Developer Rebuilds Claude Code Repo With Three-Layer Agent, Skill, Command System

·1 views

A developer known as nasrulhazim has overhauled his Claude Code configuration repository, renaming it from agent-skills to simply claude and expanding it from 14 skills to a three-layer system comprising 29 skills, 20 agents, and 10 commands. The upgrade addresses limitations discovered after months of daily use, including AI reviewers that would edit code instead of just flagging issues, and the inability to delegate repetitive tasks across multiple projects in parallel. The new structure separates concerns by role: skills define how tasks should be done, agents define who performs them with specific tool permissions, and commands trigger complete workflows on demand. A key safety improvement is that reviewer and auditor agents now ship with read-only tool allowlists, preventing Claude from modifying files during a review session. The updated system is installable via a single curl command and is also bundled into the developer's Kickoff project scaffolding tool starting with version 1.36.0.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Token Counts Can Expose Silent Failures in LLM Agents Returning HTTP 200

AI agents can return a successful HTTP 200 status with no errors in logs, yet produce no usable output — a phenomenon known as a silent failure. This occurs when a model triggers a refusal policy, generates whitespace, or successfully describes a failed tool call instead of returning expected data. Standard observability tools typically monitor HTTP status codes and miss these output-level failures entirely. Developers can detect such failures by cross-referencing output token counts with actual response content length, since a near-zero or mismatched token count signals something went wrong after the API call succeeded. A simple heuristic function comparing token spend against response content can flag these silent failures before they corrupt downstream pipelines or silently skip critical actions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Uses Claude AI to Cut Smart Contract Coding and Review Time

A software engineer with 20 years of experience across banking, blockchain, and digital forensics has detailed how he integrates Claude AI into his daily development workflow. He uses the AI tool as a pair programmer to generate boilerplate Rust code for Soroban smart contracts on the Stellar blockchain, reducing scaffolding work from a full day to roughly two hours. The engineer also employs Claude for adversarial security reviews, where it reportedly identified an integer overflow vulnerability in a reward-distribution loop that static analysis tools had missed. He applies strict prompt constraints — such as banning unwrap() calls — to ensure generated code meets production standards, which he says cut initial review cycles by about 40% across his last three projects. Additionally, he uses Claude to produce audience-tailored documentation, generating both business-facing and technical write-ups from a single code source.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LoRA-Based Preference Tuning Optimizes Style Over Reasoning, Researchers Warn

A technical analysis published on DEV Community argues that using low-rank adapters (LoRA) for preference optimization methods like DPO systematically biases language models toward superficial stylistic changes rather than genuine reasoning improvements. Because the low-rank constraint limits the update to a narrow subspace, the optimizer defaults to the cheapest signal separating good from bad outputs — typically tone, formatting, and hedging phrases. Full-rank fine-tuning can spread gradient signals across more independent directions, enabling deeper reasoning changes, but it remains computationally expensive and is rarely used in practice. The analysis warns that distilling from a LoRA-DPO model compounds the problem by permanently encoding these shortcuts into student models. The proposed remedy is not collecting more data but reconsidering how rank budget is allocated across the model's layers during preference tuning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Smartphone AI Pentesting Agent Can Flag Subdomain Takeover Risks Using WHOIS API

A local AI pentesting tool called Nightcrawler, designed to run entirely on a smartphone without cloud resources, has sparked interest in the cybersecurity community for its pocket-sized offensive-security capabilities. However, phone-based large language models lack the computing power to run full subdomain enumeration and DNS resolution pipelines independently. A proposed solution involves routing reconnaissance tasks to a lightweight backend API, specifically a Domain WHOIS API that bundles RDAP data, DNS records, SSL metadata, subdomain discovery, and takeover-risk scoring into a single JSON response. Subdomain takeover — where attackers claim dangling DNS records pointing to defunct services like GitHub Pages or Heroku — is considered a high-impact, low-complexity vulnerability commonly targeted in bug bounty programs. By offloading the heavy data gathering to the API, the on-device LLM only needs to reason over structured results and surface actionable findings to the user.

0 comments Read more at DEV Community