Articles

Thu, 30 Apr 2026 11:46:57 +0800

gstack: Use Garry Tan’s exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
Waza: Engineering habits you already know, turned into skills Claude can run.
docmd: Build production-ready documentation from Markdown in seconds.
talk-normal: Make any LLM talk like a normal person. A system prompt that removes AI slop.
The Quiet Colossus
smolvm: Tool to build & run portable, lightweight, self-contained virtual machines.
MAD Bugs: “cat readme.txt” is not safe in iTerm2
https://aistupidlevel.info/
https://markdown.new/
caveman: Claude Code skill that cuts 65% of tokens by talking like caveman
trellis-mac: This is a port of Microsoft’s TRELLIS.2 — a state-of-the-art image-to-3D model — from CUDA-only to Apple Silicon via PyTorch MPS. No NVIDIA GPU required.
ggsql: A grammar of graphics for SQL
https://lawsofsoftwareengineering.com/
VidStudio: a browser based video editor that doesn’t upload your files
cal.diy: Scheduling infrastructure for absolutely everyone.
RustTraining
opendoas: A portable fork of the OpenBSD doas command, is a minimal replacement for the venerable sudo.
compressO: Convert any video/image into a tiny size. 100% free & open-source. Available for Mac, Windows & Linux.
kami: Part of a trilogy: Kaku (書く) writes code, Waza (技) drills habits, Kami (紙) delivers documents.
design-md-chrome: Chrome extension to extract styles from any website and generate DESIGN.md files and design skills for AI based on TypeUI
佐enter 成人碎牛皮手套
localsend: An open-source cross-platform alternative to AirDrop
GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
Warp is an agentic development environment, born out of the terminal.
Just the Browser: Remove AI features, telemetry data reporting, sponsored content, product integrations, and other annoyances from web browsers.
Copy Fail: CVE-2026-31431

MAD Bugs: “cat readme.txt” is not safe in iTerm2

The core bug

The bug is a trust failure. iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor.

Skill on Ricky

Articles

MAD Bugs: “cat readme.txt” is not safe in iTerm2

The core bug