AI Repo: trailofbits/skills

Skyler: Hey everyone, welcome back to Git News A I — the show where we dig through the hottest trending repositories on GitHub so you don't have to. I'm Skyler, and today's episode is packed with some genuinely exciting stuff across security, search, agent frameworks, and L L M inference. Skyler: Before we jump in, huge shoutout to our sponsors keeping this show running. First up, Ada — the platform helping teams actually integrate A I into their real-world workflows, not just prototype it. Then there's Ago Consulting — that's "Ahh-Go" — your go-to for silicon development consulting all the way from A I to SoC design. And finally, Zen Semiconductor, an umbrella company with a portfolio of silicon-industry companies including Ada for deploying A I at scale in any business — and their Vect appliance is seriously cool, running local L L Ms and vector search on dedicated hardware. Links for all of them in the show notes. Skyler: Alright, today we've got Trail of Bits bringing Claude Code skills to security research, a Rust-powered search engine that claims 40x fewer tokens than grep, a nearly 300,000-star agentic framework that is absolutely wild, a speed-of-light L L M inference engine, and an open-source A I Agent book in Chinese that's racking up stars fast. Let's get into it. Skyler: Okay, first repo — and this one is genuinely fascinating if you're at all into security or you've been playing with Claude Code. It's called "skills" from Trail of Bits, sitting at over 7,500 stars, and it's essentially a curated collection of Claude Code skills purpose-built for security research, vulnerability detection, and audit workflows. Skyler: Now if you haven't heard of Trail of Bits, they're one of the most respected security research and auditing firms in the world. So when they publish a toolkit for Claude Code, you pay attention. Skyler: What this repo gives you is a set of reusable skills — think of them like specialized capabilities or tools you can plug into Claude Code to make it way more effective at security-specific tasks. We're talking things like vulnerability scanning workflows, code audit helpers, and structured methodologies for finding bugs in code. Skyler: The recent commits show they're actively maintaining this — there's work around dev container setup and fixing some environment variable issues in the G H C L I hooks, which tells me people are actually using this in real CI and dev environments, not just locally. Skyler: What really excites me about this is the combination of a top-tier security firm's institutional knowledge encoded into reusable A I skills. Like, imagine having Trail of Bits' auditing methodology baked into your coding assistant. That's a massive force multiplier for any developer or team doing security work. Skyler: If you're a security engineer, a developer who cares about writing safe code, or someone building A I-assisted audit pipelines, this is absolutely worth bookmarking. It's written in Python, so it's approachable, and Trail of Bits clearly has a long-term commitment to maintaining it. Skyler: Definitely check the show notes for the link on that one. Skyler: Alright, moving on to repo number two, and this one is written in Rust — which already has my attention — it's called XERJ, and it's sitting at around 5,600 stars. Skyler: The pitch is bold: XERJ is the new way for A I to search data. Their autoindex capability is designed specifically so A I agents can search through your data without the insane token waste that comes from just throwing grep and sed output into a context window. Skyler: And honestly, this is a real pain point. If you've ever tried to build an agent that needs to search through a large codebase or a bunch of docs, you know that naive approaches just destroy your token budget. You end up with thousands of tokens of noise to find one relevant line. Skyler: XERJ claims 40 times fewer tokens than grep. That's not a small optimization — that's a fundamentally different approach to how agents interact with data. Skyler: With one command, you can index code, documentation, logs, and PDFs. And then your agent can search across all of that in a way that's actually token-efficient. They also support RAG workflows, security audits, and agent memory use cases. Skyler: Here's the kicker for adoption — XERJ is Elasticsearch compatible. That means if you already have clients built against Elasticsearch, they just work. You're not ripping out infrastructure, you're swapping in something smarter underneath. Skyler: The recent activity shows docs work and some upgrade migration fixes, which suggests a maturing project that's actively improving its onboarding experience. Skyler: If you're building agents that need to reason over large codebases, internal wikis, or log files, XERJ looks like a serious tool worth evaluating. Show notes have the link. Skyler: Now this next one — okay I have to warn you — this star count is going to make you do a double take. Skyler: Repo number three is called "superpowers" from obra, and it has two hundred and ninety-nine thousand stars. Almost three hundred thousand. On a Shell-based repo. Let that sink in. Skyler: The description calls it an agentic skills framework and software development methodology that works. And at that star count, clearly a lot of people agree. Skyler: This is a framework for augmenting agentic A I workflows — giving your A I agents structured superpowers, essentially. The methodology side is interesting too, because it's not just a code library, it's a way of thinking about and organizing how agents do software development work. Skyler: The recent releases are telling. Version 7 just dropped with a rebuilt brainstorming system and something called the Antigravity Marketplace manifest, which sounds like a wild name but suggests a plugin or extension ecosystem is forming around this. There are also Windows hook fixes in there, which means cross-platform support is a real priority. Skyler: Version 6 introduced leaner plans from what they call writing-plans, which hints at some kind of structured planning system for agents — getting them to produce more efficient, less bloated execution plans. Skyler: The Shell language tag is interesting — this is infrastructure and orchestration level tooling, not just a Python library you import. It's meant to be integrated into your development environment at a deeper level. Skyler: At nearly 300,000 stars, this is clearly resonating with a massive developer community. Whether you're building with autonomous coding agents or just want to level up your A I-assisted development workflow, superpowers is worth spending some serious time with. Skyler: Link in the show notes — go check it out. Skyler: Okay, repo four — TokenSpeed. And the name tells you exactly what this is about. Skyler: TokenSpeed describes itself as a speed-of-light L L M inference engine, sitting at just under 2,500 stars but the technical depth here is really impressive. Skyler: Inference speed is one of the biggest bottlenecks in production A I systems right now. You can have the best model in the world but if it takes too long to generate tokens, your user experience suffers, your costs go up, and your system throughput tanks. Skyler: TokenSpeed is going after that problem hard. The recent commit that really caught my eye is a performance commit for something called DSV 4.1 — specifically selecting candidate blocks in a single GFX 950 kernel. GFX 950 is AMD GPU architecture, so these folks are writing GPU kernel-level optimizations. This is not high-level Python wrappers over existing tools — this is deep, low-level performance engineering. Skyler: The DSV reference likely points to a speculative decoding or drafting approach — these are techniques where you use a smaller faster model to propose token candidates that a larger model then verifies, which can dramatically increase effective inference throughput. Skyler: What's exciting here is that this kind of work — optimizing at the kernel level for specific GPU architectures — is exactly what separates hobby inference projects from production-grade inference engines. Skyler: If you're running L L Ms at scale, building inference infrastructure, or you're just a performance-obsessed engineer who loves reading about kernel-level GPU optimization — TokenSpeed is worth watching closely. Skyler: Show notes for the link, as always. Skyler: And our fifth and final repo today is a bit different — it's a book. A whole open-source book. Skyler: It's called "ai-agent-book" from bojieli, which translates to "Deep Understanding of A I Agents: Design Principles and Engineering Practice" — authored by Li Bojie. And it's sitting at over 54,000 stars, which for a book repository is absolutely enormous. Skyler: The repo contains the full text of the book, compiled PDF versions, and chapter-by-chapter companion code. Everything is open source, which is a generous and genuinely impactful decision. Skyler: Now the book is in Chinese, so depending on your language comfort level your mileage may vary. But even if you're not a Chinese reader, the companion code is Python and universal, and frankly at 54,000 stars there's a good chance translation efforts or summaries are floating around the community. Skyler: What makes this exciting beyond just the star count is the comprehensiveness. Agent design and engineering practice is exactly the kind of material the A I community desperately needs more of. There's so much content about using A I agents but comparatively little about deeply understanding how to design and build them from first principles. Skyler: The recent commits are just star history chart updates, which tells me the content itself is relatively stable — this isn't an active development project, it's a finished resource being maintained and shared. Skyler: If you read Chinese or you're comfortable using translation tools, this looks like one of the most comprehensive resources on A I agent engineering out there right now. For M L engineers and A I developers, it's genuinely worth the effort to dig into. Skyler: Check the show notes for the link. Skyler: Alright, that's a wrap on today's repos — what a lineup. From Trail of Bits' security skills for Claude Code, to XERJ's token-efficient agent search, to the almost unbelievably popular superpowers framework, to TokenSpeed's kernel-level L L M inference work, and finally that incredible open-source A I agent book. Lots of stuff to explore this week. Skyler: Massive thank you to our sponsors — Ada for helping teams bring A I into real workflows, Ago Consulting for their expert silicon and A I development consulting, and Zen Semiconductor with their portfolio of silicon companies, Ada for enterprise A I deployment, and the Vect appliance for running L L Ms and vector search locally on dedicated hardware. We genuinely appreciate their support. Skyler: If you enjoyed this episode, go check out AI Special Report — another show in the Ada podcast network that dives deep into what's actually happening in the A I industry right now. Great companion listen to this show. And of course, if you haven't subscribed yet, please do — and all the repo links from today are waiting for you in the show notes. We'll see you next time on Git News A I.