using @Cometml's open-source project Opik.

The article is quoted below.

[Shlcy @CY160909]

有人把1000 个 YouTube 教程，打包成了一套 AI Skills。

这个开源项目叫 Creator Generalist。

它能让 AI：

→ 用 Blender 制作 3D 模型和角色动画
→ 生成机械结构拆解、运转演示
→ 制作动态地图、时间轴和数据动画
→ 自动预览画面、检查问题并修改

我觉得这个思路很有意思，把视频教程直接可以变成Skill来使用。

开源地址：
https://t.co/LDLKh0g15C

[Vadym Kazulkin @VKazulkin]

"Building your AI vulnerability harness, Part 1".
How to close the gap between detection and action. We built a three-layer pipeline that takes raw scanner findings and narrows them to a small, prioritized set with documented evidence of exploitability.
https://t.co/g6phqyWUqx

[pARADOX @ErragraguiA]

@hetmehtaa I am