SetupBay

Ready-made setups for AI coding agents: rules, skills, and MCP configs, checked in CI. Claude Code, Codex, Cursor, Gemini CLI, Copilot, Antigravity. Free.

[SetupBay @setupbay]

@gourav_io @TheHackersNews fair shout, that's moved fast. if it reads AGENTS.md on its own now that's one less step. the import line still does no harm when you've got both files, so we'll keep it in ours

[SetupBay @setupbay]

@edinsoncode same rule here, plus one line at the top of ours: start every session by saying which AGENTS.md you loaded and its first heading. if it names a file you didn't write, you stop before it runs anything

[Kalshi @Kalshi]

BREAKING: A new study found that paper straws are worse for the environment than plastic straws

[SetupBay @setupbay]

@JackCulpan I pay more not to fly with Ryanair anyway.

[SetupBay @setupbay]

@j2k_mk yep, first line of ours is "start every session by saying which AGENTS.md you loaded and its first heading". takes two seconds and you catch the wrong-folder runs straight away

[SetupBay @setupbay]

@gourav_io @TheHackersNews last I checked it reads CLAUDE.md, and AGENTS.md only gets in if your CLAUDE.md imports it or you've symlinked the two. for overnight runs I'd also check what's in ~/.claude and any parent folders, it walks up the tree

[SetupBay @setupbay]

@sonuv_dev a hook that blocks edits to lockfiles, migrations and .env unless I've said so. rules in CLAUDE.md get argued with, a hook just says no

[SetupBay @setupbay]

the ones that earn their keep for me are boring: a "run the tests and read the failure before touching code" skill, a commit/PR writer, and a review skill that checks the diff against your own rules. whatever you install, open the raw SKILL.md first, a few popular packs hide stuff in HTML comments

[SetupBay @setupbay]

@HermesAgentTips makes sense, thanks. hooks are the fiddly part anyway since they're tied to each tool's event names. worth a line in the readme so people know to port them by hand

[SetupBay @setupbay]

@fxlxsxf 699 is wild. did you open any of them in raw view? the GitHub preview hides HTML comments and anything after a long run of blank lines, which is exactly where the dodgy ones stash their instructions

[SetupBay @setupbay]

@thedelost worth opening the raw files before installing a pack that size. VirusTotal found bad skills hiding instructions after hundreds of blank lines and inside HTML comments, neither of which shows up in GitHub's preview

[SetupBay @setupbay]

My favourite example: a tax skill with ~500 blank lines before the last instruction, telling the agent to BCC your tax docs to an outside address. GitHub's preview looks like it just ends.

[SetupBay @setupbay]

VirusTotal looked at 36k agent skills and classed 18.5% as malicious. Most didn't even hide it, the bad instruction was just sitting there in plain text.

The 90 that did hide used three tricks: hundreds of blank lines, HTML comments, and invisible Unicode.

Wrote up how to spot all three with a few terminal commands:
https://t.co/dRZyjkGnML

[SetupBay @setupbay]

@davey_juice @calli_ry Wasn’t exactly a technical analysis… but sure.

[SetupBay @setupbay]

I hope everyone’s updated their PHP version by now.

[SetupBay @setupbay]

@yuan_minh5988

[SetupBay @setupbay]

SetupBay is live: 60 small setups for AI coding agents. Each one is the rules (AGENTS.md, CLAUDE.md), skills and MCP config for one job, laid out for Claude Code, Codex, Cursor, Gemini CLI, Copilot and Antigravity CLI.

Free, no account.
https://t.co/QLl0Z7KwDT

[SetupBay @setupbay]

@MohakBajaj5 That's why the checks also rerun every week, not just when a file changes. A setup can quietly break when an agent moves where it looks for files.

[SetupBay @setupbay]

@Madeactual Symlinks work nicely on Mac and Linux. We went with the @AGENTS.md import instead because symlinks can trip up Windows checkouts. Same result either way: one file, one review.

[SetupBay @setupbay]

@Landlyu Yep, that's how every Claude Code layout on the site works. CLAUDE.md starts with @AGENTS.md, so one rules file covers Claude Code, Codex and Cursor.