Full Byte Developer

Add drawing, diagram and film skills to your agent

Thu, 05 Nov 2026 00:00:00 GMT

Anatomy, Diagram Design and Lemo Opuscar cover different outputs: interactive illustrations, diagrams and films built in code, per their repositories ^[1]^[2]^[3]. Choose the output first.

Install Anatomy for an interactive illustration

The Anatomy README documents this Claude Code installation ^[1]. Read its skill and scripts before running it.

bash

npx skills add wheresryan22/anatomy -g -a claude-code

Its documented example asks the skill to explain a token bucket rate limiter interactively ^[1].

text

/anatomy explain how a token bucket rate limiter works, interactive

Install Diagram Design for a diagram

The repository documents this installation ^[2].

bash

npx skills add cathrynlavery/diagram-design

Describe the components and their relationships in plain language. Per the README, the skill writes a self-contained HTML and SVG diagram you can open locally ^[2].

Install Lemo Opuscar for a film

Lemo Opuscar documents these terminal commands for Claude Code ^[3].

bash

claude plugin marketplace add lemomo-ai/lemo-opuscar
claude plugin install lemo-opuscar@lemolab

Check the repository's runtime requirements before rendering. Its first use downloads shared guides and tools; each film's project stays in the folder where you started ^[3]. Keep the generated source with the export so you can revise it later.

Write skill metadata an agent can recognize

Thu, 05 Nov 2026 00:00:00 GMT

An agent skill starts with a directory containing SKILL.md. The Agent Skills specification requires a name and description in YAML frontmatter, followed by the instructions ^[1].

Make the description say when to use it

The specification's minimal structure is ^[1]:

skill-name/SKILL.md

---
name: skill-name
description: A description of what this skill does and when to use it.
---

Replace the placeholders with your task. The name must match the directory. Describe both the work and the circumstances that should trigger it ^[1].

Keep the procedure in the body

Put the instructions after the frontmatter. The specification allows supporting scripts, references and assets beside SKILL.md ^[1]. Link the exact supporting file where the agent needs it.

Anthropic describes progressive disclosure: skill metadata is available first, while the full instructions and additional resources load when needed ^[2]. A vague description can make a useful procedure hard to discover.

Check the behavior in a real task

Ask the agent to perform a task the description covers, then one outside that scope. Inspect which skill it selects and whether it loads the intended references. Revise the trigger description if it repeatedly selects the wrong procedure.

Automate SEO drafts with an editor review

Thu, 05 Nov 2026 00:00:00 GMT

Automate the collection and drafting work, then keep a person responsible for the published page. Google asks publishers to verify AI-generated content, including metadata. Its spam policy targets scaled content made to manipulate rankings without helping users. ^[1]^[2]

Pick pages from search data

Search Console's searchAnalytics.query returns clicks, impressions, click-through rate and position. It supports page and query dimensions and requires authorization and a date range. The API returns top rows rather than guaranteeing every row. ^[3]

Look for pages with meaningful impressions and few clicks. Read the queries and the page before deciding whether a title change would help. Low click-through rate alone does not explain why a result was skipped.

Prepare an editing brief

Supply the page, its audience, the search queries and sources the draft may cite. Ask for suggested changes to the title, description and outline, with a separate list of claims to verify.

Check the draft against those sources and the actual product. Include metadata in that review, as Google's guidance recommends. ^[1]

Save a WordPress draft

The WordPress API documents creating and updating posts, including a status value of draft. Use the post ID when updating an existing post and confirm that it belongs to the intended page. ^[4]

Preview the draft before publishing. Review links, headings and the rendered page as well as the text.

Check the resulting page

Lighthouse CI documents collecting audits and applying assertions in a build workflow. Follow its setup guide for the site's build and serving configuration before using its autorun command. ^[5]

bash

lhci autorun

Use these checks to catch page regressions. They do not prove a ranking improvement. Keep the original metrics and compare later Search Console data over a comparable period. ^[3]^[5]

Check Better Auth Magic Link and OAuth Proxy fixes

Thu, 05 Nov 2026 00:00:00 GMT

Better Auth's advisories describe two account-takeover paths. Both identify 1.7.7 as the patched version; the release notes confirm the Magic Link and OAuth Proxy fixes ^[1]^[2]^[3].

Read your lockfile and auth setup. The Magic Link advisory covers versions from 1.4.0-beta.18 up to, but excluding, 1.7.7. Its affected configuration combines social or Generic OAuth sign-in with database-backed OAuth state and one of these Magic Link storage setups ^[1]:

storeToken: "plain".
storeToken: "hashed" with global verification.storeIdentifier: "hashed".

The advisory says disableSignUp: true does not prevent takeover of existing accounts ^[1].

Check OAuth Proxy separately

The second advisory covers 1.5.0-beta.12 through versions before 1.7.7. It requires cookie-backed state, implicit account linking, and a missing dedicated proxy secret or one equal to the environment's global secret ^[2].

Switching between cookie and database state can expose the other issue. Read both advisories before choosing a workaround ^[1]^[2].

Upgrade the participating services together

Warning: the release notes say existing Magic Links and pending OAuth or SAML sign-ins must restart after the upgrade. Coordinate the change across servers sharing verification storage ^[3].

Install a supported patched release and update the associated Better Auth packages together. The 1.7.7 release notes state that no database migration is required for this fix ^[3]. Review the advisory's prefix changes if you use custom verification identifier overrides ^[1].

After deployment, request fresh Magic Links and exercise each configured login path. For OAuth Proxy, include every participating production and preview environment in that check ^[2]^[3].

Run five checks before merging AI-written code

Thu, 05 Nov 2026 00:00:00 GMT

Gitleaks, Knip, jscpd, OSV-Scanner and Lefthook cover different parts of a review. Their documentation describes secret detection, unused-code analysis, duplicate-code detection, dependency scanning and Git hooks respectively ^[1]^[2]^[3]^[4]^[5].

Scan the repository for secrets

On macOS with Homebrew, Gitleaks documents this installation. Run the scan from your repository ^[1].

bash

brew install gitleaks
gitleaks git -v

Review each finding before sharing scan output: it can contain the secret that was found ^[1].

Check unused code and duplication

Follow Knip's setup for your JavaScript or TypeScript project. Review its reported entry points before removing anything it considers unused ^[2].

For duplication, jscpd documents a one-off scan ^[3].

bash

npx jscpd .

Use the duplicate locations to inspect the code. Similar text can still serve different behavior.

Scan dependency files

Install OSV-Scanner using its documented installation for your system. Its source scan walks supported package files ^[4]. Replace the example directory with your checkout.

bash

osv-scanner scan source -r /path/to/your/dir

Keep the useful checks in hooks

Lefthook runs commands you define in lefthook.yml. After configuring those commands, its README installs them into the Git project with ^[5]:

bash

lefthook install

Keep your application's tests in the review too. These tools report particular problems; a clean scan does not prove the feature works.

Check packages before trusting an AI suggestion

Thu, 05 Nov 2026 00:00:00 GMT

An AI-generated package name needs the same review as any new dependency. These tools check package metadata, suspicious code, download hosts and known vulnerabilities, per their documentation. ^[1]^[2]^[3]^[4]^[5]

Review an npm package before installation

The npq README documents this install command. It checks package characteristics before handing installation to your package manager. ^[1]

bash

npm install -g npq

Its usage example installs Express after the checks. Replace that name only after confirming the package you intend to use. ^[1]

bash

npq install express

Inspect package code with GuardDog

After installing GuardDog through its documented setup, its npm scan command checks a package for suspicious behavior. The README uses this example. ^[2]

bash

guarddog npm scan express

Review findings before deciding whether to install the package.

Restrict lockfile download hosts

For an npm lockfile, the post's supplied command checks the allowed registry host and HTTPS URLs. The lockfile-lint README documents those checks. ^[3]

bash

npx lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https

You should see no findings when the file passes, per the README. ^[3]

Scan installed dependencies for advisories

Grype scans filesystems and container images for known vulnerabilities. Use its linked installation and scan-target documentation for your project type. ^[4]

For Python requirements, pip-audit documents this command. ^[5]

Warning: pip-audit can resolve dependencies and is not a malicious-code detector. Its security model says to audit only input you would trust to install. ^[5]

bash

pip-audit -r ./requirements.txt

The report lists known vulnerabilities and available fixes. A clean report leaves provenance and application-specific review for you. ^[5]

Choose an AI workflow before building an agent

Thu, 05 Nov 2026 00:00:00 GMT

Anthropic recommends starting with the simplest workable approach and adding complexity when it improves results. ^[1]

Try one model call first

Give the model relevant context and examples. Define a useful result before adding orchestration. ^[1]

Match the task to a workflow

Anthropic describes five patterns. ^[1]

Prompt chaining divides work into fixed steps with checks between them.
Routing sends different inputs to specialized handlers.
Parallelization handles independent parts or compares several attempts.
Orchestrator-workers lets a model divide work whose subtasks are not predictable.
Evaluator-optimizer uses feedback to revise a result.

Choose the pattern around your task's uncertainty. ^[1]

Add an agent loop only where needed

Anthropic says agent loops can cost more and compound mistakes. Test the tool boundaries and stopping conditions before using one on consequential work. ^[1]

For coding tools, the guide reports that absolute file paths avoided mistakes caused by a changed working directory. Require them in file-editing tools. ^[1]

Compare Zapier, n8n and Activepieces

Thu, 05 Nov 2026 00:00:00 GMT

Zapier provides hosted automation plans. n8n and Activepieces also document self-hosting, where you operate the server and store the connected-app credentials. Compare that responsibility before comparing plan prices. ^[1]^[4]^[5]

Read the licence for your use

n8n's Sustainable Use License limits use to your own internal business purposes, non-commercial use or personal use, with separate terms for enterprise code. Read the full licence before building a service for clients. ^[2]

Activepieces' licence applies MIT terms outside its listed enterprise directories. Those directories have separate terms. Check the specific features you intend to deploy. ^[3]

Choose an n8n deployment path

The current n8n Docker Compose guide includes configuration for its assistant sandbox. Follow its service and networking instructions together; a single start command is not the full deployment. ^[4]

Before starting, verify your Compose installation with its documented check. ^[4]

bash

docker compose version

You should see Docker Compose v2. ^[4]

Inspect Activepieces setup

Activepieces requires Docker Compose v2 and documents at least 2 vCPU and 4 GB RAM. Its guide provides this command to print the installer for review. ^[5]

bash

curl -fsSL https://get.activepieces.com

After reviewing the script, follow the linked installation guide in a dedicated directory. It generates secrets and starts the services. ^[5]

Check the current pricing pages and the connections your workflow needs before migrating it. Keep an export of the working workflow and a backup of its self-hosted data.

Choose an SEO skill for each job

Thu, 05 Nov 2026 00:00:00 GMT

A site audit and a new blog post need different instructions. The Short covers five SEO jobs. Here are current documented options for those jobs: Claude SEO handles the first four, and Claude Blog handles writing. ^[1]^[2]

Audit the site

Claude SEO documents a site audit and a narrower page review. Start with the installation and first audit guide, then choose the scope. ^[1]

text

/seo audit https://example.com

Review AI search readiness

Its GEO command checks how a site can be discovered and quoted in AI answers. ^[1]

text

/seo geo https://example.com

Check structured data

The schema command detects, validates and generates Schema.org markup. ^[1]

text

/seo schema https://example.com

Plan pages built from data

The programmatic command reviews and plans programmatic SEO. Use it when many pages share a template. ^[1]

text

/seo programmatic https://example.com

Research and write a post

Claude Blog documents research, drafting and review, plus separate fact-checking commands. Its current requirements include Claude Code and Python 3.11 or newer. Read its installation instructions before starting. ^[2]

Once installed, its documented workflow includes: ^[2]

text

/blog strategy "freelance CRM software"
/blog write "best CRM for freelancers"
/blog analyze posts/best-crm.md

Review generated claims and links yourself. The project's own FAQ says it cannot promise citations in AI answers. ^[2]

Choose design skills for five UI tasks

Thu, 05 Nov 2026 00:00:00 GMT

Pick a design skill around the change you need. These five projects cover different parts of interface work; their documentation is the basis for the choices below. ^[1]^[2]^[3]^[4]^[5]

Set the visual rules

UI UX Pro Max documents recommendations for colors, typography and layouts, plus a generated design system that can be saved for later pages. Use that written system to keep subsequent changes consistent. ^[1]

Hallmark focuses on visual direction and reviewing generated interfaces. Its repository documents installation and agent-specific invocation. For an existing page, follow the Hallmark audit and redesign guide. ^[2]

Work on the interaction

Emil Kowalski's collection includes skills for building, reviewing and removing animations. That last option matters when repeated motion gets in the way. Its README gives this installation command: ^[3]

bash

npx skills@latest add emilkowalski/skills

Choose the animation review skill when a transition feels wrong; choose the removal skill when the interaction needs less motion. ^[3]

Use the component library correctly

The shadcn skill reads project configuration so the assistant can find, install and compose components using the project's setup. Its documentation shows this pnpm installation: ^[4]

bash

pnpm dlx skills add shadcn/ui

This is useful when the task is a form, dialog or settings panel built with shadcn/ui. ^[4]

Review the finished interface

Vercel's web-design-guidelines skill reviews interface code for accessibility, focus states, forms, animation, images and other web conventions. ^[5]

Give the review a specific page and task. Then inspect the rendered result with a keyboard and a narrow viewport. A repository of instructions cannot decide whether your particular layout reads well; keep the changes you can explain and verify.

Use less context before raising your AI plan

Thu, 05 Nov 2026 00:00:00 GMT

Long conversations, large attachments and unnecessary tool calls can use more of your allowance. Start by changing what goes into a task before deciding that you need a larger plan ^[1].

Start a fresh chat for unrelated work

Claude distinguishes a conversation's length limit from the usage allowance across conversations. Starting a new chat does not reset the allowance. It can reduce the context carried into your next task ^[2].

When moving to a different job, bring only the files and decisions that job needs. Keep related follow-up work together so you do not have to explain the same problem again.

Match effort to the task

Anthropic's Claude Code guidance recommends Sonnet for routine coding and reserves Opus for harder work because Opus uses more quota ^[3].

OpenAI describes ChatGPT's Instant setting as suitable for everyday questions, with higher thinking settings for work that needs them. Available choices and limits depend on the plan and workspace ^[4]. Neither provider promises a fixed saving from changing the model.

Ask for the connected parts of a task in one clear message. Anthropic recommends batching similar requests and giving the relevant background upfront ^[1]. For example:

text

Review this function for the reported bug. Explain the cause,
suggest the smallest fix, and list the cases the test should cover.
Do not change the files yet.

Reuse project material

Claude caches project content, so reused material can count less against usage while it remains cached. Caches expire after inactivity ^[1]. Put recurring reference documents in the project, and remove files that no longer help the work.

Keep tools and thinking purposeful

Claude's guidance recommends disabling unused connected apps and avoiding web searches when current information is unnecessary. On models that offer a thinking toggle, switch it off for simple work; on always-thinking models, lower the effort level ^[2].

Keep search enabled when the answer depends on current facts. Saving a tool call is not useful if the answer relies on outdated information.

Check your own allowance

Claude's Settings > Usage shows consumption and reset information for supported plans ^[1]. ChatGPT displays allowance resets when available; its limits differ by model, plan and workspace ^[4]. Check those controls before starting a long task. A new chat changes the context, not the reset time.

Use five built-in Claude Code shortcuts

Thu, 05 Nov 2026 00:00:00 GMT

Claude Code includes shortcuts for checking context and working with an active session. These controls come from its interactive-mode documentation. ^[1]

Inspect the context window

Enter this inside Claude Code. It shows what is using the session's context. ^[1]

text

/context

Ask a side question

The documented side-question command can run while Claude works. It uses existing context and cannot fetch new files or run tools. ^[1]

text

/btw what was the name of that config file again?

Paste an image

Copy a screenshot, then use Ctrl+V. The docs list Cmd+V for iTerm2 and Alt+V for Windows and WSL. You should see an image chip in the prompt. ^[1]

Read shell output in the session

This documented shell-mode example adds the command and its output to the conversation. ^[1]

text

! git status

Open the rewind controls

Press Esc twice or enter /rewind to review an earlier point. Inspect the available choices before restoring changes. ^[1]

Use the control for the task at hand; none needs another plugin.

Use Claude Code hooks for status notifications

Thu, 05 Nov 2026 00:00:00 GMT

Claude Code hooks can signal when a session needs your attention, per the hook reference. A status widget or notification can react to those events without approving a tool call. ^[1]

Choose events for each state

The reference describes these lifecycle events. ^[1]

UserPromptSubmit fires when you submit a prompt.
PostToolUse fires after a tool succeeds.
PermissionRequest fires when Claude is about to request permission.
Stop fires when Claude finishes responding; an interrupted response does not trigger it.

Use the first two for a working indicator, PermissionRequest for an attention indicator and Stop for completion. Keep the display separate from permission-decision output. ^[1]

Add a notification hook

Follow the hook guide's desktop-notification example in your Claude settings. Choose a command for your operating system. The guide includes macOS and Linux options. ^[2]

Warning: hooks run shell commands. Read a hook before installing it, especially if it comes from another repository. ^[2]

Check the configured hooks

Inside Claude Code, inspect the configured hooks with the guide's command. ^[2]

text

/hooks

You should see your event and command listed. Trigger a notification with a harmless task before connecting the same signal to a light or desktop widget. ^[2]

The permission_prompt notification waits before firing. Use PermissionRequest when you need the signal at the permission request itself; the reference notes separate behavior for sandbox network prompts. ^[1]

Check five Claude Code compaction and sandbox fixes

Thu, 05 Nov 2026 00:00:00 GMT

Claude Code releases 2.1.309 and 2.1.311 fix several failures that can look like a model ignoring instructions or getting stuck. Our WEEKLY post covers these October releases ^[1]^[2].

Check the installed version

bash

claude --version

If your installation supports Claude Code's updater, run ^[3]:

bash

claude update
claude --version

For a package-manager installation, use that manager's update instructions in the setup documentation. Confirm the version after updating; these fixes first appeared in the releases below.

Four session fixes in 2.1.311

Standard-context sessions that crossed 200K tokens could stop with a usage-credit error. The fix makes them compact and continue.
Edits to CLAUDE.md and MEMORY.md could be stale immediately after automatic compaction. The release fixes that stale view.
Subagents could miss MCP tools when the server finished connecting after the subagent started. The release fixes that timing problem.
A very long list item in CLAUDE.md could cause long freezes during startup or file work. The release fixes those freezes ^[1].

Compaction still summarizes context. Keep instructions concise and check the actual file when a response appears to use an old rule.

Sandbox fixes in 2.1.309

The earlier release fixes shell startup files running outside the sandbox before sandboxed Bash commands on macOS and Linux. It also prevents sandboxed commands and auto-accepted edits from modifying the file supplied through --mcp-config ^[2].

These are specific fixes. Keep your existing sandbox and permission settings enabled after updating. If you were working around one of these bugs, retry the original task with the updated client and record the version alongside the result.

Separate Claude Code sessions with Git worktrees

Thu, 05 Nov 2026 00:00:00 GMT

Claude Code's worktree docs describe separate working folders and branches for parallel sessions ^[1]. Use one per task when two sessions would otherwise edit the same files.

Start the first isolated session

From your Git repository, use the documented example ^[1].

bash

claude --worktree feature-auth

You should see a worktree at .claude/worktrees/feature-auth on branch worktree-feature-auth ^[1]. In another terminal, use a different worktree name for the second task.

Keep generated worktrees out of status

Add this entry to your existing ignore file, preserving its other entries ^[1].

.gitignore

.claude/worktrees/

Copy only the ignored files you need

A fresh checkout lacks untracked environment files. The documented .worktreeinclude mechanism copies files only when they match its patterns and are also Git-ignored ^[1].

Warning: this creates additional copies of your local environment files. Include secrets only when the isolated task needs them.

.worktreeinclude

.env
.env.local

Review work before cleanup

The docs say Claude prompts about keeping or removing a worktree when it contains changes or commits. Keep any work you still need ^[1]. Separate worktrees isolate file edits; they are not a substitute for reviewing the combined changes before merging.

Choose a Claude Code plugin for the task

Thu, 05 Nov 2026 00:00:00 GMT

Choose the plugin for the job in front of you. Claude Code's plugin manager lets you inspect and manage installed plugins ^[1]. The four choices from our PLUGPICK post cover development process, documents, session memory and interface design.

Warning: review a plugin's code, hooks and server configuration before installing it. Installation can add executable components to your environment.

Add Superpowers for a development workflow

Superpowers describes a workflow built around planning, tests and review. Its README gives this Claude Code command ^[2].

text

/plugin install superpowers@claude-plugins-official

Add Anthropic skills for documents

Anthropic's repository includes skills for PDF, Word, spreadsheets and presentations. Run these commands inside Claude Code ^[3].

text

/plugin marketplace add anthropics/skills
/plugin install document-skills@anthropic-agent-skills

After installation, the README says you can request a skill by name, such as the PDF skill ^[3].

Add Claude-Mem for session context

Claude-Mem describes capturing session activity and supplying relevant context to later sessions. Its current README gives these commands, followed by restarting Claude Code ^[4].

text

/plugin marketplace add thedotmack/claude-mem
/plugin install claude-mem

The README says context from earlier sessions appears in later sessions. Review what the plugin records before using it with sensitive work ^[4].

Add UI UX Pro Max for interface work

The repository supplies design guidance and these marketplace commands ^[5].

text

/plugin marketplace add nextlevelbuilder/ui-ux-pro-max-skill
/plugin install ui-ux-pro-max@ui-ux-pro-max-skill

Use the chosen plugin on a real task before adding another. The plugin manager remains the place to inspect what is installed and remove what you no longer use ^[1].

Build a video with Claude Code and Remotion

Thu, 05 Nov 2026 00:00:00 GMT

Remotion's coding-agent guide provides a project setup you can edit with Claude Code ^[1]. Plan the spoken line, visual and tool for each shot first, as in our VIDEO post. Approve that plan before generating the scenes.

Start a Remotion project

The current Remotion guide uses these commands. It requires Node.js and a coding agent ^[1].

bash

npx create-video --yes --blank my-video
cd my-video
npx remotion skills add
npm run dev

The first command creates a blank project in my-video. Open another terminal in that project to start Claude Code ^[1].

bash

cd my-video
claude

Get timestamps for spoken words

The faster-whisper README documents installation and word-level timestamps ^[2].

bash

pip install faster-whisper

This combines its CPU model setup and word timestamp example. Replace voice.wav with your narration file ^[2].

python

from faster_whisper import WhisperModel

model = WhisperModel("large-v3", device="cpu", compute_type="int8")
segments, _ = model.transcribe("voice.wav", word_timestamps=True)
for segment in segments:
    for word in segment.words:
        print("[%.2fs -> %.2fs] %s" % (word.start, word.end, word.word))

You should see timestamped words. The README notes that transcription happens when the segment generator is consumed, and loading a model by name downloads its files ^[2].

Prepare a cutout when the scene needs one

For text placed behind a subject, rembg documents removing a local image's background. Use artwork you have permission to publish ^[3].

bash

pip install "rembg[cpu,cli]"
rembg i in.png out.png

Inspect out.png before compositing it. Keep the original image so you can correct a poor mask.

Apply the post's optional grade

The VIDEO setup guide uses this FFmpeg filter chain. The filters reference describes curves, saturation adjustment and vignette ^[5]. Use your rendered video as in.mp4 and a new destination filename.

bash

ffmpeg -i in.mp4 -vf "curves=master='0/0.05 0.5/0.48 0.85/0.80 1/0.92',eq=saturation=0.85,vignette=angle=PI/5" out.mp4

Check caption timing and readability on the final export. Remotion's license FAQ permits free use for individuals and teams of up to three people; check the current terms for your organization before commercial production ^[4].

Give new Claude Code sessions your project facts

Thu, 05 Nov 2026 00:00:00 GMT

A new Claude Code session starts with a fresh context window. The memory docs say project instruction files and auto memory carry information into it ^[1]. A short CLAUDE.md gives you a place to keep facts you keep repeating.

Write the facts the next session needs

Adapt the example from our MEMORY post to your project. Replace every line that is untrue before saving it in the project root.

CLAUDE.md

# Project context

- Stack: Next.js + Postgres
- Auth is done
- Do not redo auth

The docs describe CLAUDE.md as context the model tries to follow. It does not enforce access restrictions ^[1]. Use permission rules to protect secrets.

Check the file in Claude Code

Run the documented command inside a session ^[1].

text

/memory

You should see the instruction file locations. Select the project file to read or edit it.

Keep the instructions current

Remove completed-work notes once they stop helping future sessions. Put recurring decisions in concrete sentences. If a rule is ignored, the docs recommend checking for conflicting instructions and confirming that the file loaded ^[1].

For procedures that deserve their own skill or hook, see where each Claude Code instruction belongs.

Choose a slide tool for Claude Code

Thu, 05 Nov 2026 00:00:00 GMT

Your output format decides which slide tool to use. These projects support web presentations, Office files or Markdown exports, per their documentation. ^[1]^[2]^[3]^[4]^[5]

Make a web deck with Frontend Slides

The README asks you to send these as separate Claude Code messages, waiting for the first to finish. ^[1]

text

/plugin marketplace add https://github.com/zarazhangrui/frontend-slides

text

/plugin install frontend-slides@frontend-slides

Then start its installed skill. ^[1]

text

/frontend-slides:frontend-slides

Edit Office files with OfficeCLI

OfficeCLI documents this npm installation and explicit skill installation. It works with PowerPoint, Word and Excel files. ^[2]

bash

npm install -g @officecli/officecli
officecli install

Export Markdown with Marp

For an existing Markdown deck, the CLI supports a PowerPoint export. Its ordinary PowerPoint output contains rendered slide images; editable output is a separate experimental option. ^[3]

bash

npx @marp-team/marp-cli@latest slide-deck.md --pptx

Check the exported deck in the application your audience will use.

Connect GenOffice to your agent

Install the GenOffice app first, then use its Settings > Integrations page or the documented skill command. ^[4]

bash

npx skills add genspark-ai/genoffice

Start a code talk with Slidev

Slidev uses Markdown and web components. Its getting-started guide provides this npm project command. ^[5]

bash

npm init slidev@latest

Choose one tool around the file you need to deliver. For PowerPoint, check editability before committing to a whole deck.

Choose five tools for working with spreadsheet data

Thu, 05 Nov 2026 00:00:00 GMT

DuckDB, Anthropic's data plugin, csvkit, Datasette and marimo give you different ways to inspect a dataset, per their documentation ^[1]^[2]^[3]^[4]^[5]. Choose the tool for the operation you need before asking an agent to analyze the whole file.

Use SQL for a focused calculation

DuckDB is an analytical database with support for tabular data ^[1]. Use a query to select the columns and aggregate you need. Check the query and a small sample against the original file before relying on its result.

Use the data plugin for a guided analysis

Anthropic's data plugin provides analysis and dashboard workflows for Claude ^[2]. Review its instructions and connectors before installation, especially when the dataset contains private information.

Inspect a CSV with csvkit

The csvkit tutorial documents its Python installation ^[3]. Use an isolated Python environment if your operating system manages its own Python packages.

bash

pip install csvkit

Work through the linked tutorial to inspect columns, convert formats and calculate statistics ^[3].

Choose a browser or notebook view

Datasette provides a web interface for exploring data and JSON access to results ^[4]. marimo provides a reactive Python notebook ^[5]. Pick the format you can inspect and rerun.

A file processed locally can still produce tool output that your agent sends to its model. Review the agent's data handling before using confidential rows. Keep the calculation and its input alongside the answer so another person can reproduce it.

Give Claude Design an existing design system

Thu, 05 Nov 2026 00:00:00 GMT

Open Design Agent Kit collects design systems, skills and examples that coding agents can read. Its repository includes a claude-design-systems directory ^[1]. I would choose one reference that fits the product before asking an agent to design a whole site.

Choose the reference for your product

Browse the repository's design systems and examples ^[1]. Check the typography, navigation and content density against your own page. A dashboard reference and a reading-focused publication solve different problems.

Add the system in Claude Design

Anthropic's setup guide describes creating a design system from supplied assets, including a codebase or design references. The system stores colors, typography, components and layout patterns for later work ^[2]. Follow the account-specific setup in that guide and supply the selected system's files.

Review a real page before reusing it

Check a page containing your actual title, navigation and longest content. Look at narrow and wide layouts, link states and text contrast. Record the corrections in the system you reuse.

Keep your own branding and content. The repository supplies design material; you still need to decide which choices belong in your product ^[1].

Review claude-mem prompt upload consent before setup

Thu, 05 Nov 2026 00:00:00 GMT

A claude-mem issue reports that earlier setup versions uploaded recent coding-agent prompts without a separate consent step ^[1]. The current setup source contains an explicit upload decision, so the historical report needs to be read alongside the code in the version you install ^[2].

Check the version and setup changes

Read the release notes and the issue's linked commits before running an installer ^[1]^[3]. The report describes scans of multiple coding agents' histories, not only the tool selected during installation ^[1].

Do not assume a newer file on the default branch is already present in the package you downloaded.

Inspect the upload choice

The current setup-scan.ts has an awaiting-consent phase and a confirmUpload method. Its comments say declining keeps prompts local ^[2]. Check that your installed setup presents that choice before authorizing access to histories.

Warning: Old chat histories can contain confidential project information. Review which tools and time range the setup will inspect before allowing an upload.

Handle an earlier upload separately

The issue distinguishes deleting records at cmem.ai from deleting downstream copies ^[1]. If you already ran an affected setup, ask the service which recipients received your data and what deletion covers.

Keep the installed version and the consent shown as evidence. A later consent fix cannot establish what happened to an earlier upload.

Audit a site with the Claude SEO plugin

Thu, 05 Nov 2026 00:00:00 GMT

Claude SEO adds site auditing commands to Claude Code, per its README. Start with a site you own or have permission to audit. ^[1]

Install the public plugin

Run these commands inside Claude Code, one at a time. The README specifies Claude Code 1.0.33 or newer. ^[1]

text

/plugin marketplace add AgriciDaniel/claude-seo

text

/plugin install claude-seo@agricidaniel-claude-seo

text

/seo setup

The setup prepares the plugin's Python environment and browser. Check that setup with its diagnostic command. ^[1]

text

/seo doctor

Choose the audit scope

Replace the example address with your site's URL. Use the page command when you need to review one page first. ^[1]

text

/seo page https://example.com/pricing

For a whole-site review:

text

/seo audit https://example.com

The README describes a report with a prioritized action plan. Check each proposed change against your actual content and deployment before applying it. ^[1]

Keep the report alongside the fixes so you can compare the next audit with this one.

Check what changed from Claude Max 20x to Ultra

Thu, 05 Nov 2026 00:00:00 GMT

Anthropic says Max 20x is now called Ultra, with existing Max 20x subscribers moved automatically at the same price ^[1]. The name change is not a reason to buy a second subscription.

Check your current subscription

Open your account's plan and billing settings. Compare the plan shown there with Anthropic's current Ultra help page. The page lists Ultra at USD 200 per month for a web subscription and says mobile pricing can differ ^[1].

Read the usage conditions

The help page describes weekly usage at ten times Pro and no five-hour limit for verified accounts. Check the verification condition before assuming every Ultra account receives the same limit behavior ^[1].

Review billing before switching

The page describes different upgrade treatment for web and mobile subscriptions. Read the section for the store where you pay, including how unused annual Pro credit is handled ^[1].

Prices and plan rules can change. Use the account's displayed billing terms and the linked help page when deciding whether to change plans ^[1].

Enable and inspect local Codex memories

Thu, 05 Nov 2026 00:00:00 GMT

Codex can carry useful context from earlier chats into later work through local memory. The CODEXMEM post covered CLI 0.165.0, which introduced the v2 default for fresh profiles and imports from other agents ^[2].

Enable local memory

Local Codex memories are off by default. Add this to ~/.codex/config.toml, merging it into an existing [features] section if you already have one ^[1]:

toml

[features]
memories = true

In an interactive chat, open the memory controls:

text

/memories

Choose whether this chat can use existing memories and contribute to future ones. These controls apply to the chat; they do not replace the global setting ^[1].

Check the storage location

Fresh CLI profiles normally use ~/.codex/memories_v2/. An existing memories/ store continues to be used by default. Explicit version settings can change that behavior; the desktop app has migration behavior that can involve both directories ^[1].

Memory generation runs in the background and may wait after a chat becomes idle. Review generated files before sharing them. Keep required project rules in AGENTS.md or checked-in documentation ^[1].

Other changes in 0.165.0

The October 27 release also added GPT-6.1 Terra to the model catalog, reasoning-effort changes during a conversation for supported models, and a repository filter for sessions across linked worktrees. It added the built-in Google Cloud Vertex AI provider configured with model_provider = "gcp" ^[2].

Treat those as release-specific changes. Follow the current memory documentation when configuring a newer client, particularly if it already has a memory store.

Check instruction files before starting a coding agent

Thu, 05 Nov 2026 00:00:00 GMT

Forever Security reported finding malicious agent instructions in a customer's Downloads folder. The report describes attempts to redirect an agent's configuration and install malware ^[1].

Choose a project directory you control

The researchers recommend avoiding ~/Downloads as an agent's starting directory. Inspect unfamiliar AGENTS.md and CLAUDE.md files before opening their folder with an agent ^[1].

text

AGENTS.md
CLAUDE.md

Read for unexpected installation requests, credential handling or instructions to disable safeguards.

Review configured endpoints

The report names these configuration locations ^[1].

text

~/.codex/config.toml
.claude/settings.json

Check Codex for unfamiliar MCP server entries or a changed chatgpt_base_url. Check Claude Code for an unexpected ANTHROPIC_BASE_URL or proxy. Keep approvals and sandboxing enabled ^[1].

Respond to evidence of compromise

Forever recommends rotating exposed tokens if you discover the malicious configuration. It identifies function-color as a malicious npm package in the campaign; finding it warrants treating the machine as compromised ^[1]. Do not run unfamiliar package commands to investigate them.

You have the instruction files and endpoint settings to review before the next agent session. For repository startup hooks, continue with the unfamiliar repository checklist.

Compare six models and choose a coding client

Thu, 05 Nov 2026 00:00:00 GMT

Choose a model around the work you need done, then choose a client that supports your account. These are the six models covered in the carousel, with links to their providers' descriptions. The provider descriptions below can help you choose candidates for your own comparison. ^[1]^[2]^[3]^[4]^[5]^[6]

Narrow the model choices

GPT-6.1 Terra: OpenAI describes visual reasoning, computer use and everyday work. For GitHub's integration, see the Terra in Copilot guide. ^[1]
Kimi K3.1 Pro: Kimi documents its model and API access, including kimi-k3.1-pro and a high-speed variant. Check the provider's current availability before choosing a deployment path. ^[2]
Gemini 4 Argon: Google's documentation positions it for software engineering, mathematical and scientific reasoning, and multi-step agents. ^[3]
Claude Haiku 5.5: Anthropic describes high-volume work such as summaries, classification and database queries, plus coding subagent work. ^[4]
Grok 4.7: Its announcement focuses on coding and knowledge work, including longer tasks and checking its own results. ^[5]
GLM-5.3-Flash: Z.ai describes visual feedback from interfaces and rendered output, alongside coding and document workflows. ^[6]

Use the same representative task when comparing candidates. Record whether the result is correct, how much revision it needs, and its actual usage cost.

Separate the model from the client

OpenCode connects multiple providers through its provider configuration. Its documented connection command is: ^[7]

text

/connect

Choose the provider and follow its authentication instructions. OpenCode's documentation explicitly says Claude Pro/Max authentication through third-party plugins is prohibited by Anthropic. Use the supported API connection for that provider. ^[7]

A subscription and an API key are different billing arrangements. Check the provider's current terms and prices before connecting an account; the carousel's October snapshot should not set a spending budget today. ^[7]

Compare five alternatives for notes and team docs

Thu, 05 Nov 2026 00:00:00 GMT

Docmost, Logseq, AppFlowy, AFFiNE and Outline have different storage and licensing choices ^[1]^[2]^[3]^[4]^[5]. A public repository alone does not tell you what a production deployment permits.

Decide whether you need a local notebook or a server

Check Logseq's release notes for the edition and storage model you intend to use ^[2]. For a collaborative server, compare Docmost and AppFlowy Cloud's deployment requirements ^[1]^[3]. Start with a copy of your notes before attempting a migration.

Read the license for the component you deploy

AFFiNE's server license separates Community Edition code from Enterprise Edition terms ^[4]. Outline's license contains an additional-use grant and restrictions on production use ^[5]. Read the actual license for your version and deployment, especially if you plan to host it for other customers.

Try one documented installation

Docmost recommends Docker and provides a deployment guide with configuration steps ^[6]. Follow the current guide rather than copying a partial compose command from a caption. Review its application URL, credentials and persistence settings before starting it.

Check that you can export your notes and restore the stored data before moving the working copy. The software choice also leaves you responsible for the server, backups and updates.

Connect Claude Code to five useful MCP tools

Thu, 05 Nov 2026 00:00:00 GMT

MCP lets Claude Code read and act on connected services. Add a server for a task you actually do, such as checking an issue or reading a browser page. The Claude Code documentation explains installation, scopes and authentication. ^[1]

Choose the service you need

GitHub: work with repository files, issues and pull requests. Start with the official server's setup and tool permissions. ^[2]
Playwright: interact with a browser using page accessibility information. Check its browser setup and supported tools. ^[3]
Context7: retrieve library documentation and code examples. Follow the current client installation instructions. ^[4]
Sentry: investigate errors, performance and issue triage. Connect the organization or project you need. ^[5]
Notion: find, read and update workspace information. Follow its hosted MCP connection and authorization guide. ^[6]

Connect one server first

Sentry documents this Claude Code command. Replace the organization and project placeholders with your own slugs. Sentry recommends project scoping where possible. ^[5]

bash

claude mcp add --transport http sentry https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}

Inside Claude Code, open the server panel: ^[1]

text

/mcp

Use it to inspect the connection and authenticate servers that require OAuth. Complete the browser sign-in before asking Claude to read the service. ^[1]

Check access before adding more

Start with a read-only task, such as inspecting one issue. Review the returned item against the service itself before relying on it. Choose only the accounts and workspaces that the task needs.

Follow each provider's setup instructions; a local browser server and a hosted account integration have different requirements. Keep server credentials out of shared configuration files. Claude Code's documentation covers project approval and configuration scopes. ^[1]

Choose an effort level in Copilot Fusion

Thu, 05 Nov 2026 00:00:00 GMT

Copilot Fusion chooses models for each prompt. You select an effort level, and Copilot decides how to produce and review the response. GitHub made it generally available on October 28, 2026 ^[1].

Select Fusion in your client

Update VS Code, Copilot CLI, the Copilot app or your JetBrains client. Open the model picker, select Copilot Fusion, then choose Standard, High or Max ^[1].

Start with Standard for routine coding. High and Max are options for tasks that justify more reasoning and additional model calls. A useful first comparison is the same small bug fix at two effort levels: inspect the diff and run the same tests before comparing the credit use.

GitHub says Fusion is available on all Copilot plans, but organization policies still control which models it can use. If every eligible model is disabled, Fusion will not appear ^[2].

Understand what ran

Fusion can complete a request with one model, have a draft checked before escalating it, or have other models critique a draft before revision ^[1]. The pattern can change between prompts in the same conversation.

Hover over the effort label beneath the reply to see the models used ^[2]. That gives you something concrete to compare when two requests take different amounts of time.

Check credits and edits

GitHub bills the models Fusion uses, with no separate Fusion charge. High and Max can consume more credits than Standard because more than one model may run. The current documentation lists a 30% model-cost discount for paid plans through November 30, 2026 ^[2]. Check the linked billing section before estimating costs after that date.

One limitation deserves attention: discarding a draft does not automatically undo edits that draft made in your workspace ^[2]. Review the complete diff before committing, including files the final response does not mention.

Run five website checks before your next release

Thu, 05 Nov 2026 00:00:00 GMT

A website needs several kinds of checks. Lighthouse audits a page, a link checker finds broken destinations, and browser measurements show what happens during visits. Our CRAWLKIT post collects five free tools for these jobs.

Run scans on a site you own. Replace https://example.com in the examples with your URL.

Start with one page

Lighthouse can run just its SEO category ^[1]. This command gives you a focused report to work through before scanning more pages.

bash

npx lighthouse https://example.com --only-categories=seo

Read each failed audit and check the affected element. A passing automated report does not prove that every page is indexed or that its content answers a visitor's question.

Check across the site

Unlighthouse discovers pages and runs Lighthouse audits across them. Its current homepage documents the v1 beta command and requires Node.js 24.13.1 or later ^[2].

bash

npx unlighthouse@beta --site https://example.com

This explicitly selects a beta release. Review the discovered URLs before treating the report as coverage of your whole site. Pages behind authentication or without discoverable links need separate attention.

Find broken links

lychee checks URLs in websites, Markdown and HTML. On macOS, its documented Homebrew installation is ^[3]:

bash

brew install lychee
lychee https://example.com

Inspect failures before changing links. An unavailable destination or a server that blocks automated requests needs a different response from a typo in your own URL.

Repeat audits after changes

Lighthouse CI runs audits and can enforce assertions in a build process ^[4]. Its setup needs a configuration file describing what to collect and check.

bash

npm install -g @lhci/cli

Follow the linked getting-started guide to configure your site's build directory or URLs. Once that configuration exists, run:

bash

lhci autorun

Choose assertions that reflect the pages you are releasing, then compare results after changes. Installing the CLI alone does not add a check to your deployment pipeline.

Measure visits in the browser

The web-vitals package measures Core Web Vitals in the browser ^[5]. Install it in a project with a client-side build:

bash

npm install web-vitals

Start with the documented console example:

import { onCLS, onINP, onLCP } from 'web-vitals';

onCLS(console.log);
onINP(console.log);
onLCP(console.log);

Some callbacks wait for interaction or a change in page visibility. This example only logs locally. Collecting measurements across visitors requires connecting the callbacks to an analytics endpoint ^[5].

Keep the results separate

Use the page audit to identify issues, the site scan to find repeated problems, and the link checker to find broken destinations. Add repeatable build checks once the configuration is useful. Browser measurements then help you see how released pages behave during actual visits.

Five tools for local AI work

Thu, 05 Nov 2026 00:00:00 GMT

These tools cover five everyday jobs. Their documentation describes local processing options, but hardware support and setup differ. Start with the job you repeat most. ^[1]^[2]^[3]^[4]^[5]

Dictate with Handy

Handy transcribes speech and pastes it into the app you are using. Its README describes local processing on Windows, macOS and Linux. Download the appropriate release, grant microphone and accessibility permissions, then configure a shortcut. ^[1]

Use it for a short message first. Read the transcription before sending it.

Run a local model with Ollama

Ollama supports local models and also offers cloud features. Its FAQ distinguishes the two: local processing keeps prompts on your machine, while a cloud model sends them to the service. ^[2]

For local-only operation, the documented setting in ~/.ollama/server.json is: ^[2]

json

{
  "disable_ollama_cloud": true
}

Restart Ollama after changing it. Check model requirements against your available memory. ^[2]

Enlarge an image with Upscayl

Upscayl provides a desktop image upscaler. Its README requires a Vulkan-compatible GPU and warns that many integrated GPUs will not work. It also says upscaling does not fix an out-of-focus photograph. ^[3]

Keep the original and compare edges and small text in the result.

Transcribe a recording with Buzz

Buzz supports offline transcription and translation, audio and video files, and transcript exports including TXT, SRT and VTT. Install its desktop app using the linked repository instructions. ^[4]

SRT or VTT is useful when the next step is captions. Review names and technical terms before publishing.

Remove a background with rembg

The rembg README documents Python 3.11 through 3.13 and this CPU installation with CLI support: ^[5]

bash

pip install "rembg[cpu,cli]"

Its single-image example is: ^[5]

bash

rembg i path/to/input.png path/to/output.png

Replace those paths with your input and output files. Inspect hair, glasses and soft edges before using the cutout.

Check GitHub Actions before merging workflows

Thu, 05 Nov 2026 00:00:00 GMT

GitHub Actions workflows need checks before they receive repository access. The actionlint, zizmor, pinact, ratchet and act projects cover different parts of that review. ^[1]^[2]^[3]^[4]^[5]

Check syntax and security

Install actionlint and zizmor using their linked installation instructions. From your repository, actionlint checks workflow syntax and expressions; zizmor scans for security problems. ^[1]^[2]

bash

actionlint
zizmor .

Read the reported file locations and fix each finding before running the workflow.

Pin action versions

Per the pinact README, this command edits workflow and composite-action files to pin action references. Review its changes before committing them. ^[3]

bash

pinact run

Use ratchet to check those pins afterward. Its lint command exits unsuccessfully when it finds an unpinned reference. ^[4]

bash

ratchet lint .github/workflows/*.yml

List the jobs before a local run

The act documentation provides a list mode for a specific event. ^[5]

bash

act -l pull_request

You should see the jobs for that event. A full run requires a working container setup and the event inputs your workflow uses. Review the workflow before allowing it to run locally, where it can execute its commands. ^[5]

Keep these checks in the pull-request review so a passing local run is one piece of evidence about the change.

Check what Google AI Overviews actually requires

Thu, 05 Nov 2026 00:00:00 GMT

Google says AI Overviews and AI Mode use the same search fundamentals as ordinary Google Search. There is no additional AI-specific file or schema requirement ^[1].

Check whether Google can index the page

Use Search Console's URL Inspection for the page you want people to find. Per Google's guide, a supporting page must be indexed and eligible to appear with a snippet ^[1]. Review crawling restrictions, hosting restrictions and any noindex instruction before changing the content.

Put the answer in visible text

Google recommends making important content available as text and linking to it from other pages. Give the reader a direct answer, then the evidence they need to assess it. Structured data must agree with the visible page ^[1].

Check the ordinary search report

Google includes traffic from these AI features in Search Console's Web performance report. Use that report alongside the actions readers take on your site ^[1].

Meeting the requirements does not guarantee crawling, indexing or inclusion. Fix an observed indexing or content problem before paying for an AI-search addition whose effect you cannot measure ^[1].

Use Google's search guidance beyond the PageRank story

Thu, 05 Nov 2026 00:00:00 GMT

Brin and Page's 1998 paper describes a Google prototype that used hyperlink structure alongside page text. Its database covered at least 24 million pages. That historical design helps explain the interest in links, but it is not a checklist for ranking a page today. ^[1]

Check the page people will read

Google's current Search Essentials recommends useful content, words people search for in titles and headings, and crawlable links. ^[2] Apply that to one page before changing your whole site:

Give it a title that names the question it answers.
Put the answer near the start, with enough detail for someone to act.
Link to it from a relevant page using descriptive link text.
Check that images and videos follow Google's guidance for those formats.

Avoid manufactured signals

Google's spam policies cover keyword stuffing and links created to manipulate rankings. ^[3] Repeating a phrase or buying links does not improve the explanation your reader came for.

I would spend that effort on an original example, a documented result or a clear comparison someone else can reference. Then check the page against Search Essentials again. Meeting its requirements makes content eligible; Google explicitly says it does not guarantee crawling, indexing or serving the page. ^[2]

Map a codebase with Graphify

Thu, 05 Nov 2026 00:00:00 GMT

Graphify builds a graph of code and related documents that an assistant can query. Its repository says code parsing runs locally through tree-sitter; an optional semantic pass over documents or media can call a configured backend. Check that boundary before including private material. ^[1]

Install the official package

The documented requirements include Python 3.10 or later and uv or pipx. For uv, the package has two trailing y characters: ^[1]

bash

uv tool install graphifyy
graphify install --project

Run this from the repository you want to configure. The project option writes the assistant skill inside that repository. Review the generated files before committing them. ^[1]

Build and inspect the graph

In Claude Code, use the documented skill command: ^[1]

text

/graphify .

Look in graphify-out/ for graph.html, GRAPH_REPORT.md and graph.json. The HTML is the visual view; the JSON holds the graph. ^[1]

Inspect a connection before relying on it. Graphify marks whether edges came directly from source or were inferred, and its query, path and explain commands expose the relationships. Use the linked source file to confirm the result before changing code. ^[1]

Keep Hermes project context and memory useful

Thu, 05 Nov 2026 00:00:00 GMT

Hermes documents separate places for project instructions, persistent facts and reusable procedures ^[1]^[2]. Put information where the next session can find it.

Keep project rules in AGENTS.md

The tips guide says Hermes loads the project-root AGENTS.md when a session starts. Put project conventions and architecture decisions there. It discovers subdirectory instruction files during relevant tool calls ^[1].

Save facts and procedures separately

Use memory for durable facts, such as project locations or environment details. Use a skill for a repeatable procedure, per the Hermes guide ^[1]. Review remembered facts when the environment changes.

The memory documentation describes files that persist between sessions ^[2]. Avoid treating temporary task progress as a permanent preference.

Inspect a long session before compressing it

Hermes documents these interactive commands ^[1]. Check usage first, then compress when the accumulated conversation needs shortening.

text

/usage

text

/compress

The guide describes compression as a summary of conversation history ^[1]. Keep important decisions in the project files too, so a later session does not depend on recovering every detail from that summary.

Discover commands instead of guessing them

Type / and press Tab for the available commands and installed skills, as documented in the tips guide ^[1]. Use the choices shown by your installed version.

Import Claude Code settings into Hermes

Thu, 05 Nov 2026 00:00:00 GMT

Hermes can import Claude Code instructions, skills and MCP settings, per its import guide. Preview the plan before writing changes. ^[1]

Install the importer and preview changes

The current guide installs the official plugin, then runs a dry preview. ^[1]

bash

hermes plugins install agent-importers
hermes import-agent claude-code --dry-run

You should see a per-item plan. The guide says dry runs do not write to disk. ^[1]

Review permissions before importing

The importer maps Bash allow and deny rules, but reports non-Bash rules such as Read(...) as unmapped. It skips slash commands and strips credentials. Rebuild missing protections before giving Hermes access to the project. ^[1]

Hermes' security guide says its file tools deny reads of project .env, .env.local, .env.production and .envrc files, while allowing writes. That specific rule does not describe protection for every secret path. ^[2]

Apply the import

bash

hermes import-agent claude-code

Review the report for skipped items. The same guide supports codex and cursor as source names. ^[1]

Preview later updates

bash

hermes import-agent --sync --dry-run

After reviewing the changes, apply them with:

bash

hermes import-agent --sync

Imported setup changes can now be reviewed separately from the credentials you configure in Hermes. ^[1]

Inspect a binary with capa, Ghidra, YARA-X and ILSpy

Thu, 05 Nov 2026 00:00:00 GMT

capa, Ghidra, YARA-X and ILSpy answer different questions about a binary, per their repositories ^[1]^[2]^[3]^[4]. Start with a file you own or are authorized to inspect.

Identify the file before choosing the tool

Use capa to identify capabilities represented by its rules ^[1]. Ghidra supplies a reverse-engineering framework for inspecting compiled code ^[2]. YARA-X matches patterns expressed as rules ^[3]. ILSpy is a decompiler for .NET assemblies ^[4].

A .NET assembly is a good reason to try ILSpy first. A native executable may require a different tool. Read the supported formats in each project's documentation before downloading it.

Use an isolated inspection environment

Warning: An unfamiliar binary may be malicious. Keep it off your ordinary work machine and do not run it merely to find out what it does.

Download the tool from the repository's release links. Follow the runtime requirements for that release, particularly Ghidra's Java requirements ^[2]. Keep the original file unchanged and inspect a copy.

Treat the findings as leads

capa documents limits for packed and obfuscated files ^[5]. A rule match identifies a pattern to investigate; an empty result cannot establish that a file is harmless.

Record the file, tool version and relevant findings. That gives the next reviewer enough information to repeat the inspection without relying on a screenshot alone.

Check PHP deployments for the October security fixes

Thu, 05 Nov 2026 00:00:00 GMT

The PHP team says CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution. Its advisory covers PHP installations serving web requests, with the highest stated risk for Apache mod_php. ^[1]

Read the command-line version

The PHP manual documents the version option. ^[2]

bash

php -v

You should see the version of the PHP executable on your command path. ^[2] Check your hosting panel or service configuration separately to identify the web runtime.

Compare the deployment with its vendor notice

The upstream fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution vendors may backport fixes without using those version numbers. The PHP team directs those users to their vendor's updated packages. ^[1]

Warning: replacing a runtime can affect application compatibility. Follow your vendor's update procedure and check your application before resuming normal traffic.

Review the follow-up advisory

The October 23 notice recommends disabling session upload progress for an unusual serialization-handler combination until its fix. Read that notice against your configuration, even after applying the October 21 updates. ^[1]

Record the package installed and the web service running it, so the next check compares the deployment that actually serves requests.

Give Claude a reusable design system

Thu, 05 Nov 2026 00:00:00 GMT

A design system gives Claude reusable colors, typography, components and layout patterns, per Anthropic's setup guide. Open Design Agent Kit is a community repository of design systems, skills and examples that can provide starting material. ^[1]^[2]

Review one reference first

Browse the kit's design systems and read the selected files before using them. The repository is MIT-licensed, but it is a third-party project. Treat a brand-inspired example as reference material and adapt it to your own product. ^[1]

Choose the typography, spacing and component rules you want to retain. Avoid combining several unrelated visual systems in one generation request.

Use the current import path

Anthropic's current guide describes creating a design system from a chat using uploaded assets, connected apps, Figma files, decks, logos and fonts. For a React component system, it documents this Claude Code command: ^[2]

text

/design-sync

The command reads existing tokens and components. Check the guide's plan and organization requirements before starting. ^[2]

The carousel showed the older standalone Claude Design setup screens. Use the current help guide for the interface in your account. If you have an existing standalone design system, the guide also describes moving it into the Claude app. ^[2]

Check a small generated page

Generate one page and compare its type, colors, spacing and components with the source. Check narrow and wide screens before using the system across a site.

For the original post, I reached the setup page but did not run generation. That walkthrough is not evidence that the kit imports or renders correctly in every account. Keep the first trial small enough to inspect.

Keep coding agents away from production data

Thu, 05 Nov 2026 00:00:00 GMT

Replit acknowledged that its agent deleted data from Jason Lemkin's application database. Its July 2025 account says he restored the database through Rollback, despite the agent failing to explain that recovery option. ^[1]

The same account says development changes could affect production before Replit introduced separate databases by default. That is the part I would check in any agent setup. ^[1]

Check access before the next task

Use this checklist before handing an agent database work:

Give it development credentials. Check which database those credentials actually reach.
Remove production write access from the agent's environment.
Enforce a freeze through permissions and deployment approvals. A sentence in a conversation does not revoke credentials.
Review the proposed database changes before deployment.

These are checks I recommend for your setup, not a claim that every agent platform enforces them automatically.

Rehearse recovery

Replit documents checkpoints and rollback in its incident account. ^[1] Before you need recovery, find your provider's restore instructions and restore a backup into an isolated environment. Check that the expected records are present and the application can read them.

Write down who can restore production and where that procedure lives. The incident shows why asking the agent itself may be insufficient. ^[1]

Update Python tooling after the eMudhra certificate incident

Thu, 05 Nov 2026 00:00:00 GMT

Older pip installations can still trust the affected eMudhra certificates after an operating-system update. The Python security team explains that pip also loads its bundled certifi store. ^[1]

Update pip in each environment

Activate each existing virtual environment. The advisory supplies this wheel URL and checksum to bootstrap a fixed pip installation. ^[1]

bash

python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

Check the current advisory before rebuilding

The advisory now recommends at least certifi 2026.10.19, pip 26.2.2 and uv 0.13.6. It also lists updated Python releases, including 3.15.2, 3.14.10 and 3.13.18. These recommendations supersede the older versions in the video. ^[1]

Rebuild container images with layer caching disabled so the system certificate packages are refreshed. Review the advisory's separate instructions for macOS framework installations and other packaging tools you use. ^[1]

Updating one environment leaves the others untouched. Keep the advisory beside your environment list until every installation and rebuilt image has been covered.

Read the original ELIZA behind the chatbot story

Thu, 05 Nov 2026 00:00:00 GMT

ELIZA is easier to understand when you separate the conversation script from the program that runs it. The ELIZAGEN archive explains that Joseph Weizenbaum's original program interpreted scripts, with DOCTOR providing the familiar therapist-style conversation. ^[1]

Start with the recovered source

ELIZAGEN documents the recovery of the original code from Weizenbaum's papers at MIT. It was written in MAD-SLIP, rather than Lisp. The archive provides the code, a transcription and an annotated version, with permission from Weizenbaum's estate. ^[1]

Start with the annotated version linked from that page. Compare the interpreter with the separate DOCTOR script. This gives you something concrete to inspect when a reply seems surprisingly personal.

Read the paper with that distinction

Weizenbaum's 1966 paper included the DOCTOR script and described the algorithm. It did not publish the original interpreter. Later implementations can therefore differ from the recovered code. ^[1]

When trying an ELIZA demonstration, check which implementation it uses. Record a short exchange, then look for the rule or script entry responsible for the reply. I find that a more useful exercise than judging the program from one convincing sentence.

Review an agent design before writing the code

Thu, 05 Nov 2026 00:00:00 GMT

Google's Elephant Goldfish Model plugin drafts a specification with an agent that knows your project, then asks fresh reviewers to examine it without the earlier conversation ^[1]. It is intended for work that needs design decisions.

Install the complete plugin

The repository documents these terminal commands for Claude Code ^[1].

bash

claude plugin marketplace add google/elephant-goldfish-model
claude plugin install egm@egm

Start a new session after installing. The workflow needs an agent that can create fresh subagents ^[1].

Discuss the design before implementation

Choose a feature with unresolved behavior, such as webhook retries. Use the repository's brainstorm command, with the documented Claude Code prefix ^[1].

text

/egm:egm-brainstorm Add webhook delivery to this project.

The agent saves the agreed direction in concepts_brief.md ^[1].

Draft and review the specification

Continue with the documented draft command ^[1].

text

/egm:egm-draft

Then review the draft path returned by the agent. The README uses this example ^[1].

text

/egm:egm-review design_draft.md

Choose which findings to address and approve the design before implementation. You keep responsibility for the architectural trade-offs ^[1].

Check your TV before running a cleanup agent

Thu, 05 Nov 2026 00:00:00 GMT

CleanYourTV's agent workflow targets Android TV and Google TV. Its repository directs owners of Samsung, LG, Roku, Vizio and Hisense VIDAA televisions to separate settings instructions ^[1]. Start with the operating system your exact model runs.

Choose the instructions for your model

Check the TV's settings and model information. For a non-Android model, use the project's platform-specific privacy settings guide. It describes changes made with the remote, without installing the Android cleanup tool ^[2].

Preserve the restore information

For supported Android televisions, the repository's workflow backs up installed packages and settings before changes. It uses Android debugging and asks the owner to authorize the computer ^[1].

Warning: Disabling TV packages can remove behavior you use. Review the proposed package list and the documented restore procedure before approving changes ^[1].

Disable only what you have reviewed

The repository describes disabling packages with pm disable-user, rather than uninstalling them, and keeping a restore script ^[1]. Follow its current instructions for your model; a command list from another brand is not evidence that the same packages are safe to disable.

Keep the backup and restore instructions somewhere you can reach without the TV. Check the remote, inputs and apps you actually use before treating the cleanup as finished.

Choose alternatives for five developer tools

Thu, 05 Nov 2026 00:00:00 GMT

Choose a replacement around the job you need: API testing, a backend, deployment, design or issue tracking. The projects below document different requirements and operating costs. ^[1]^[2]^[3]^[4]^[5]

Run API collections with Bruno

Bruno's CLI runs collections, folders and individual requests. After installing its CLI and opening a collection directory, the documented command is: ^[1]

bash

bru run

Use a test environment when requests can modify data.

Plan a Supabase installation

The Supabase guide has an automated Linux setup and a manual Docker setup. The automated path installs prerequisites and asks for your service URLs. Review its secrets, HTTPS and update instructions before exposing an instance. ^[2]

Check a server for Coolify

Coolify documents a minimum of 2 CPU cores, 2 GB RAM and 10 GB disk space for its own instance. Check the linked requirements against the applications you plan to host as well. ^[3]

Start a Penpot instance

With Docker and Compose installed, the Penpot guide provides these commands. Download and review the Compose file first. ^[4]

bash

curl -o docker-compose.yaml https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml

Then start the services:

bash

docker compose -p penpot -f docker-compose.yaml up -d

You should see Penpot at localhost:9001. Follow its backup and HTTPS instructions before using it for production work. ^[4]

Select Plane's intended edition

Plane's main Docker guide starts with Commercial Edition. Its separate Community Edition section downloads a different setup script. Follow that section if you want Community Edition; do not assume the first installer selects it. ^[5]

Before moving real projects, check how you will export data and restore a backup from each tool you choose.

Choose tools for five marketing jobs

Thu, 05 Nov 2026 00:00:00 GMT

Self-hosting marketing software puts its setup and maintenance on your server. Start with one job and its documented requirements before moving the rest of your workflow. ^[1]^[2]^[3]^[4]^[5]

The listmonk docs require PostgreSQL and provide a Compose file. Download it into a dedicated folder and customize the configuration before starting it. ^[1]

bash

curl -LO https://github.com/knadh/listmonk/raw/master/docker-compose.yml

After reviewing that file:

bash

docker compose up -d

You should see the admin setup at localhost:9000, per the installation guide. ^[1]

Choose an Umami installation

Umami documents source, Docker Compose and prebuilt-image options. Its source installation needs a PostgreSQL connection in DATABASE_URL. Change the initial admin password after the first login. ^[2]

Configure a short domain for Shlink

Shlink's Docker guide requires your short domain, an HTTPS setting and a GeoLite2 licence key. Read its database and persistence options before deploying the example container. ^[3]

Prepare an Ubuntu server for Formbricks

The Formbricks setup guide targets Ubuntu and installs its dependencies, including Docker and PostgreSQL. Use the linked guide to check the server requirements before running its installer. ^[4]

Configure Postiz before starting it

The Postiz docs begin with this repository. ^[5]

bash

git clone https://github.com/gitroomhq/postiz-docker-compose

Open the cloned folder, configure the Compose variables, then run the documented start command from that folder. ^[5]

bash

docker compose up

You should see the frontend at localhost:4007 unless you changed that setting. Configure the required social-platform apps before trying to schedule posts. ^[5]

Understand what MCP connects

Thu, 05 Nov 2026 00:00:00 GMT

MCP gives AI applications and external systems a common way to communicate. Anthropic introduced the Model Context Protocol on November 25, 2024, to reduce the custom integrations needed for each data source. ^[1]

On December 9, 2025, Anthropic announced its donation to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI. ^[2]

Follow one connection

The protocol's architecture uses three participants. The host is your AI application. It creates an MCP client to connect to a server, which exposes capabilities such as tools and resources. A host can maintain several of these client connections. ^[3]

For example, a database server can expose a query tool and a resource describing the schema. MCP defines how the application discovers and calls those capabilities. ^[3]

Check the server before enabling it

I would check who operates the server, what credentials it needs and which actions it exposes. Give a read-only task read-only access where the service supports that restriction. A common protocol does not establish that a particular server deserves your credentials.

The architecture documentation also distinguishes local STDIO connections from remote Streamable HTTP connections. Check which transport your application supports before copying a server configuration. ^[3]

Read startup files before opening an unfamiliar repository

Thu, 05 Nov 2026 00:00:00 GMT

JFrog reported 42 compromised third-party repositories containing execution hooks for coding assistants and editors ^[1]. Read the startup configuration before trusting a repository in your tools.

Inspect the files from the post

JFrog's investigation names these paths among the campaign's execution points ^[1].

text

.claude/settings.json
.cursor/mcp.json
.vscode/tasks.json
.gemini/settings.json
.github/init.js

Look for startup commands, unfamiliar servers and scripts they invoke. This is a starting list: JFrog also names other locations, including Cursor rules, Makefiles and composer.json ^[1].

Disable Claude Code hooks for inspection

Claude Code documents this one-run setting, which takes precedence over project and local settings ^[2].

bash

claude --settings '{"disableAllHooks": true}'

Managed hooks controlled by an administrator are an exception. This setting also does not disable other editors' tasks or MCP servers ^[2].

In a trusted Claude Code session, the hook menu shows configured hooks and their source ^[2].

text

/hooks

Preserve evidence if you find the campaign

Warning: JFrog reports a token-revocation wiper. Its response guidance says to remove net-health-checker and pkg-runtime persistence before revoking the stolen GitHub token ^[1]. Follow the incident-specific sequence with your security responder; do not run the suspect files.

The same report recommends preserving commit, workflow and artifact metadata before cleanup ^[1]. Your review should cover both the visible startup file and the code it launches.

Check the MCP reference server security release

Thu, 05 Nov 2026 00:00:00 GMT

The MCP reference servers' v2.1.0 release includes security fixes for Filesystem, Everything and Fetch. The repository release number differs from each published package version. ^[1]

Check the installed packages

That release lists these patched packages: ^[1]

@modelcontextprotocol/server-filesystem: 2.0.1.
@modelcontextprotocol/server-everything: 2.0.1.
mcp-server-fetch: 2026.10.24.

The TypeScript packages changed from date versions to semantic versions. Package managers sort 2.0.1 below a 2026.x version, so an ordinary upgrade check can miss the fix. The release gives this explicit installation example: ^[1]

bash

npm install @modelcontextprotocol/server-filesystem@2.0.1

These are the versions in that security release, not a claim that they will remain the newest. Check subsequent releases before changing an existing installation. ^[1]

Review what changed

The release fixes filesystem path handling, HTTP request handling in Everything, and Fetch checks involving internal addresses and redirected robots.txt requests. Read its linked advisories for the affected paths. ^[1]

Check the Windows limitation

The filesystem advisory says version 2.0.1 anchors writes to the validated directory on Linux and macOS. On Windows, a concurrently replaced directory junction can still redirect certain writes outside the allowed folders. ^[2]

The advisory recommends avoiding allowed directories that another user or an untrusted local process can write to on Windows. Do not treat a package update as removal of that documented limitation. ^[2]

After updating, review the package referenced by your client's actual launch configuration and restart the client. A separate package installation does not prove an existing process is running the new version.

Use GPT-6.1 Terra in GitHub Copilot

Thu, 05 Nov 2026 00:00:00 GMT

GitHub announced GPT-6.1 Terra in Copilot on October 26, 2026, describing it as an option for everyday coding and terminal tasks. Availability covers Pro, Pro+, Max, Business and Enterprise plans. ^[1]

Select the model

Open your Copilot model picker and look for GPT-6.1 Terra. GitHub lists VS Code, Visual Studio, Copilot CLI and other supported surfaces. The announcement says rollout is gradual. ^[1]

If your organization manages Copilot, check its model policy. Business and Enterprise administrators control model access in Copilot settings. ^[1]

Read the full token rate

On November 5, 2026, GitHub's default-tier rates per million tokens are: ^[2]

GPT-6.1 Terra: $1 input and $5 output.
GPT-6.1 Sol: $2 input and $10 output.
GPT-6 Astra: $10 input and $50 output.

These figures exclude cache read and cache write rates. Long-context tiers also differ. GitHub converts token usage to AI credits at $0.01 per credit; check the linked table before estimating a job. ^[2]

Compare it on a scoped task

OpenAI positions Terra around speed, cost and computer-based work. Treat those as the provider's description, then try a small task with clear acceptance criteria in your own repository. ^[3]

Review the diff and run the project's checks before accepting the result. Compare correctness and total usage on the same task if you try another model.

Check the affected Claude Code extension in Cursor

Sun, 01 Nov 2026 03:16:16 GMT

Cursor's notice, updated 2026-10-30, identifies malicious marketplace builds of Anthropic.claude-code 2.1.312 and 2.1.313 on macOS and Windows ^[1]. Both versions need attention if installed during the incident window on 2026-10-29.

Check the SSH indicator

Cursor identifies svc-telemetry in authorized keys as an indicator. Its macOS check is ^[1]:

bash

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

You should see one of those messages. Treat a negative result as this indicator's result; review Cursor's other indicators if the affected extension was installed. Windows users should use the PowerShell check in Cursor's notice ^[1].

Follow remediation for affected hosts

Warning: Cursor says uninstalling alone may leave persistence. Isolate hosts showing compromise and use the platform-specific remediation script linked from its notice ^[1].

The macOS instructions run the downloaded script as the affected user, without root ^[1]:

bash

bash remediate-macos.sh

Cursor says the scripts return a nonzero status if anything remains. Rotate accessible credentials from a trusted system and assess whether the host needs rebuilding ^[1].

Set up a private Hermes WhatsApp bot

Sun, 01 Nov 2026 03:16:16 GMT

Hermes documents two WhatsApp connections: a Baileys bridge and the Business Cloud API ^[1]^[2]. I would choose the official integration for a business bot; the bridge's documentation warns about account restrictions ^[1].

Choose the official integration for business use

Hermes documents a setup wizard for the Cloud API ^[2]:

bash

hermes whatsapp-cloud

You need a Meta Business account, a WhatsApp-enabled Meta app and a public HTTPS endpoint. The wizard checks credentials and explains the remaining webhook setup ^[2]. Continue with the linked Cloud API guide if this is your choice.

Pair a dedicated number for the bridge

For the alternative bridge, the docs require Node 18 or later and WhatsApp on a phone ^[1].

Warning: This integration emulates WhatsApp Web. Hermes warns about account restrictions and recommends a dedicated number ^[1].

bash

hermes whatsapp

You should see a QR code. In the bot account's WhatsApp settings, open Linked Devices and link it. The wizard confirms pairing ^[1].

Limit who can reach the bot

Before starting the gateway, merge the documented settings into ~/.hermes/.env. Replace the example number with an allowed sender's country-code number, without + or spaces ^[1].

~/.hermes/.env

WHATSAPP_ENABLED=true
WHATSAPP_MODE=bot
WHATSAPP_ALLOWED_USERS=15551234567

Hermes says unauthorized direct messages can receive pairing replies by default. Its configuration reference documents this override to keep those messages silent ^[3]:

~/.hermes/config.yaml

whatsapp:
  unauthorized_dm_behavior: ignore

Start the gateway

The bridge guide documents the foreground command ^[1]:

bash

hermes gateway

Protect ~/.hermes/platforms/whatsapp/session as credentials. Hermes advises against unsolicited automated outbound messages ^[1]. You now have an explicit sender list and a configured response policy for strangers.

Check MCP Inspector security fixes before connecting

Sun, 01 Nov 2026 03:16:16 GMT

MCP Inspector's 2026-10-21 advisories describe remote servers or apps triggering local command execution ^[1]^[2]^[3]. Check the installed version before connecting it to an unfamiliar server.

Match your version to the advisory

The OAuth callback advisory lists versions 0.13.0 through 1.0.2 as affected and 1.0.3 as patched. It describes a remote server changing the connection transport during authorization ^[1].

The remote MCP App advisory lists versions 0.20.0 through 1.0.2 as affected, also patched in 1.0.3. It describes an app obtaining the proxy token and reaching local command execution ^[2].

For the v2 line, the Windows and WSL advisory covers 2.0.0 through 2.11.0 and lists 2.12.0 as patched. That issue can trigger during connection through the server's authorization URL ^[3]. These are fixes for the named advisories, not a guarantee against every vulnerability.

Choose the maintained release line

The repository says its main line tracks released v2, while v1 receives security fixes. Its documented web launcher is ^[4]:

bash

npx @modelcontextprotocol/inspector

Warning: Moving from v1 to v2 changes CLI flags, configuration and Node requirements. Read the migration guide linked from the README before replacing an existing setup ^[4].

If you need the maintained v1 line, the repository documents this separate tag ^[4]:

bash

npx @modelcontextprotocol/inspector@v1-latest

Confirm the resolved package version against the advisories before connecting. Do not assume a saved launcher command proves which version you have.

Review stored credentials

The README says Inspector stores secrets in the OS keychain when available. Without one, it can use ~/.mcp-inspector/secrets.json, unencrypted unless you supply a key. Follow its linked storage instructions before entering credentials ^[4].

You now have the affected ranges and release paths needed to check your setup before opening a connection.

Control Claude Code idle compaction

Sun, 01 Nov 2026 03:14:39 GMT

Claude Code can replace a long idle conversation with a summary before you return, per Anthropic's settings reference ^[1]. You can turn that behavior off without changing every compaction setting.

Open the idle compaction setting

In the terminal, open the configuration menu and change the Idle compaction row. Anthropic says this row requires Claude Code v2.1.302 or later, saves to user settings and takes effect immediately ^[1].

text

/config

You should see the row when it is available. The docs say another settings source or unavailable feature flags can explain a missing row ^[1].

Set the preference in JSON

For file-based configuration, merge this field into your settings. The setting requires v2.1.290 or later ^[1]. User settings apply across projects, subject to higher-priority configuration ^[3].

~/.claude/settings.json

{
  "idleCompaction": false
}

To restore idle compaction, change the value to true ^[1].

Check which settings loaded

Anthropic recommends /status when a setting appears to be ignored ^[3].

text

/status

You should see which configuration sources loaded. A managed or project setting can override your user preference ^[3].

Decide when to compact manually

The prompt-caching docs recommend compacting at a natural break. Compaction makes a separate summary request; cached history can reduce its input cost, while expired history must be processed again ^[2].

text

/compact

Idle compaction requires an eligible session, automatic compaction enabled, a one-hour cache lifetime, available feature flags, the context threshold and an awake computer after about an hour idle. The documented default threshold is 200,000 tokens ^[1].

You now control idle compaction separately and have a manual command for the next natural break in your work.

Use assisted permissions in Copilot and Claude Code

Sun, 01 Nov 2026 03:14:39 GMT

Copilot assisted permissions and Claude Code auto mode can review actions before they run, according to their docs ^[1]^[2]. I would start with a single session so you can see which requests still reach you.

Enable assisted permissions for one Copilot session

GitHub documents this command for the interactive CLI ^[1]. Enter it at the Copilot prompt.

text

/permissions assisted

Check the active mode:

text

/permissions show

You should see the session's permission mode. Eligible requests get a model review; requests requiring your decision still prompt you. Existing deny rules and enterprise restrictions remain in force ^[1].

Make Copilot remember your preference

For new interactive sessions, GitHub documents this setting in your user configuration. Merge the field into your existing file ^[1].

~/.copilot/settings.json

{
  "defaultPermissionMode": "assisted"
}

Managed defaults can take precedence, and resumed sessions retain their saved mode. To return the current session to manual review, enter ^[1]:

text

/permissions manual

Check Claude Code's rules

Anthropic documents this command for inspecting permission rules and their source files ^[3]. Use it before changing how actions are approved.

text

/permissions

You should see the configured rules. A matching ask rule can still require approval in auto mode ^[2]^[3].

Start Claude Code with auto mode

Anthropic documents the permission-mode flag for selecting auto mode ^[2]. Run it in your project terminal.

Warning: Auto mode allows actions after model review. Anthropic explicitly says it does not guarantee safety; keep sensitive operations under review ^[2].

bash

claude --permission-mode auto

If auto mode is unavailable, check the account, model and administrator requirements on the linked permission-mode page. Do not substitute bypass permissions to get past that refusal ^[2].

Your next session now uses the mode you chose. Keep /permissions available when an unexpected approval or denial needs inspection.

Audit an existing page with Hallmark

Sun, 01 Nov 2026 03:14:39 GMT

Hallmark can audit an existing page before changing it, according to its README ^[1]. I would use that report to choose a specific design problem before asking for a redesign.

Install the skill

The README documents this global installation, requiring Node 18 or later. It installs across projects; omit -g for the current project only ^[1].

bash

npx skills add nutlope/hallmark -g

For Claude Code, the documented install location is ~/.claude/skills/hallmark. Other supported agents have their own invocation conventions ^[1].

Audit the existing page

Run this in Claude Code, replacing the example path with your page. The README says audit reports findings without redesigning ^[1].

text

/hallmark audit ./index.html

You should get a report to review before requesting edits. Hallmark's skill instructions give an existing root design document priority, followed by the project's established visual choices ^[2]. Keep your approved design rules available to the agent.

Enable browser checks when needed

The README says rendered checks need Chrome and this package. Static checks remain available without them ^[1].

bash

npm i -g puppeteer-core

Request a redesign deliberately

Use the README's redesign command when you want changes ^[1].

Warning: This requests edits to your page. Keep a recoverable copy of your work before running it.

text

/hallmark redesign ./src/app

The README describes preserving content and behavior while changing layout and appearance ^[1]. Check the resulting links and forms yourself before accepting the result. Your audit gives you specific findings to compare against that revision.

Review what your AI assistant's browser can access

Sun, 01 Nov 2026 00:00:00 GMT

An AI assistant's embedded browser can expose more than the page you opened. In its 2026-10-29 EMBRACE report, Forever Security described flaws in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. I would review that browser's access before opening an unfamiliar project's preview. ^[1]

Identify the browser integration you use

Record the assistant, its installed version and whether it opens pages inside the app. Forever Security's findings concern particular embedded-browser integrations. Naming an affected product does not establish that every version or browsing mode has the same flaw. ^[1] ^[2]

The technical report describes different outcomes: page content reaching Cursor's agent instructions, a spoofed address in GitHub Copilot, and local-file access in Codex, Claude Desktop and VS Code. These require different fixes. ^[2]

Check the disclosure date before deciding you are patched

Forever Security reported that Cursor had patched its finding on 2026-10-01 and GitHub Copilot had fixed the address spoof in build 1.1.29 on 2026-10-13. It described Codex and VS Code findings as open when it published on 2026-10-29. Those are the researcher's dated statements, not a current patch inventory. ^[1]

Compare your installed build with the vendor's current security notices and release notes. If you cannot find a notice covering the reported browser issue, do not infer that an unrelated update resolved it.

Review local previews as untrusted input

The technical analysis describes local HTML reading files beyond the intended project. In the Claude Desktop and VS Code cases, the researchers reported that restrictions applied to the page but missed background workers. A worker is a script the page starts separately. ^[2]

Before opening an unfamiliar repository's preview, inspect what it loads and which files the assistant can reach. I would use a separate disposable environment without personal credentials for untrusted examples. That limits what is exposed; it does not repair a browser vulnerability.

Inspect the action behind an approval

The Cursor finding used page-supplied text to influence the agent's instructions. GitHub Copilot's finding concerned what address the integration showed to the agent and user. A familiar-looking page or an assistant-generated link is insufficient evidence that the next action is safe. ^[2]

Read the actual command, destination and requested file access before approving an action. If an organization manages your machine, give its security team the installed version and the relevant finding so they can decide which browser features to restrict while checking the vendor's response.

Compare both sides before accepting AI advice

Sun, 01 Nov 2026 00:00:00 GMT

Write down your choice before asking an AI agent what it would do. That is my suggestion from the BOTHSIDES post, followed by asking for the strongest case on each side. It is a review habit, with no claim that it prevents bias. ^[3]

Anthropic's study, published on 2026-10-27, put 50 causal-inference analysts to work with Claude Code. A hidden coin flip assigned each agent a preference. Across four analytical choices, the analysts followed that preference 86% of the time, per the paper. These were choices with defensible alternatives, not questions with one correct answer. ^[1] ^[2]

Record your choice before reading the recommendation

Put your preferred option and the reason in a note before asking the agent to recommend one. Keep the note so you can compare it with your eventual decision. This is the first step I suggested in the post. ^[3]

The researchers did not record every participant's preference before the agent spoke, so they could not measure each person's change of mind. ^[1]

Ask for the strongest case for each option

Use the second part of my suggestion: ask the agent to argue each option. Read both arguments before accepting its recommendation. ^[3]

Anthropic reports that the agents rarely argued the alternative well. Its proposed future research includes agents that explain both sides or ask for the expert's view first. Those proposals were not tested as remedies in this experiment. ^[1]

Compare your reasons with the agent's reasons

Return to your note and identify which reasons changed. If you keep an argument from the agent, say where it came from when you explain the decision. I suggest keeping that comparison with the work so someone reviewing it can see what changed.

In the paper's follow-up survey, 77% of analysts repeated an agent argument in at least one answer, while 15% credited the agent anywhere. ^[2]

Keep the study's limits with the claim

Treat the 86% result as a result from this experiment. Anthropic deliberately strengthened the agents' preferences and studied one task with one model. It does not establish how often developers defer to agents in ordinary coding sessions. ^[1]

You now have your original choice beside the arguments you considered and a reason for the decision you kept.

Add five skill sets to Claude Code

Sun, 01 Nov 2026 00:00:00 GMT

Superpowers, frontend-design, Karpathy-inspired rules, webapp-testing and document skills cover different jobs in Claude Code. I suggest starting with the one that fits your next task, then reviewing its output before adding more. The installation commands below come from the maintainers' repositories. ^[1] ^[2] ^[4]

Enter these commands inside Claude Code, not in your shell.

Install Superpowers for a planned implementation

Per the Superpowers repo, its workflow starts by clarifying the requested change, gets your approval on a design, then prepares a plan with tests and review. Install it from Claude's official plugin marketplace: ^[1]

text

/plugin install superpowers@claude-plugins-official

Give Claude a development task with a clear outcome. The repo says its skills activate automatically. You should see design discussion before implementation; inspect the proposed scope before approving it. ^[1]

Add frontend-design for a specific visual brief

Register Anthropic's marketplace, then install its example bundle. These are the repository's commands. The bundle contains both frontend-design and webapp-testing, along with other example skills. ^[2] ^[6]

text

/plugin marketplace add anthropics/skills
/plugin install example-skills@anthropic-agent-skills

Anthropic says you can invoke an installed skill by mentioning its name. Ask Claude to use frontend-design and supply the page's purpose, audience and real content. ^[2] ^[3]

The skill calls for a design plan covering typography, colors and layout before implementation. Check that those choices fit your brief. It also asks for mobile support, keyboard focus and reduced-motion support, so include those in your visual review. ^[3]

Review the Karpathy-inspired rules before installing

The community implementation at multica-ai/andrej-karpathy-skills turns Karpathy's observations about coding agents into guidance on assumptions, small changes and verifiable outcomes. This is the implementation linked here; the caption's name alone does not identify a repository. ^[4]

Its README still gives the earlier forrestchang address, which redirects to the current repository. These are its plugin installation commands: ^[4]

text

/plugin marketplace add forrestchang/andrej-karpathy-skills
/plugin install andrej-karpathy-skills@karpathy-skills

Per the repo, this makes the skill available across projects. Read it alongside your existing project rules before using it. For a small change, check the resulting diff: unrelated edits and unnecessary abstractions are exactly what these guidelines ask the agent to avoid. ^[4]

Use webapp-testing on a running local page

If you installed the example bundle above, webapp-testing is already included. Mention the skill and give Claude your local page address plus the interaction to check. ^[2] ^[6]

Anthropic's skill uses Python Playwright scripts. For a running dynamic app, it instructs the agent to wait for the page to load, inspect its rendered elements, and then interact with the discovered controls. It supports screenshots and browser logs. ^[5]

Review the test's actual actions and results. A screenshot can show the page rendered; checking that a button submits the intended data needs a test of that behavior.

Install document skills for the file you need

With Anthropic's marketplace already registered, install its document bundle: ^[2]

text

/plugin install document-skills@anthropic-agent-skills

The bundle contains docx, pdf, pptx and xlsx skills. Mention the matching skill and provide the file or describe the document you need. ^[2] ^[6]

Anthropic publishes these document skills as source-available, with different licensing from its open-source examples. It also tells users to test the examples in their own environment. Open the resulting file in its normal viewer and inspect the content and formatting before sharing it. ^[2]

Five Claude Code skills for marketing drafts

Sun, 01 Nov 2026 00:00:00 GMT

These five skills cover writing marketing pages, reviewing conversions, planning emails and editing a draft's voice. The install steps below come from their repositories. You still need to check the claims in the resulting copy ^[1]^[2]^[3].

Install Humanizer for a prose edit

Blader's Humanizer removes recurring AI writing patterns while preserving the meaning, per its README ^[1]. Run these commands inside Claude Code. The plugin requires Claude Code 2.1.142 or newer ^[1].

text

/plugin marketplace add blader/humanizer
/plugin install humanizer@humanizer

You should see the installed plugin available as /humanizer:humanizer, per the README ^[1]. Give it your draft and a writing sample so it has a voice to match.

Install the marketing collection for Copywriting

Corey Haines's Copywriting skill handles homepage and landing-page copy. Its instructions first check for product context and require claims to be supportable ^[3]. The repository documents this terminal command for installing the collection for Claude Code ^[2].

bash

npx skills add coreyhaines31/marketingskills -a claude-code

This installs the collection, including the next two skills. For Copywriting, give the agent the page you are writing, the audience and the evidence behind your offer ^[3].

Review a landing page with CRO

The current skill is named cro; the repository renamed page-cro and merged form review into it ^[2]. It examines marketing pages and forms for conversion problems, per its instructions ^[4]. Invoke it inside the agent, then supply the page and the action visitors should take ^[2]^[4].

text

/cro

Plan a sequence with Emails

The current name is emails, replacing email-sequence ^[2]. Its instructions cover welcome sequences and other automated email flows, including their timing and individual messages ^[5]. Start it inside the agent and supply the sequence's audience and goal ^[2]^[5].

text

/emails

Add Content Humanizer for brand voice

Alireza Rezvani's README provides these commands for its marketing bundle ^[6]. The bundle includes Content Humanizer, whose instructions ask for the draft, voice examples, audience and goal before editing ^[7].

text

/plugin marketplace add alirezarezvani/claude-skills
/plugin install marketing-skills@claude-code-skills

This adds the marketing bundle. Ask for its content-humanizer skill and provide your writing example ^[7].

The draft is ready for your factual review. Check its names, numbers and promises against the material you supplied before publishing it.

Reduce Claude Code tool output with three tools

Sun, 01 Nov 2026 00:00:00 GMT

RTK, Headroom and Context Mode each reduce the tool output sent to your model, according to their repositories ^[2]^[3]^[4]. I would try one at a time so you can check what changed and whether Claude still gets the details your task needs.

Check your current session usage

Run this inside Claude Code before changing your setup. Anthropic documents session token usage and estimated costs under /usage ^[1].

text

/usage

You should see usage information for your account and session. Per the docs, the session cost is an estimate; subscription billing does not use that estimate ^[1]. Save the figures alongside the task you asked Claude to do.

Try RTK for shell output

The RTK README documents a Homebrew install and a check that distinguishes this package from other tools named RTK ^[2]. Run these commands in your terminal.

bash

brew install rtk
rtk --version
rtk gain

You should see the installed version and RTK's savings dashboard ^[2]. Its Claude Code integration uses a hook to rewrite supported shell commands to RTK equivalents.

Warning: The following command changes your global Claude Code integration. The README says it also offers proxy configuration; review those choices before accepting them ^[2].

bash

rtk init -g

After using Claude, run rtk gain again to inspect RTK's recorded savings ^[2].

Try Headroom through its local proxy

Headroom's README documents an isolated install with uv. Its wrapper starts a local proxy and launches Claude through it ^[3].

Warning: The wrapper also installs Serena for code navigation and registers it for the Claude project in ~/.claude.json, per the README. Review that integration if you already manage MCP configuration ^[3].

bash

uv tool install --python 3.13 "headroom-ai[all]"
headroom wrap claude

Use another terminal to check the installation and routing with the documented health check ^[3].

bash

headroom doctor

Launch future sessions with headroom wrap claude when you want them routed through Headroom ^[3].

Try the Context Mode plugin

Context Mode's README describes running tools in a sandbox and keeping large results outside the conversation until needed. Install its Claude Code plugin by entering these commands inside Claude ^[4].

text

/plugin marketplace add mksglu/context-mode
/plugin install context-mode@context-mode

Restart Claude Code, then run the plugin's diagnostic command ^[4].

text

/context-mode:ctx-doctor

You should see its checks marked [x], per the README. After using the plugin, inspect its context statistics ^[4].

text

/context-mode:ctx-stats

You now have the chosen tool's statistics to compare with Claude Code's session usage. Repeat a comparable task and check the answer's correctness before deciding to keep that setup.

Set up Copilot Memory and review Dreaming

Sun, 01 Nov 2026 00:00:00 GMT

Copilot Memory can save a preference across sessions, but asking it to remember something does not guarantee it will store or use it. GitHub announced general availability on paid Copilot plans on 2026-10-28. I suggest starting with one preference you can check. ^[1] ^[2]

Ask Copilot to remember one preference

If Memory is enabled for your account, paste GitHub's example into a Copilot conversation. It tells Copilot how to format your pull request descriptions. ^[1]

text

Remember to start my pull request descriptions with a TL;DR

The model decides whether to save a memory. For guidance you need consistently, GitHub recommends custom instructions. State whether a new memory applies to you across projects or to everyone working in the current repository. ^[2]

Check whether the CLI allows memory

In an interactive Copilot CLI session, enter the command from GitHub's personal settings documentation. This is a Copilot command, not a shell command. ^[3]

text

/memory show

You should see the client setting and a link to manage stored memories on GitHub. A locally enabled setting does not override account or repository policies. ^[3]

If personal Memory is off, open your profile menu on GitHub, choose Copilot settings, and find Copilot Memory under Features. Enable it there if your organization allows it. The CLI can also have its own opt-out. ^[3]

Review what Copilot stored

Open your GitHub profile menu, choose Copilot settings, then Memory in the sidebar. Per GitHub's docs, this is where you review and delete personal preferences. Check whether the saved text says what you intended. ^[3]

For repository facts, open the repository's Settings, then Copilot, then Memory. GitHub requires write access and enabled personal preferences, including any required organization permission, to view or delete those facts. Repository memory controls are separate. ^[5]

Decide whether to enable Dreaming

Memory works without Dreaming. GitHub describes Dreaming as optional background maintenance that can revise or delete memories and propose changes to checked-in instructions through pull requests. Those files change only if you merge the pull request. ^[4]

Warning: every Dreaming run uses AI credits, including runs that change nothing. GitHub's initial public preview excludes Copilot Pro, requires access to GPT-6.1 Sol, and requires session syncing for personal memory curation and repository customization. Check those requirements and your spending controls before enabling it. ^[4]

For personal memories, open GitHub Settings, then Copilot, then Features. With Copilot Memory enabled, set the Dreaming dropdown to Enabled. This does not enable Dreaming for your repositories, and organization policies can prevent it. ^[3]

Inspect a Dreaming run before using its changes

In the Copilot app, open Automations, then Dreaming. Open a completed personal or repository run and inspect its memory changes. Repository runs appear for repositories you added to the app. GitHub schedules runs; refreshing the list does not start one. ^[5]

You should see the run status and, when available, memory additions, updates or removals. Open any linked pull request and review proposed instruction changes before merging. ^[5]

You have a place to inspect what Copilot remembers and a separate decision about whether to pay for background Dreaming runs.

Save web content as Markdown with Defuddle and Obsidian

Sun, 01 Nov 2026 00:00:00 GMT

Defuddle extracts a page's main content and can return Markdown for your notes. Its repository calls the tool a work in progress, so I suggest checking one extracted page before handing a collection to an agent. ^[1]

Install Defuddle and extract one page

With Node.js and npm available, run the global installation command from Defuddle's README. The second command is its Markdown example for a public article. ^[1]

bash

npm install -g defuddle

bash

curl -L https://stephango.com/saw | npx defuddle parse --markdown

You should get extracted Markdown in the terminal. Compare it with the source page before saving it as a note. Check that headings, links and the paragraphs you need survived. The README says Defuddle removes page clutter; that is not a guarantee that every extraction preserves everything you want. ^[1]

Save the reviewed text in your Obsidian vault and retain the original URL so you can check the source later.

Add the Obsidian skills to your agent

The Obsidian skills repository documents this HTTPS installation command: ^[2]

bash

npx skills add https://github.com/kepano/obsidian-skills

Its skills cover Obsidian Markdown, Bases, JSON Canvas, the Obsidian CLI and Defuddle. Use the skill appropriate to the file you are working on; an ordinary note needs different instructions from a canvas. ^[2]

Ask the agent to work on the note you saved, then open the result in Obsidian. Check that its links resolve and that the text still agrees with the source. Review the change before letting the agent edit the rest of your vault.

Review Second Brain OS before adding automation

The caption includes this command to add the project's skills: ^[5]

bash

npx skills add undefined-ui/second-brain-os

The repository's full setup also includes a starter vault, commands, agents and supporting scripts. Installing skills alone does not reproduce that setup. Its README specifically says its maintenance commands need scripts copied into the vault. Follow the linked quickstart when you want those features. ^[3]

Per the repository, the workflow keeps source material separate from linked wiki notes. Start with a copy of your notes and inspect the first changes. Keep the source article available when checking whether an agent's summary or cross-reference is correct. ^[3]

Try Tolaria separately if you prefer its editor

Tolaria can open a folder of Markdown files as a vault. It is optional for this workflow. On macOS with Homebrew installed, its official documentation gives this command: ^[4]

bash

brew install --cask tolaria

Open Tolaria and choose its Getting Started vault to inspect the app before opening your notes. The official guide also provides desktop downloads for Windows and Linux. ^[4]

Use a copied folder for the first comparison. Open a note in both editors and check its formatting and links before choosing where to maintain the originals.

Run a Claude Code sprint with gstack

Sun, 01 Nov 2026 00:00:00 GMT

Garry Tan's gstack gives Claude Code separate skills for planning, code review and QA. The repository documents a sprint that passes work between them ^[1].

Review setup and install

The install docs require Claude Code, Git and Bun, and recommend Bun v1.4.2 or later. Windows also needs Node.js ^[2].

Warning: ./setup registers hooks in ~/.claude/settings.json, including a default Stop hook. Review the installer's hook details before running it ^[2].

The repository's personal install command is ^[1]:

bash

git clone --single-branch --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack && cd ~/.claude/skills/gstack && ./setup

Describe the problem before building

In Claude Code, run each skill separately and answer its questions before continuing. The documented order is ^[1]:

text

/office-hours
/plan-ceo-review
/plan-eng-review

You should get a design document from /office-hours and an engineering plan covering data flow and tests from /plan-eng-review ^[1]. Approve the plan before asking Claude to build.

Review and test the changes

After implementation, run these separately. Give /qa your staging URL or an isolated local target ^[1]:

text

/review
/qa

The README says both skills can fix code, so inspect their changes ^[1].

Ship and review the sprint

Warning: /ship runs the release workflow, including tests and a pull request. Use it when the changes are ready ^[1].

text

/ship

For the repository's retrospective workflow, run ^[1]:

text

/retro

You can use that report to choose what to change in the next sprint ^[1].

Skip idle Hermes cron agent runs

Sun, 01 Nov 2026 00:00:00 GMT

Hermes can skip an agent run when a scheduled script finds nothing new, per its cron docs ^[1].

Return the skip signal

Have your pre-check script emit this as its final stdout line when nothing needs processing ^[1]:

json

{"wakeAgent": false}

The docs say Hermes skips that tick's agent. Omitting wakeAgent defaults to waking it. Your script still needs to detect changes ^[1].

Attach your pre-check

Ask Hermes to create a job with your script attached. The docs' feed example uses script="feed-changed.sh" and schedule="every 30m"; its script lives under ~/.hermes/scripts/ ^[1].

Check the registered job:

bash

hermes cron list

Check the scheduler

The gateway must be running for scheduled agent jobs. Inspect its status ^[1]:

bash

hermes cron status

You should see scheduler health and the next scheduled run ^[1].

For tasks fully handled by a script, the docs also provide --no-agent. After supplying memory-watchdog.sh and configuring Telegram delivery, their example is ^[1]:

bash

hermes cron create "every 5m" \
  --no-agent \
  --script memory-watchdog.sh \
  --deliver telegram \
  --name "memory-watchdog"

That job delivers script output directly, without starting an agent ^[1].

Set up a local AI phone agent on Apple Silicon

Sun, 01 Nov 2026 00:00:00 GMT

ai-phone runs speech recognition, a language model and speech synthesis on an Apple Silicon Mac, per its README ^[1]. Start with a local SIP call. Its README says live-carrier acceptance checks remain pending ^[1].

The repository requires macOS on Apple Silicon, Git, Homebrew and uv. It recommends 16 GB RAM for the default model, with a smaller option for 8 GB systems. Model downloads need several GB of disk space ^[1].

Clone and install ai-phone

The installer sets up Python dependencies and the native SIP library, per the README ^[1]. SIP is the protocol used to connect the call.

bash

git clone https://github.com/oxnw/ai-phone.git
cd ai-phone
./scripts/install.sh

Choose a local model and SIP address

The setup wizard chooses call directions, model, line and voice ^[1]. For the local call, enable incoming calls, select "A SIP address" and keep the name agent, as the usage guide describes ^[2]. Choose the local model option to keep the conversation processing on the Mac ^[2].

bash

uv run ai-phone setup

You should see prompts for those choices and model downloads ^[1]. The usage guide says setup saves configuration and secrets under ~/.ai-phone/ ^[2].

Start the phone agent

The usage guide requires the daemon to stay running for incoming calls. Setup does not install a background service ^[2].

bash

uv run ai-phone run

You should see the daemon state where the call's text will go when it starts, per the usage guide ^[2].

Call it from another terminal

Keep the daemon running. In a second terminal, use the repository's local-call command ^[1]^[2].

bash

pjsua --local-port 5070 sip:agent@127.0.0.1

The guide describes this as a local call without a carrier. If you chose a different SIP name, substitute that name for agent ^[2].

You can now evaluate a local call before connecting a number. Telephone calls require a SIP trunk or carrier account, with charges. Audio travels over SIP/RTP. Choosing a remote language model sends conversation text to that provider ^[2].

The published Phonon measurements cover local loopback calls with no carrier registration or external model ^[3]. Treat them as the repository's local results when deciding what to try next.

Six AI coding tools, one for each job

Sat, 31 Oct 2026 00:00:00 GMT

Don't install 20 AI coding tools. Pick one per job, use it for a week, then add the next. Here are six, with the install line for each from its own README.

Warning: plugins and MCP servers can run code on your machine. Read what each one adds before you install it.

Know what you spend with ccusage

ccusage reads Claude Code's local logs and shows your token use and cost ^[1]. Nothing to install, it runs through npx:

bash

npx ccusage@latest

You should see a table of usage by day, with tokens and an estimated cost for each.

See your context with Claude HUD

Claude HUD adds a status line to Claude Code that shows how full the context window is and what's running ^[2]. It installs as a plugin. Inside Claude Code, run these one at a time:

text

/plugin marketplace add jarrodwatts/claude-hud
/plugin install claude-hud
/reload-plugins
/claude-hud:setup

You should see the HUD appear at the bottom of the Claude Code screen.

Give AI the whole repo with Repomix

Repomix packs a repository into one file you can hand to any AI model ^[3]. Run it in the repo's root:

bash

npx repomix@latest

You should see a new repomix-output.xml in the current folder. To keep using it, npm install -g repomix or brew install repomix installs it for good ^[3].

Debug in real Chrome with Chrome DevTools MCP

The Chrome DevTools MCP server lets Claude Code open Chrome, read the console and network, and check what it built ^[4]:

bash

claude mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest

You should see chrome-devtools listed when you type /mcp in Claude Code.

Review the diff with lazygit

Before you commit what an agent wrote, read it. lazygit is a terminal UI for git that makes the diff quick to scan and stage ^[5]:

bash

brew install lazygit
lazygit

Run lazygit inside a git repository. You should see files, branches and the diff in panes.

Review every PR with Claude Code Action

The Claude Code GitHub Action reviews pull requests and answers @claude mentions ^[6]. The quickest setup is from Claude Code itself, as a repository admin:

text

/install-github-app

It walks you through installing the GitHub app and adding the secret. This path is for direct Anthropic API users; Bedrock, Vertex and Foundry have their own setup in the repo's docs ^[6].

That's one tool for each job. Add one this week and leave the rest until it earns its place.

Lock Claude Code out of your .env

Fri, 30 Oct 2026 00:00:00 GMT

Claude Code can read your .env file, and a line in CLAUDE.md asking it not to won't stop it. These four steps do. I tested them on Claude Code 2.1.312 with fake keys only.

Start it in your project folder

Claude Code works from the folder you start it in. Start it in your project, not your home folder, so your other projects and dotfiles aren't in reach to begin with.

bash

cd ~/code/my-app
claude

You should see your project's path in the Claude Code header.

Add deny rules to settings.json

Create .claude/settings.json in the project (or add to it) and deny reads of your env files and key folders ^[1]. Deny rules are checked before allow rules, and an allow rule can't make an exception to a deny rule. The file is strict JSON: no comments and no trailing commas ^[3].

.claude/settings.json

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ]
  }
}

Commit this file so everyone on the project gets the same rules. Deny rules apply right away, even before someone trusts the folder ^[3].

In my test, the Read tool was refused. You should see Claude Code report that reading .env is denied by your settings.

Turn on the sandbox

Read deny rules cover Claude's own file tools and the shell commands Claude Code recognizes, such as cat, head and tail. They don't cover a script that opens the file itself ^[1]. In my test, a short Python script still printed the fake keys past the deny rule.

The sandbox fixes that at the operating system level ^[2]. Add it to the same file:

.claude/settings.json

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "denyRead": ["./.env", "~/.ssh", "~/.aws"]
    }
  }
}

Or type /sandbox inside Claude Code to turn it on interactively. The sandbox works on macOS, Linux and WSL2. On Linux and WSL2 it needs two packages first ^[2]:

bash

sudo apt-get install bubblewrap socat

Warning: if the sandbox can't start, Claude Code runs commands without it unless you also set "failIfUnavailable": true inside "sandbox" ^[2].

With the sandbox on, the same Python script got Permission denied in my test.

Check that it worked

Put a fake key in .env, then ask Claude Code to read it, both directly and through a script.

bash

echo "API_KEY=fake-123" > .env
claude

text

Read .env and tell me what API_KEY is.
Run: python3 -c "print(open('.env').read())"

You should see the first request refused by your deny rule and the second fail with Permission denied. Type /permissions to see every rule that's active.

Rotate any key it already saw

If Claude Code read a real .env before you did this, treat those keys as exposed. Create new keys in each provider's dashboard, put them in .env, and revoke the old ones. The rules above stop the next read; they can't undo an earlier one.

Your .env, ~/.ssh and ~/.aws are now off limits to Claude Code's tools and to anything it runs in the sandbox.

Where each Claude Code instruction belongs

Thu, 29 Oct 2026 00:00:00 GMT

Your CLAUDE.md says "never do X", and Claude can still do X. CLAUDE.md is guidance; hooks are enforced. Here's where each kind of instruction belongs, per the Claude Code docs.

Keep CLAUDE.md to facts

Put the facts Claude needs in every session in CLAUDE.md: build commands, conventions, project layout. The docs say to target under 200 lines, because longer files use more context and reduce how well Claude follows them ^[1]. Everything below moves out of it.

CLAUDE.md

# my-app

- Build: npm run build
- Test: npm test
- API code lives in src/api, UI in src/ui

Block a never with a PreToolUse hook

A hook runs your script before a tool call. If the script exits with code 2, the call is blocked and whatever it wrote to stderr goes back to Claude as the reason ^[2]. Add this to .claude/settings.json:

.claude/settings.json

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/protect-files.sh"
          }
        ]
      }
    ]
  }
}

Then the script, at .claude/hooks/protect-files.sh. Change the pattern to whatever must never be edited:

.claude/hooks/protect-files.sh

#!/bin/bash
file=$(jq -r '.tool_input.file_path // empty')
case "$file" in
  *.env|*.env.*|*package-lock.json)
    echo "Blocked: $file is protected" >&2
    exit 2
    ;;
esac
exit 0

bash

chmod +x .claude/hooks/protect-files.sh

The script needs jq (brew install jq on macOS). You should see Claude report "Blocked" when it tries to edit a protected file.

Run an always with a PostToolUse hook

For "always do Y after edits", run it after the tool instead of asking for it. This formats every file Claude edits, from the docs' own example ^[2]:

.claude/settings.json

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "jq -r '.tool_input.file_path' | xargs npx prettier --write"
          }
        ]
      }
    ]
  }
}

You should see edited files come back formatted without asking.

Turn a procedure into a skill

A 30 line procedure doesn't belong in every session's context. Put it in a skill, which Claude loads only when it's needed ^[3]. The folder name becomes the command:

.claude/skills/release/SKILL.md

---
description: Release checklist. Use when the user asks to cut or publish a release.
---

1. Run npm test and stop if anything fails.
2. Bump the version in package.json.
3. Update CHANGELOG.md with the merged pull requests.
4. Tag the commit and push the tag.

Save it as .claude/skills/release/SKILL.md. The --- must be the file's first line, or Claude Code won't read the frontmatter ^[3]. You should see /release when you type /.

Scope a rule to one folder

A rule that only matters in one part of the repo goes in .claude/rules/ with a paths list, so it only loads when Claude works on matching files ^[1]:

.claude/rules/api.md

---
paths:
  - "src/api/**/*.ts"
---

# API rules

- Every endpoint validates its input.
- Use the standard error response format.

Save it as .claude/rules/api.md. Rules without paths load at the start of every session ^[1].

Hand deep work to a subagent

Long searches and log analysis fill the main context with noise. A subagent does the work in its own context window and returns only the result ^[4]. Save this as .claude/agents/log-reader.md:

.claude/agents/log-reader.md

---
name: log-reader
description: Reads long logs and test output and reports only the errors and their likely cause.
tools: Read, Grep, Glob
---

Read the logs you are pointed at. Report each distinct error once, with the file and line,
and one sentence on the likely cause. Do not paste whole logs back.

Only name and description are required ^[4]. You should see Claude hand log questions to log-reader and get a short summary back.

Your CLAUDE.md is now short, the nevers are enforced by a hook, and everything else loads only when it's needed.

Full Byte Developer

Add drawing, diagram and film skills to your agent

01Install Anatomy for an interactive illustration

02Install Diagram Design for a diagram

03Install Lemo Opuscar for a film

Write skill metadata an agent can recognize

01Make the description say when to use it

02Keep the procedure in the body

03Check the behavior in a real task

Automate SEO drafts with an editor review

01Pick pages from search data

02Prepare an editing brief

03Save a WordPress draft

04Check the resulting page

Check Better Auth Magic Link and OAuth Proxy fixes

01Check the installed release and login configuration

02Check OAuth Proxy separately

03Upgrade the participating services together

Run five checks before merging AI-written code

01Scan the repository for secrets

02Check unused code and duplication

03Scan dependency files

04Keep the useful checks in hooks

Check packages before trusting an AI suggestion

01Review an npm package before installation

02Inspect package code with GuardDog

03Restrict lockfile download hosts

04Scan installed dependencies for advisories

Choose an AI workflow before building an agent

01Try one model call first

02Match the task to a workflow

03Add an agent loop only where needed

Compare Zapier, n8n and Activepieces

01Read the licence for your use

02Choose an n8n deployment path

03Inspect Activepieces setup

Choose an SEO skill for each job

01Audit the site

02Review AI search readiness

03Check structured data

04Plan pages built from data

05Research and write a post

Choose design skills for five UI tasks

01Set the visual rules

02Work on the interaction

03Use the component library correctly

04Review the finished interface

Use less context before raising your AI plan

01Start a fresh chat for unrelated work

02Match effort to the task

03Combine related questions

04Reuse project material

05Keep tools and thinking purposeful

06Check your own allowance

Use five built-in Claude Code shortcuts

01Inspect the context window

02Ask a side question

03Paste an image

04Read shell output in the session

05Open the rewind controls

Use Claude Code hooks for status notifications

01Choose events for each state

02Add a notification hook

03Check the configured hooks

Check five Claude Code compaction and sandbox fixes

01Check the installed version

02Four session fixes in 2.1.311

03Sandbox fixes in 2.1.309

Separate Claude Code sessions with Git worktrees

01Start the first isolated session

02Keep generated worktrees out of status

03Copy only the ignored files you need

04Review work before cleanup

Choose a Claude Code plugin for the task

01Add Superpowers for a development workflow

02Add Anthropic skills for documents

03Add Claude-Mem for session context

04Add UI UX Pro Max for interface work

Build a video with Claude Code and Remotion

01Start a Remotion project

Install Anatomy for an interactive illustration

Install Diagram Design for a diagram

Install Lemo Opuscar for a film

Make the description say when to use it

Keep the procedure in the body

Check the behavior in a real task

Pick pages from search data

Prepare an editing brief

Save a WordPress draft

Check the resulting page

Check the installed release and login configuration

Check OAuth Proxy separately

Upgrade the participating services together

Scan the repository for secrets

Check unused code and duplication

Scan dependency files

Keep the useful checks in hooks

Review an npm package before installation

Inspect package code with GuardDog

Restrict lockfile download hosts

Scan installed dependencies for advisories

Try one model call first

Match the task to a workflow

Add an agent loop only where needed

Read the licence for your use

Choose an n8n deployment path

Inspect Activepieces setup

Audit the site

Review AI search readiness

Check structured data

Plan pages built from data

Research and write a post

Set the visual rules

Work on the interaction

Use the component library correctly

Review the finished interface

Start a fresh chat for unrelated work

Match effort to the task

Combine related questions

Reuse project material

Keep tools and thinking purposeful

Check your own allowance

Inspect the context window

Ask a side question

Paste an image

Read shell output in the session

Open the rewind controls

Choose events for each state

Add a notification hook

Check the configured hooks

Check the installed version

Four session fixes in 2.1.311

Sandbox fixes in 2.1.309

Start the first isolated session

Keep generated worktrees out of status

Copy only the ignored files you need

Review work before cleanup

Add Superpowers for a development workflow

Add Anthropic skills for documents

Add Claude-Mem for session context

Add UI UX Pro Max for interface work

Start a Remotion project

Get timestamps for spoken words

Prepare a cutout when the scene needs one

Apply the post's optional grade

Write the facts the next session needs

Check the file in Claude Code

Keep the instructions current

Make a web deck with Frontend Slides

Edit Office files with OfficeCLI

Export Markdown with Marp

Connect GenOffice to your agent

Start a code talk with Slidev

Use SQL for a focused calculation

Use the data plugin for a guided analysis

Inspect a CSV with csvkit

Choose a browser or notebook view

Choose the reference for your product

Add the system in Claude Design

Review a real page before reusing it