今日开源：PHP 高危漏洞研究密集，AI 工具落地各有新思路
日报 · 2026-10-21 · GitHub 新星
覆盖日期：2026-10-21 · 北京时间
发布时间：2026/10/22 08:00:19
修订于 2026/10/22 17:31:39 · 原刊收录 35 个项目，修订版采用 34 个仍可公开项目。本版不作跨期比较。
本刊有 1 个项目已不可公开，相关条目已隐藏。
本期日报聚焦 PHP session.upload_progress 高危漏洞的多份研究仓库、Rust 重写 TypeScript 编译器、本地决策模型与 AI 代理工作台等 12 个项目，覆盖安全、开发工具、AI 应用与生活指南。
修订版说明：原刊收录 35 个项目，本版依据 34 个仍可公开项目。对比资料不再完整，本版不作跨期比较。原刊物快照和历史文章保留。
今天的开源项目里，安全研究占据了相当分量，围绕 PHP 高危漏洞的多个仓库集中出现；与此同时，开发工具与 AI 应用也在继续往更实用、更贴近日常工作的方向演进。下面按主题展开。
1. PHP 高危漏洞：从分析到复现的多份研究
十月中旬，PHP 核心的 session.upload_progress 处理被曝出两个严重漏洞（CVE-2026-109618 与 CVE-2026-109619），CVSS v4.0 评分为 9.2，可在未认证的情况下实现远程代码执行，影响范围覆盖 PHP 5.4.0 至 8.5.x。今天收录的多个仓库，从漏洞分析到完整利用链，构成了一个相当完整的研究谱系。
ikow 的 php2shell-poc 是最早一批披露细节的仓库之一，它把漏洞概括为三条已验证的攻击链：Session 文件注入加 LFI、var_destroy 触发的 UAF 堆破坏，以及反序列化 handler 不匹配导致的 __destruct 调用。每条链都附带验证条件与结果，仓库里还给出了 Docker 实验环境和完整的分析文档。作者明确指出，PHP 官方只对仍在支持的 8.2 至 8.5 分支发布修复，5.x、7.x、8.0、8.1 等已停止维护的版本没有官方补丁。
eness 的 php2shell-CVE 仓库则更偏向应急响应，除了 POC，还打包了配置缓解、快速修复脚本、源码补丁以及 Cloudflare WAF、FrankenPHP、Lighttpd、Apache 等不同部署场景的加固示例。它也确认了影响版本范围，并提示 EOL 版本只能靠关闭 session.upload_progress 或依赖发行版回溯修复。值得注意的是，该仓库的 PoC 本身仍在开发中，尚未发布。
9bie 的仓库则是目前看起来走得最远的复现：它声称在完全远程、纯 HTTP、目标页面没有 session_start()、不写任何目标侧 PHP 的约束下，用单个 exploit.py 在官方 php:8.4.26-apache 镜像上实现了 3/3 成功率，自动完成 worker 轮换、堆泄漏、libphp 基址泄漏和命令执行。它内置了 Debian 12 的偏移标定，payload 命令长度限制在 14 字节内，并且要求 display_errors=1 等特定配置。作者也说明 display_errors=0 的完整 RCE 稍后提交。
这三份材料放在一起看，能清晰感受到漏洞研究从“发现问题”到“形成可操作工具”的完整链路。对于运维和开发者，最实际的行动依然是：尽快升级到已修复的 PHP 版本，对无法升级的环境关闭 session.upload_progress，同时留意异常的子进程行为。
参考仓库： https://github.com/ikow/php2shell-poc https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC https://github.com/9bie/php2shell-bypass-aslr-exp
2. Rust 重写 TypeScript：性能与兼容性的平衡
oxc-project 旗下的 tsrs 是今天另一个值得关注的项目。它是用 Rust 编写的 TypeScript 7 编译器与语言服务器替代实现，目标是作为 drop-in replacement，在保持 100% 符合性的前提下大幅降低内存占用、提升类型检查速度。项目目前以 TypeScript 主分支为目标，计划在 7.1 版本达到完全一致。
根据仓库给出的信息，tsrs 在现有项目测试中尚未发现正确性 bug，但存在已知的诊断顺序差异：固定的 Go 编译器可能因并行解析、解析与检查顺序不同产生不同的诊断信息，而 tsrs 默认会对部分检查器历史进行规范化处理。此外，--init 和 --showConfig 命令暂不支持，相关已知缺口都记录在兼容性文档里。
对于大型 TypeScript 项目来说，这类重写带来的性能收益可能相当可观，但诊断顺序的细微差异在多线程并行场景下是否会影响开发体验，还有待实际使用验证。项目方目前开放了 issue 反馈，但暂时不接受 pull request，贡献者需要留意。
参考仓库： https://github.com/oxc-project/tsrs
3. 本地模型与推理加速：各家有各家的思路
在模型本地部署与推理效率这个方向上，今天出现了几个定位差异明显的项目。
StartLux-Decision 是一个开放决策模型家族，模型规模从 0.8B 到 27B 不等。它的特点是给定一段状态（文本、JSON 或图像）和一组类型化问题，每个选项都能得到一个校准过的概率：是枚举选择、是否判断还是量表评分，都返回数值。Instant 模型单次前向传播就能回答，AutoThink 模型则只在最高概率低于 0.6 的阈值时才生成简短思考并重新读取答案。项目提供了推理引擎和 HTTP 服务器，API 兼容 System One 的 /v1/systemone，支持 vLLM、llama.cpp 和 MLX 后端。按官方 release note，v1.1 27B Instant 在 Decision Index 0.3.2 排行榜上排第一，Full score 为 69.12。这样的模型很适合客服工单分类、游戏策略决策等需要结构化输出的场景，但要注意 AutoThink 在不确定时耗时更长。
EAGLE-4 则是典型的推测解码加速方案。它发布的是官方推理代码，核心卖点是“一个 drafter 适配所有 batch size 和硬件”，会根据运行时的 batch、硬件和工作负载动态调整推测树的大小，并且通过引擎暴露的 hook 注册，不在运行时打补丁。目前它支持 SGLang、vLLM 和实验性的 TokenSpeed，但只支持文本请求，不支持流水线并行，且对硬件有明确要求（NVIDIA B300 或 AMD MI355X）。这显然面向需要极致推理性能的部署团队，普通开发者门槛较高。
NVIDIA 的 flare-local-inference 走的是另一条路：它是一款针对 NVIDIA SM120/SM121 GPU 的本地推理服务器，特别强调长对话、编码代理和重复工具使用场景。它的设计很有意思——编译阶段用 PyTorch、Transformers 和 FlashInfer 加载模型、调优内核、捕获 CUDA graph，打包成运行时；服务阶段则由 Rust 运行时承担，不含 Python。项目方自己也承认，与 vLLM 相比，Flare 支持的模型、硬件和部署模式范围更窄，属于“当硬件和模型覆盖匹配时才值得考虑”的专门选项。
三个项目放在一起看，决策模型、推测解码、专用本地服务器各自瞄准不同的问题，也提醒我们在选择推理方案时，先想清楚自己的场景是结构化判断、吞吐优先还是资源受限的长会话。
参考仓库： https://github.com/StartLuxLabs/StartLux-Decision https://github.com/eagle-hq/EAGLE-4 https://github.com/NVIDIA/flare-local-inference
4. AI 应用走向桌面与日常
如果说上面这些偏底层，那么今天还有一批项目在尝试把 AI 能力带到普通用户的桌面和工作流里。
YuE2 Studio 把 YuE2 开源歌曲模型封装成了本地 Windows 桌面应用，核心卖点是“单文件、无 Python、无 Node.js”，通过 Tauri 和 Rust 实现。它不仅能根据风格和歌词生成带人声的完整歌曲，还能把模型先写出的 ABC 记谱显示成可编辑的乐谱——改音符、改速度、改调性后重新渲染，保持作曲不变而改变演奏风格。它还内置了 Winamp 风格的播放器、均衡器和可视化效果，甚至提供一个 MCP 服务器，让 AI 代理可以驱动整个 Studio 工作。硬件方面，NVIDIA 显卡要求 6 GB 显存，AMD/Intel 的 Vulkan 路径仍是实验性，Linux 版也标注为实验性。对于想本地跑模型做音乐创作的用户，这可能是目前门槛最低的打包方案之一。
Shapeshift 则是一个很有意思的交互实验：一个文本框，输入自然语言，它会边打字边“变形”成对应的事件卡片、清单、计时器、颜色选择器、账单分割器等等。它的设计哲学是“Jev 决定，代码计算”——用 TypeSafe 的 Jev 模型做意图分类，回答了包含卡片类型和信号在内的 14 个并行类型化问题，但日期、金额、单位、数学运算这些值全部由确定性代码解析。默认完全离线运行，用内置关键词分类器，可选配在线模型增强。这种“AI 只负责分类，具体计算交给确定性代码”的架构，既控制了延迟和成本，也保证了计算的可靠性，值得做类似工具的人参考。
PandaCode 则是一款面向编码代理的桌面工作区，把 Claude Code、Codex、Kimi Code、OpenCode 等多个编码 CLI 并排放在一个窗口里，配合任务看板、Git 集成、终端、浏览器和审批栏等功能。它内置了“architect + 最多三个 worker”的代理团队模式，以及 Telegram、Slack、Discord 等渠道的 bot 支持。项目采用 Tauri 2 和 Rust 构建，没有账号、没有遥测，但发布版本未签名，首次运行会有系统警告；许可证是 MIT 基础上增加了一条“商业使用或公开发布的 fork 必须声明来源”的条款。对于每天要同时跑多个编码代理的开发者，这类统一入口确实能减少窗口切换和管理成本。
这几个项目的共同点是：它们都在尝试把 AI 从“聊天框”推向“具体可用的工具”——无论是生成可编辑的乐谱、把输入变成结构化卡片，还是管理多个代理任务。至于谁更贴近真实需求，恐怕还要看各自社区的反馈和迭代速度。
参考仓库： https://github.com/timoncool/YuE2-Studio https://github.com/anishfn/shapeshift https://github.com/aicodeking/pandacode
5. 代理框架与生活指南：面向不同“真实世界”
最后两个项目有点特别。Agnes Harness 是一个面向 Forward Deployed Engineering（FDE）的可插拔代理框架，用“大脑、小脑、记忆、身体”的比喻组织架构——LLM 是大脑，Jev 是小脑，Harness 是记忆，MHS 是身体。它的目标是把 AI 集成到客户的真实工作流里，把每次部署沉淀成可复用的能力，强调审批、记录和信任。但项目目前是开发者预览（pre-alpha），只能从源码构建，API 和接口都可能变化，普通后端插件以受信任的进程内代码运行，并未完全沙箱化。适合 FDE、解决方案工程师以及需要监督机制的团队尝试，但若需要托管服务或生产承诺，现在还不是时候。
HowToGetAlong 则是一个完全不同的项目：面向大学生和初入职场的“人情世故指南”，10 章 77 条经验建议，覆盖合作、求助、拒绝、金钱、礼节、冲突等场景，每条都写明判断关键、行动准备、具体做法和示例表达。它甚至配套了 AI 使用的 SKILL 文件，还提供了论文、访谈等依据资料，不过作者明确说明内容未经系统访谈或行为测试验证，属于经验建议。这类项目放在技术日报里有些另类，但它用开源协作的方式整理社会经验，本身也是开源生态多样性的一种体现。
参考仓库： https://github.com/AgnesAI-Labs/agnes-harness https://github.com/kkk-bot/HowToGetAlong
6. 结语
今天的 34 个收录项目里，我们挑出了 12 个代表性仓库。安全方向的 PHP 漏洞研究链条最完整，从分析、检测到可复现的利用，说明漏洞披露后的社区反应已经越来越快；开发工具和 AI 应用则在性能优化、本地化、易用性上持续推进。如果你是 PHP 运维，建议优先关注漏洞修复与缓解；如果你在做 AI 工具，Shapeshift 的“AI 分类 + 确定性计算”架构、YuE2 Studio 的本地打包方式，可能都能带来一些启发。
（本期为修订版，基于可公开的 34 个项目撰写，原收录总数为 35。）
文章生成于 2026/10/22 17:31:39 · 依据本期保存的资料撰写
本期项目与来源资料
收录数按本期首次达标收录的项目统计。
- oxc-project/tsrsRust · 1,738 Stars
类型检查
Stars 统计更新于 2026/10/22 07:55:33
查看原始资料
作者描述
Rust port of the TypeScript 7 type checker
编报时的 AI 中文解读
tsrs 是一个用 Rust 编写的 TypeScript 7 编译器与语言服务器的替代实现，旨在提供更低的资源占用和更快的类型检查速度，适用于需要高效类型检查的 TypeScript 项目。
编报时的 README 依据
# `tsrs` [](https://www.npmjs.com/package/tsrs) [](https://github.com/oxc-project/tsrs/blob/main/LICENSE) `tsrs` is a drop-in replacement for the TypeScript 7 compiler and language server, written in Rust. Our goal is 100% conformance, with much lower memory use and faster type checking. [Read the announcement](https://blog.cloudflare.com/typescript-rust-port/). ## Get started ```sh pnpm add -D tsrs pnpm exec tsrs --noEmit ```
You can try `tsrs` today and give us feedback on performance, memory usage, and conformance. Try checking and emitting code in the [browser playground](https://tsrs-playground.void.app). ## Conformance `tsrs` currently targets the main branch of [microsoft/TypeScript](https://github.com/microsoft/typescript). We aim to release a stable version against TypeScript 7.1 with 100% conformance. In our testing on existing projects, we have yet to find a correctness bug in `tsrs`. There are known order issues: the pinned Go compiler can produce different diagnostics and traces depending on
parallel parse, resolution, and check order, while `tsrs` canonicalizes some checker history by default. For the closest comparison, use `--checkerAssignment go --noLazyMembers`; tsgo parser and resolver races can still vary between runs. `--init` and `--showConfig` are not supported. See [compatibility and evidence](https://github.com/oxc-project/tsrs/blob/main/docs/COMPATIBILITY.md) for supported features and known gaps. <a href="https://github.com/oxc-project/tsrs/blob/main/bench/RESULTS.md"> <picture>
- kkk-bot/HowToGetAlongHTML · 1,338 Stars
生活指南
Stars 统计更新于 2026/10/22 07:56:03
查看原始资料
作者描述
面向大学生和初入职场者，讲清大学课堂里往往没有系统教过的人情世故、沟通技巧与社会规则。遇到合作、求助、拒绝、金钱、礼节和冲突时，帮助你理解事情怎么做、话怎么说，以及一个选择可能付出的代价，少走弯路，更从容地进入社会。
编报时的 AI 中文解读
面向大学生和初入职场者的人情世故指南，涵盖合作、求助、拒绝、金钱、礼节和冲突等场景，提供判断关键、行动准备、具体做法和示例表达，帮助理解社会规则与沟通技巧。
编报时的 README 依据
# 人情世故指南  ## 项目简介 进入社会之后，我们常常会因为人情世故而苦恼：不知道事情该怎么做，话该怎么说，也不清楚一个选择背后可能要付出什么代价。 **这是一份面向大学生和初入职场者的人情世故指南，讲清大学课堂里往往没有系统教过的相处方法、沟通技巧，以及进入社会后需要了解的规则与边界。** 从合作、求助、拒绝，到金钱、礼节和冲突，每条都写清判断关键、行动前准备、具体做法、示例表达、可能效果、代价和例外。希望帮助你少走弯路，更清楚地理解人与事，逐步学会怎么做、怎么说，在进入社会后更从容地处理具体问题。你可以选择相近的场景试用，再根据自己的关系与环境调整。 10 章 77 条 · 全部为经验建议。 > **免责声明：仅供参考。** 本项目内容仅供学习与交流参考，属于经验建议，不保证适用于所有人或取得特定效果。具体问题请根据事实情况分析，结合自身处境、关系与适用规则独立判断，不宜直接照搬示例。
### [阅读与检索](https://kkk-bot.github.io/HowToGetAlong/) · [连续阅读](https://kkk-bot.github.io/HowToGetAlong/%E9%98%85%E8%AF%BB%E5%85%A8%E6%96%87.html) · [让 AI 按指南回答](skills/social-situations-guide/SKILL.md) | 入口 | 内容 | |---|---|
| 免费下载 | [免费版 PDF v1.23.0](https://github.com/kkk-bot/HowToGetAlong/raw/refs/heads/main/downloads/%E4%BA%BA%E6%83%85%E4%B8%96%E6%95%85%E6%8C%87%E5%8D%97.pdf) · [HTML 检索页](https://kkk-bot.github.io/HowToGetAlong/downloads/html.html) · [Markdown](https://github.com/kkk-bot/HowToGetAlong/raw/refs/heads/main/%E5%AE%8C%E6%95%B4%E6%8C%87%E5%8D%97.md) · [项目 ZIP](https://github.com/kkk-bot/HowToGetAlong/archive/refs/heads/main.zip) | | 阅读 | [完整文字版](完整指南.md) · [使用指南](https://kkk-bot.github.io/HowToGetAlong/docs/usage.html) |
| 查阅 | [依据与核实记录](https://kkk-bot.github.io/HowToGetAlong/docs/verification.html) · [编写与纠错规范](https://kkk-bot.github.io/HowToGetAlong/docs/editorial-guide.html) · [论文与文章资料](https://kkk-bot.github.io/HowToGetAlong/docs/research-notes.html) · [访谈与博客笔记](https://kkk-bot.github.io/HowToGetAlong/docs/interview-notes.html) · [来源索引](https://kkk-bot.github.io/HowToGetAlong/%E9%98%85%E8%AF%BB%E5%85%A8%E6%96%87.html#sources) | 点击上方“阅读与检索”或“连续阅读”可直接在线阅读。需要离线使用时，下载项目 ZIP，解压后用浏览器打开 `index.html` 或 `阅读全文.html`。
- 条目支持复制示例、收藏和分享。收藏保存在当前浏览器；复制不可用时可手动选择文本。分享链接指向公开在线条目。 - 10 个条目包含接续对话，展开后可查看第一次表达、后续回应和调整信号；均为编写情境。4.3 补充了领导提议点饮料时，确认费用、回应请客、代下单和婉拒的四组对话。 - 想提出用词、检索或场景建议，可查看[读者反馈与案例征集](docs/读者反馈与案例征集.md)。 - 喜欢纯文字，可以按下面的问题读 `book/` 正文。 - 每条的“可以怎么说”都是本项目拟写的示例，不是平台原话，也不保证对方接受。 - 展开“准备、不同情境与调整信号”，区分普通朋友、亲近关系、职责内请求等条件，别只照搬一句话。 - 本版没有经过系统访谈、行为测试或逐条研究验证。平台调研提供选题线索，不证明方法有效。涉及学校、单位和法律的具体要求，需要另查对应规则。 ## 如何理解依据 不把经验、制度和研究放在一把尺子上打分，也不计算“情商分”或社交成功率。 | 类型 | 要求 | 本版情况 | |---|---|---| | 研究背景 | 原始研究来源、研究对象、主要结论与局限 | 已在部分条目注明背景与阅读范围；具体动作未逐条验证 | | 制度规定 | 官方文本、适用地区或机构、截至日期 | 暂无具体制度结论 | | 经验建议 | 标明为可选办法，列出代价、例外与失效可能 | 77 条 |
- StartLuxLabs/StartLux-DecisionPython · 1,121 Stars
模型本地部署、模型接口服务
Stars 统计更新于 2026/10/22 07:56:03
查看原始资料
作者描述
Open decision models from 0.8B to 27B: a calibrated probability for every option in one pass, and a short thought only when unsure. Engine for vLLM, llama.cpp and MLX.
编报时的 AI 中文解读
StartLux-Decision 是一个开放决策模型家族，根据给定的状态（文本、JSON 或图像）和一组类型化问题，为每个选项返回一个校准的概率。它提供推理引擎和 HTTP 服务器，支持 vLLM、llama.cpp 和 MLX 等后端。 该仓库包含推理引擎和 HTTP 服务器，API 与 System One `/v1/systemone` 兼容。用户可以通过命令行工具 `startlux-decide` 启动服务，并使用 curl 等工具发送请求。
编报时的 README 依据
StartLux-Decision is a family of open decision models. Given a state (text, JSON or images) and a set of typed questions, a model returns a probability for every option of every question: a choice among listed options (`choice`), a yes or no judgement (`noul`), or a level on a scale (`score`). Instant models answer in a single forward pass with bidirectional attention over the prompt. AutoThink models answer in one pass when the top probability reaches a gate, 0.6 by default, and otherwise generate a short reasoning trace and read the answer again.
Download a model and start one vLLM server per GPU with the decision server in front of them: ```bash hf download startlux-models/StartLux-Decision-v1.1-4B-AutoThink --local-dir models/StartLux-Decision-v1.1-4B-AutoThink startlux-decide serve --model models/StartLux-Decision-v1.1-4B-AutoThink --launch-vllm --gpus 0,1,2,3 --port 8090 ``` Ask a question: ```bash curl -s localhost:8090/v1/systemone -H 'Content-Type: application/json' -d '{ "state": {"ticket": "I was charged twice for order #4411 and the app still shows it as unpaid."}, "questions": {
<p align="center"> <a href="https://arxiv.org/abs/2610.17309"><img src="https://img.shields.io/badge/arXiv-2610.17309-8A5CD6" alt="arXiv"></a> <a href="LICENSE"><img src="https://img.shields.io/badge/code-Apache--2.0-8A5CD6" alt="License"></a> <a href="pyproject.toml"><img src="https://img.shields.io/badge/python-3.9%2B-8A5CD6" alt="Python"></a> <a href="#engines"><img src="https://img.shields.io/badge/backends-vLLM%20%7C%20llama.cpp%20%7C%20MLX-8A5CD6" alt="Backends"></a> </p>
To try a model without a GPU, use [bamboonode.dev](https://bamboonode.dev/). It hosts the 27B AutoThink model with the same request format (`POST /v1/decisions`), free and without usage limits, and needs only a Bamboo API key. To run the models yourself, install the package into the same Python environment as vLLM. It carries the vLLM plugin that Instant models need. ```bash git clone https://github.com/StartLuxLabs/StartLux-Decision.git cd StartLux-Decision pip install -e '.[vllm]' # vLLM 0.31.0; the published numbers were measured on 0.19.1, which is also supported ```
contains the full evaluation. The engine also serves the [v1 models](https://huggingface.co/collections/startlux-models/startlux-decision-v1-6abba92b301b573fa154d493) (0.8B to 27B and 35B-A3B), which answer in one pass. On one H200 with vLLM and one request in flight, Instant models answer a request in 25 to 52 ms at the median, from 0.8B to 27B. Through this server, an AutoThink model needs one read-out of 38 to 59 ms when it is sure. When it is unsure it writes a thought and reads the answer a second time, and the thought takes longer the more it writes. ## Quick start
- AgnesAI-Labs/agnes-harnessTypeScript · 1,053 Stars
AI代理编排
Stars 统计更新于 2026/10/22 07:52:02
查看原始资料
作者描述
Agnes Harness: A pluggable agent harness for Forward Deployed Engineering (FDE). Built for trust. Made for the real world.
编报时的 AI 中文解读
Agnes Harness 是一个可插拔的代理框架，用于前置部署工程（FDE），旨在将AI集成到客户的真实工作流程中，支持通过CLI、Web和SDK使用，并可通过插件扩展业务能力。其目标用户是FDE和解决方案工程师、插件开发者以及需要监督的团队。
编报时的 README 依据
- **FDE and solution engineers** delivering agents into customer systems and workflows - **Plugin developers** packaging business tools, services, and interfaces for reuse - **Teams that need oversight**: approvals before commands, records of every step, and explicit package trust - **Field and lab teams** bringing devices into tasks through MHS Not a fit yet if you need a hosted service, signed installers, or a production commitment today: AGH is a developer preview. ## Start from an example
CLI, Web, and SDK share the same backend sessions. Resume a Web session in the terminal with `/resume <id>` and the history, tool records, and results are already there; whatever you add in the terminal shows up in the Web thread. See [sessions and recovery](docs/guide/sessions.md). <p align="center"> <img src="docs/assets/readme/terminal.gif" alt="The terminal UI resumes a session started on the Web, shows its history, tool records and result table, answers a follow-up, and the same thread is up to date back on the Web" width="100%" /> </p>
| [A full-stack plugin](docs/develop/fullstack.md) | Read a backend result from a panel, then inspect updates and rollback | Package a business service together with its interface | **Choose an example, then add your business logic.** [Open the demo guide →](docs/guide/demo.md) ## Run from source AGH is a **developer preview (pre-alpha)**, available through a source build. You need Node.js 24.10+, pnpm 10.34.5, and the native build tools for your platform. See [getting the source and installation](docs/guide/install.md).
Not yet. AGH is a developer preview without a public package release, installer, or upgrade commitment. Validate deployment, audit, and isolation requirements in your own environment. **Are plugins sandboxed?** Ordinary backend plugins run as trusted in-process code, so install only packages you trust. Approvals and the command sandbox apply to the supported execution paths; they do not isolate arbitrary plugin code. **Which models can I use?**
- timoncool/YuE2-StudioTypeScript · 1,050 Stars
歌曲生成、乐谱编辑、音频处理
Stars 统计更新于 2026/10/22 07:52:02
查看原始资料
作者描述
Local AI song generator with an editable score — YuE2 on your GPU: full songs with vocals, sheet music, covers, exact replay. Native Windows app, no Python, installer with auto-update.
编报时的 AI 中文解读
YuE2 Studio 是一款在本地 GPU 上生成完整歌曲的桌面应用，支持可编辑乐谱、翻唱、精确重放等功能，无需 Python 环境，提供 Windows 安装程序。
编报时的 README 依据
# YuE2 Studio **Full songs with an editable score, generated on your own GPU. One executable — no Python, no Node.js, no launcher.** [](https://timoncool.github.io/YuE2-Studio/) [](https://github.com/timoncool/YuE2-Studio/releases/latest) [](DONATE.md)
1. Install the studio from the [latest release](https://github.com/timoncool/YuE2-Studio/releases/latest) and start it. 2. Connect to its MCP server at `http://127.0.0.1:8791/mcp`: `claude mcp add --transport http yue2-studio http://127.0.0.1:8791/mcp` 3. Read the skill it serves (resource `studio://skill`, prompt `studio`), the same text as [docs/mcp-skill.md](docs/mcp-skill.md), and start with the tool `studio_status`. [llms.txt](llms.txt) says the same for tools that look for it. To keep the skill in Claude
| [Ночной вор Барсик](docs/samples/barsik.mp3) | Style and lyrics written by the built-in assistant from a one-line idea | pop-punk, distorted guitars, 185 BPM | ## What it needs - Windows 10/11 x64. - A GPU with **6 GB of VRAM** or more: - **NVIDIA**, from the GTX 900 series on, runs on CUDA — the fastest path. The studio ships two CUDA builds of the engine and picks the one your card and driver run: CUDA 13 for Turing and newer (GTX 16, RTX 20–50, Tesla T4, A100, RTX A-series, L4/L40, H100) with driver 580 or newer, CUDA 12 for Maxwell, Pascal and Volta
(GTX 900/1000, Titan X/Xp/V, Tesla M40, P40, P100, V100) and for any card on a driver from 525 to 579. Both carry compiled code for every one of those architectures, so nothing is left for the driver to compile. - **AMD or Intel — experimental.** The engine runs on Vulkan through the card's own driver. The Vulkan path itself is verified on NVIDIA (the same words heard as on CUDA), but on AMD Radeon integrated graphics the song came out with unintelligible vocals, and discrete AMD and Intel cards are untested. Reports from owners are welcome.
- Without a GPU the engine falls back to the processor, which works but is many times slower. - 4–10 GB of disk for one model set. - Training a LoRA (optional): an NVIDIA RTX 30-series card or newer with 11 GB of VRAM and about 8 GB more disk for the trainer and its weights, downloaded only when you open training. Describing songs by ear needs about 12 GB of VRAM and 10 GB more disk for MOSS-Music; without it the styles are written by hand. ### Linux (experimental) The .deb and the AppImage for Linux x86-64 are **experimental**. They come from the same code with the
Linux build of the same engine (Vulkan, and the processor), but the author works on Windows and has not run them on a real Linux desktop. **If you live on Linux, it would be great if you polished them and sent the fixes back as a pull request.** The studio keeps its data in `~/.local/share/yue2-studio` (`$XDG_DATA_HOME`). ## What runs where | Part | NVIDIA | AMD, Intel | No graphics card | | --- | --- | --- | --- | | Making songs · yue2.cpp | CUDA | Vulkan | processor | | Training a LoRA · music-train | CUDA | not available | not available |
The main, tested path is an NVIDIA card. - Training needs an NVIDIA card with 11 GB of video memory or more. The trainer has no other path, and on the processor one run would take days, so on any other machine the studio does not offer the training files. - On AMD and Intel cards stems are separated on the processor: the HT-Demucs model does not run through DirectML (out of memory on a 2 GB integrated card, over 20 GB and minutes for 30 seconds of audio on a 24 GB one). - Karaoke's Parakeet and the tempo model reach any DirectX 12 card through DirectML. Its
- anishfn/shapeshiftTypeScript · 1,016 Stars
智能输入转换、卡片创建
Stars 统计更新于 2026/10/22 07:52:02
查看原始资料
作者描述
An input that becomes what you mean: one text box that morphs into the right UI as you type. Powered by TypeSafe Jev, works offline.
编报时的 AI 中文解读
Shapeshift 是一个智能输入框应用，用户输入自然语言文本，它会自动识别意图并转换为相应的卡片界面，如事件、清单、计时器等。它默认离线运行，也可选配在线模型增强识别。适合希望快速创建结构化卡片的个人用户。
编报时的 README 依据
<p align="center"><img src="docs/diagrams/jev-fanout.svg" alt="One Jev call answers 14 questions in parallel; a deterministic parser reads the same text for values" width="820"></p> It works **fully offline by default** with a built-in keyword classifier, so you can run it without an account. ## Quick start Requires [Bun](https://bun.sh) 1.2+. ```bash bun install bun dev ``` Open http://localhost:3000 and start typing. Press <kbd>/</kbd> to see every card type. ### Use the online Jev model (optional) ```bash cp .env.example .env.local
# then set TYPESAFE_API_KEY=... (get one at https://console.typesafe.ai/keys) ``` Restart `bun dev`. The latency readout in the bottom-right corner switches from `jev-offline` to `jev-1.13.0`. The key is only ever read on the server (`/api/intent`); it never reaches the browser. If the API is unreachable or rate-limited, Shapeshift quietly falls back to offline mode. | Variable | Default | What it does | | --- | --- | --- | | `TYPESAFE_API_KEY` | _(empty)_ | Enables the online model. Empty or placeholder values keep you offline. | | `JEV_MODEL` | `jev-1.13.0` | Pinned model version. |
- ikow/php2shell-pocPython · 909 Stars
漏洞研究
Stars 统计更新于 2026/10/22 07:45:56
查看原始资料
作者描述
CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
编报时的 AI 中文解读
针对PHP session.upload_progress漏洞（CVE-2026-109618/109619）的安全研究仓库，包含验证POC、实验环境搭建和详细技术分析，适用于授权安全测试和教育目的。
编报时的 README 依据
verify_handler_mismatch.py — Verify handler mismatch → object deserialization lab/ docker-compose.yml — PHP 8.2.34 FPM + nginx lab environment Dockerfile — Vulnerable PHP build php.ini — Lab configuration setup.sh — One-click lab setup docs/ ANALYSIS.md — Full technical analysis ``` ## Quick Start ```bash # Start the lab cd lab && ./setup.sh # Verify session injection python3 poc/verify_session_injection.py --target http://127.0.0.1:18080 # Verify UAF (requires ASAN build)
docker exec php-asan-lab php poc/verify_uaf_asan.php # Verify handler mismatch python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080 ``` ## Affected Versions - PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`) - Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21) - PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix** ## Mitigation ```ini ; Immediate mitigation (does NOT fix all attack paths) session.upload_progress.enabled = Off session.use_only_cookies = On ``` ## Disclaimer
This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test. ## License MIT
- eagle-hq/EAGLE-4Python · 719 Stars
模型服务加速
Stars 统计更新于 2026/10/22 07:45:59
查看原始资料
作者描述
Official Inference Code of EAGLE-4
编报时的 AI 中文解读
EAGLE-4是用于加速大型语言模型推理的官方推理代码，通过推测解码技术在不同批量大小和硬件上提升生成速度，适用于需要高效部署和运行LLM服务的开发者。
编报时的 README 依据
Figure 1(a) of the EAGLE-4 paper: Qwen3.8-27B on the SPEED-Bench qualitative split, 4× NVIDIA B300, one request, temperature 0. The numbers this release measured with EAGLE-4 are in the <a href="docs/support-matrix.md">support matrix</a>. </sub> </p> ## EAGLE-4 EAGLE-4 (Extrapolation Algorithm for Greater Language-model Efficiency) is the latest generation of the EAGLE family for accelerating large language model inference. One drafter adapts its speculative decoding strategy to the batch size, the hardware and the workload, and keeps the target model's output distribution.
The EAGLE-4 draft uses a sliding-window draft layer, a low-rank candidate head and an append-only draft cache. Dense and latent-MoE draft structures are implemented. Qwen3.8-27B with its [EAGLE-4 draft](https://huggingface.co/EAGLE-corp/EAGLE4-Qwen3.8-27B) is the measured target pair. ## Engines This repository is `eagle-harness`, a pip-installable package (`eagle_harness`) that serves EAGLE-4 drafts on SGLang, vLLM and TokenSpeed through engine plugins. EAGLE-4 sizes the speculative tree from measured draft and
verification costs for the batch size, hardware and workload it is running on. It registers through hooks the engine exposes and does not patch the engine at runtime. The patched engines ship as pinned wheels and container images, not as source trees in this repository: | Engine | Hardware | Wheel index | Image | Source | | --- | --- | --- | --- | --- | | SGLang | NVIDIA B300, CUDA 13.0 | [cu130](https://eagle-hq.github.io/EAGLE-4/whl/cu130/) | `ghcr.io/eagle-hq/eagle-4-sglang:0.1.0` | [eagle-hq/sglang](https://github.com/eagle-hq/sglang) |
Use Python 3.12 for the CUDA engines and Python 3.10 for the ROCm wheel. The commands read their pins from the release settings file in the checkout. Run them, and start servers, from the directory that contains the checkout. Inside it, `python -m` would import the source tree's `eagle_harness/` instead of the installed wheel. ```bash git clone https://github.com/eagle-hq/EAGLE-4 . EAGLE-4/docs/release.env ``` SGLang on CUDA: ```bash python3.12 -m venv .venv-sglang && source .venv-sglang/bin/activate python -m pip install --upgrade pip
eagle-harness hooks. On SGLang and vLLM a draft top-k of 1 gives a chain and a larger top-k gives a tree. TokenSpeed implements static and calibrated trees, chains and sampled trees, without prompt logprobs or native no-speculation rounds, and its coverage is limited to the configurations in the support matrix. - GPUs: NVIDIA sm_80 and newer, and AMD CDNA2 to CDNA4, through Triton kernels. The kernel tests run on B300 and the other architectures are compile-checked. MI355X is covered by the serving measurements in the support matrix. See [kernels](docs/kernels.md).
- Requests: text only. vLLM tree verification handles greedy and sampled requests and needs an unquantized KV cache. Constrained output takes the correctness fallback in [compatibility](docs/compatibility.md). - Batch: SGLang and vLLM trees and chains admit up to 512 running requests within the engine's KV and recurrent-state capacity. The SGLang tree default is 32, so set `--max-running-requests` for larger batches. No pipeline parallelism. Admission is not a throughput or correctness guarantee. Check the
- eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoCShell · 562 Stars
安全研究、漏洞检测、漏洞修复
Stars 统计更新于 2026/10/22 07:45:59
查看原始资料
作者描述
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
编报时的 AI 中文解读
演示PHP核心远程代码执行漏洞（CVE-2026-109618/109619）的概念验证项目，附带检测与修复指导，面向安全研究和教育用途。
编报时的 README 依据
#### 2. Automated Quick-Fix Script A mitigation helper script is available under the [`quick-fix/`](quick-fix/) directory: - **Check Current Status:** ```bash sudo ./quick-fix/run.sh --check ``` - **Apply Mitigation (Dry Run):** ```bash sudo ./quick-fix/run.sh --dry-run ``` - **Apply Mitigation:** ```bash sudo ./quick-fix/run.sh ``` - **Revert Changes:** ```bash sudo ./quick-fix/run.sh --revert ``` #### 3. Source Code Patch (`session-upload-progress-counters.patch`)
If you build PHP from source or maintain custom distribution packages, a C-level source patch is provided under [`patch/session-upload-progress-counters.patch`](patch/session-upload-progress-counters.patch). **What the patch fixes:**
The vulnerability relies on PHP's session upload progress mechanism (`session.upload_progress.enabled`), which is enabled by default. Disabling this directive neutralizes the attack vector while preserving regular file upload functionality: In your `php.ini`: ```ini session.upload_progress.enabled = Off ``` Or for PHP-FPM pool configurations (e.g., `/etc/php/*/fpm/pool.d/www.conf`): ```ini php_admin_flag[session.upload_progress.enabled] = off ``` After modifying the configuration, reload/restart your web services (e.g. `systemctl reload php-fpm` or `systemctl reload apache2`).
- **Impacted Versions:** Reports indicate PHP versions 5, 6, 7, and 8 may be affected. Fixes are primarily expected for currently supported PHP 8 branches, leaving end-of-life (EOL) versions (PHP 5.x, 7.x, 8.0, 8.1) exposed without official vendor patches. - **Industry Tracking:** Confirmed by security researchers (watchTowr reproduced CVE-2026-109618; monitoring by Huntress and Florian Roth / process-watcher). #### Root Cause
- If suspicious child processes or unexpected files are detected, isolate the host and preserve web server/PHP logs. - Inspect web roots and temporary directories (`/tmp`, `/var/tmp`) for dropped webshells or transient execution artifacts. --- ### Proof of Concept (PoC) This repository is dedicated to security research and Proof-of-Concept (PoC) development for **php2shell (CVE-2026-109618 / CVE-2026-109619)**. The PoC exploit is currently being developed and tested. The code will be published in this repository very soon.
- NVIDIA/flare-local-inferencePython · 498 Stars
模型本地部署、模型服务接入
Stars 统计更新于 2026/10/22 07:45:59
查看原始资料
编报时的 AI 中文解读
Flare 是一个针对 NVIDIA SM120/SM121 GPU 的本地推理服务器，专为长对话、编码代理和重复工具使用而设计，旨在让工作站和 DGX Spark 等紧凑型系统的内存、带宽和计算得到更充分的利用，同时保持生成响应速度。
编报时的 README 依据
<p align="center"> <img src="docs/images/flare-logo.png" alt="Flare — ASCII wordmark above a solar flare" width="912"> </p> > **Coding agents:** skip this README and read [AGENTS.md](AGENTS.md) directly. Flare is a local inference server for NVIDIA SM120/SM121 GPUs, built for long conversations, coding agents, and repeated tool use. Its goal is to make the memory, bandwidth, and compute in workstations and compact systems such as DGX Spark go further, while keeping generation responsive. The design rests on a few principles:
[vLLM also uses CUDA graphs](https://docs.vllm.ai/en/latest/design/cuda_graphs/). Compare the engines on your actual model and workload. Start with [model preparation and serving](docs/model-preparation.md). See the [CLI guide](docs/cli-design.md) for configuration and the [core design](docs/core-design.md) for the architectural reasoning.
hardware, and deployment patterns. Flare trades that breadth for a focused serving contract around selected models and local workloads. That focus lets model preparation, kernels, memory management, and scheduling be designed together. It also means supported recipes and prepared capacities determine what you can run. Think of Flare as a specialized option when its hardware and model coverage fit your machine. Rust gives the serving runtime explicit resource ownership; performance still depends on the GPU work, memory traffic, and scheduling.
- 9bie/php2shell-bypass-aslr-expPython · 408 Stars
漏洞复现
Stars 统计更新于 2026/10/22 07:45:59
查看原始资料
编报时的 AI 中文解读
这是一个针对 PHP 8.4.26 session 漏洞的远程代码执行（RCE）复现工具，通过单个 Python 脚本在完全远程、纯 HTTP 条件下利用漏洞，适用于安全研究人员在授权环境中进行漏洞验证。
编报时的 README 依据
cd php2shell-bypass-aslr-exp # 1) 拉官方镜像（PHP 8.4.26 / Debian 12 / Apache prefork） docker compose -f docker/docker-compose.yml pull # 2) 起目标：单 worker、display_errors=On、memory_limit=8M docker compose -f docker/docker-compose.yml up -d # 3) 等 Apache 就绪并确认普通页面 for i in $(seq 1 20); do curl -fsS http://127.0.0.1:8088/index.php >/dev/null 2>&1 && break sleep 0.5 done curl -s http://127.0.0.1:8088/index.php # OK # 4) 一条命令完成整个利用；首次运行会自动读取 libphp 偏移 python3 exploit.py -u http://127.0.0.1:8088/index.php # PROOF: uid=33(www-data) gid=33(www-data) groups=33(www-data) ```
# php2shell — PHP 8.4.26 session 漏洞复现 中文 | [English](readme_en.md) 在“完全远程、只用 HTTP、目标页面无 `session_start()`、不写任何目标侧 PHP”的约束下，用**一个 `exploit.py`** 打通 PHP 8.4.26 + Apache prefork + mod_php 的 RCE。官方 `php:8.4.26-apache` 镜像已实测 **3/3** 一键成功（`PROOF: uid=33(www-data)...`）。当前版本要求 `display_errors=1`；`display_errors=0` 已打通纯 HTTP 堆泄漏，完整 RCE 稍后提交。 ## exp 下面是从零到 RCE 的完整命令，整段复制执行即可。本仓库不编译 PHP/Apache，没有 `docker build`：环境就是官方 `php:8.4.26-apache` 镜像加 `docker/` 下的配置挂载。 ```bash # 依赖：Docker Engine/Desktop + Docker Compose v2 + Python 3.9+ git clone https://github.com/9bie/php2shell-bypass-aslr-exp.git
zif_system 0x... zval_ptr_dtor 0x... [+] chunk base = 0x... [+] libphp base = 0x... [*] stage 3: HTDATA=0x... ZIF=0x... PROOF: uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` payload 里的命令上限是 **14 字节**。要跑任意命令，把脚本写到挂载目录，再用 `sh</out/c`（8 字节）执行： ```bash printf 'id; uname -a > /out/p1\n' > out/c python3 exploit.py -u http://127.0.0.1:8088/index.php -c 'sh</out/c' ```
- **环境**：官方 `php:8.4.26-apache`（PHP 8.4.26 / Debian 12 / Apache 2.4.69 prefork）+ [docker/php.ini](docker/php.ini)、[docker/apache.conf](docker/apache.conf)，默认 `--profile bookworm`，实测 **3/3**。原 lab 构建（Apache 2.4.68、最小 PHP）用 `--profile lab`；两套 profile 的 chunk 偏移和 stage3 触发方式已分别标定。 - **边界**：当前 RCE 要求 `display_errors=1`、`memory_limit=8M`、`max_input_vars=1000`、`session.use_cookies=1`、`session.use_strict_mode=0`、单 worker prefork；`display_errors=0` 的完整 RCE 稍后提交。 - 仅用于授权环境中的漏洞研究与复现。
- aicodeking/pandacodeRust · 401 Stars
编码代理管理、任务管理、Git集成
Stars 统计更新于 2026/10/22 07:45:59
查看原始资料
作者描述
PandaCode: a calm desktop workspace for coding agents
编报时的 AI 中文解读
PandaCode 是一个面向编码代理的桌面工作区，可在同一窗口中并排运行多种编码 CLI（如 Claude Code、Codex 等），并提供任务管理、Git 集成、终端和浏览器等工具，适合需要同时管理多个编码代理任务的开发者。
编报时的 README 依据
# PandaCode A small, native desktop workspace for coding agents. PandaCode runs the coding CLIs you already use — **Claude Code, Codex, Kimi Code, OpenCode, GLM Coding Plan and Xiaomi MiMo** (through Claude Code), **Antigravity and xAI's Grok Build** (through ACP) **Pi** (through its RPC mode) and **DeepSeek** (through ACP) — side by side, with your projects, Git, a terminal and a browser in one window. PandaCode is free and open source under the [PandaCode License](LICENSE), the MIT License with one addition: forks that are used commercially or released publicly
per task; switch between them from the composer. See [providers](docs/providers.md). - **Tasks and a task board.** Parallel tasks across projects, a Pending → In progress → Review → Completed [board](docs/task-board.md), message queueing and steering while an agent runs. - **Agent teams.** An [architect and up to three workers](docs/architect-workers.md), mixing harnesses and models, or named team profiles. Each spawned worker is one line in the turn that started it; click it to open the worker. - **Bots.** Put an agent behind Telegram, Slack, Discord, WhatsApp or a local web
must say "This is a fork of PandaCode" and link to this repository. There is no account, no license key and no telemetry. Built with Tauri 2, Rust, SQLite and plain TypeScript. It uses the operating system's webview: no bundled Chromium, resident Node server, React runtime or embedded editor engine. <p align="center"> <b>Download:</b> <a href="https://github.com/aicodeking/pandacode/releases/latest/download/PandaCode-macOS-arm64.dmg">macOS (Apple silicon)</a> · <a href="https://github.com/aicodeking/pandacode/releases/latest/download/PandaCode-Windows-x64-setup.exe">Windows x64</a> ·
| macOS (Apple silicon) | [`PandaCode-macOS-arm64.dmg`](https://github.com/aicodeking/pandacode/releases/latest/download/PandaCode-macOS-arm64.dmg) | macOS 12+ | | Windows x64 | [`PandaCode-Windows-x64-setup.exe`](https://github.com/aicodeking/pandacode/releases/latest/download/PandaCode-Windows-x64-setup.exe) | Windows 10 1809+ or Windows 11 | | Linux x64 | [`PandaCode-Linux-x86_64.AppImage`](https://github.com/aicodeking/pandacode/releases/latest/download/PandaCode-Linux-x86_64.AppImage) | Ubuntu 22.04+ or compatible, X11 or XWayland |
verifies its signature, and restarts to install it when no agent is working and you've stepped away (or when you click **Restart to update**). Turn this off in Settings → About. See [platform support](docs/platform-support.md) for details. Then install Git and at least one coding CLI and sign in with its normal login. PandaCode does not include provider plans or usage.
Release builds are not code-signed, so your OS will warn the first time: - **macOS:** if macOS says it cannot verify PandaCode, open **System Settings → Privacy & Security** and click **Open Anyway**. - **Windows:** if SmartScreen appears, click **More info → Run anyway**. - **Linux:** `chmod +x PandaCode-Linux-x86_64.AppImage`, then run it. Some distributions need FUSE 2 (`libfuse2`), or set `APPIMAGE_EXTRACT_AND_RUN=1`. Each file has a `.sha256` checksum beside it. Once installed, PandaCode updates itself: it checks the latest release, downloads a newer version in the background,
- realskyrin/ns-game-apple-arm-port未标注语言 · 397 Stars
游戏移植指导、AI辅助编程
查看原始资料
作者描述
Agent skill for native Nintendo Switch game porting to Apple Silicon macOS, iPadOS and iOS with Rust and Metal
编报时的 AI 中文解读
面向AI编程助手的指令型skill，用于将Nintendo Switch游戏移植到Apple Silicon macOS、iPadOS和iOS，以Rust与Metal为核心，覆盖版本识别、AArch64离线改写、Horizon服务、NVN→Metal、输入音频、部署及实机验收。
- wevm/ondineRust · 354 Stars
图表编译、SVG生成
查看原始资料
作者描述
Fast and simple diagrams.
编报时的 AI 中文解读
Ondine 是一个用 Rust 编译 Mermaid 图表的工具，可将图表预编译为 SVG，支持 Vite 插件、CLI、Node 编译器、Markdown/MDX 集成、浏览器内编译和 GitHub 图片服务，适用于需要快速、轻量渲染图表的开发者和文档编写者。
- murkantor/Project-MidasC · 316 Stars
游戏运行
查看原始资料
作者描述
PC port of GE for Windows and Linux, built from the N64 decompilation. Widescreen, mouse look, modern controller support and in-game settings. Co-op, netplay and mods in development.
编报时的 AI 中文解读
Project Midas 是经典游戏《黄金眼007》的 PC 移植版，基于 N64 反编译代码构建，支持 Windows 和 Linux 平台，需要玩家自备美版卡带镜像才能运行。适合希望在现代 PC 上重温该游戏的玩家。
- Jakeschincariol/day-trader-skillPython · 234 Stars
图表扫描、新闻追踪、交易模拟
查看原始资料
作者描述
11 Claude skills for day trading: scan thousands of charts, track breaking news, time every entry and exit, and replay every outcome before you risk a dollar.
编报时的 AI 中文解读
提供11个用于日内交易的Claude技能，涵盖图表扫描、新闻追踪、入场出场时机、风险管理和模拟回放等功能，面向交易者，强调纸面交易和人工确认。
- lesnolie/TigrisKotlin · 228 Stars
桌面美化、照片屏保、内存清理
查看原始资料
作者描述
Tigris — tvOS 26 style launcher for Android TV: Liquid Glass dock, Top Shelf, glass Control Center, photo screensaver. Agent-installable.
编报时的 AI 中文解读
Tigris 是一个将 Android TV 桌面改造成 tvOS 26 风格的启动器，提供 Liquid Glass Dock、顶部内容、控制中心、照片屏保等功能，适用于 Android TV 9+ 设备，并支持通过 AI Agent 自动安装和适配。
- tombkeeper/BitKindleC · 173 Stars
C编译器、自举工具链
查看原始资料
编报时的 AI 中文解读
BitKindle 是一个从极小的机器码种子自举的 Windows x64 C 编译器工具链，包含编译器、链接器和运行时库，无需外部工具即可构建。 该项目面向对编译器自举、底层工具链构建感兴趣的开发者，提供了详细的构建和使用文档。
- lovisdotio/motion2codeHTML · 155 Stars
视频转代码、动画重建、逐帧校验
查看原始资料
作者描述
Skills for coding agents: rebuild a motion design video as looping SVG + GSAP code, checked frame by frame against the source
编报时的 AI 中文解读
为编码代理提供技能，将动态设计视频重建为可编辑的SVG和GSAP动画代码，并逐帧对照源视频验证。适用于使用Claude Code、Codex、Cursor等编码代理的开发者。
- helloianneo/ian-xhs-carouselHTML · 135 Stars
图文排版
查看原始资料
作者描述
把文章、案例或笔记排成 3:4 小红书图文 | 1080×1440 | 20 个母版 | 浅色 / 深色 | Claude Code Skill
编报时的 AI 中文解读
这是一个Claude Code Skill，用于将文章、案例或笔记转换为3:4比例的小红书轮播图文，提供20个母版和深浅色主题，适合内容创作者快速生成统一的图文作品。
- browser-use/rl-env-useHTML · 101 Stars
RL环境构建、提示词优化
查看原始资料
作者描述
Build RL environments for any domain from real cases that Browser Use agents mine from the web
编报时的 AI 中文解读
根据一行技能描述自动构建强化学习环境的工具，环境任务来自Browser Use代理从网络挖掘的真实案例，并附带模型提示词优化功能。
- Xc1Ym/LumaDockSwift · 100 Stars
游戏启动
查看原始资料
作者描述
LumaDock — a native macOS launcher for player-imported Switch games, powered by nxnative
编报时的 AI 中文解读
LumaDock是专为Apple Silicon Mac设计的游戏启动器，基于nxnative引擎，允许玩家导入NSP游戏文件和密钥，并通过图形界面完成准备和启动。适用人群是希望在Mac上运行Switch游戏的玩家。
- abdiraimov-otabek/dashboard-design-skill未标注语言 · 97 Stars
仪表盘设计、AI辅助编程
查看原始资料
作者描述
A Claude Code skill for clean, honest dashboard UI: KPI tiles, charts, date pickers, ranked lists, states, layouts and a screenshot QA pass. Distilled from 127 shipped dashboards.
编报时的 AI 中文解读
这是一个Claude Code技能，用于指导编码代理构建、重新设计和审查数据仪表盘，涵盖KPI磁贴、图表、日期选择器、排名列表等组件，并包含截图QA检查。适用于希望提升AI辅助仪表盘设计质量的开发者。
- ilAoC/mcd-gacha-collectorPython · 92 Stars
卡牌抽卡、营养查询、真实下单
查看原始资料
作者描述
麦卡收藏家 · 基于麦当劳中国 MCP 的卡牌收集 Skill + 网页版（麦当劳程序员创意开发大赛参赛作品）
编报时的 AI 中文解读
基于麦当劳中国 MCP 的卡牌收集 Skill 与网页版，将 160+ 餐品变成可收集的 SSR/UR/R 卡牌，支持抽卡、积分管理、营养查询和真实下单。适用人群为卡牌收集爱好者、麦当劳 MCP 使用者及 WorkBuddy Agent 玩家。
- free-dam-man/homeline-residential-exit-skillShell · 78 Stars
住宅IP线路搭建、代理配置
查看原始资料
编报时的 AI 中文解读
这是一份给AI使用的Skill，帮助用户在自有VPS上部署一条出口为住宅IP的VLESS+Reality线路，通过VPN Gate节点实现，适用于希望获得住宅IP出口的用户。
- qianshuixia/shrimpreelTypeScript · 78 Stars
AI视频生成、SaaS站点搭建
查看原始资料
作者描述
Open-source template for "one photo → AI video that follows a viral template" SaaS sites, one site per trending keyword. Cloudflare Workers + D1/R2/KV/Queues, TanStack Start + Hono, Google sign-in, credit packs (Waffo/Dodo), fal.ai video generation, admin console.
编报时的 AI 中文解读
这是一个开源SaaS模板，用于构建“单张照片生成符合病毒式模板的AI视频”网站，每个热门关键词对应一个站点，部署在Cloudflare上。适合想快速搭建类似AI视频生成服务的开发者。
- gojko/lights-on-software-factoryJavaScript · 77 Stars
AI辅助编程、模型接口服务
查看原始资料
作者描述
Lights-on software factory boilerplate for Claude Code. Based on the setup developed for Votito.
编报时的 AI 中文解读
为Claude Code提供软件工厂的起始模板，包含安全容器、命令监管、代码检查、工作流和编排器，旨在减少令牌消耗并提高自动化程度。适合希望以更高效方式使用Claude Code进行项目开发的团队。
- HalfVulpes/Deepinfer-SM80Python · 73 Stars
模型本地部署、模型性能优化
查看原始资料
作者描述
Deepinfer inspired implemetation on SM80 Ampere architecture. Deepest respect for DeepSeek opensource this work!
编报时的 AI 中文解读
该项目将DeepSeek的DeepInfer推理引擎移植到NVIDIA Ampere架构GPU上，针对A100、RTX 3090等显卡进行内核优化，以提升DeepSeek-V4.1模型的推理性能。
- qqb521/dsh-purge未标注语言 · 70 Stars
模型行为控制、提示词管理、自检诊断
查看原始资料
作者描述
Purge Community：给 DeepSeek Harness 拆闸的插件 —— 83 条宿主补丁 · 27 层破甲自检 · 提示词/规则/技能管理 · 原生右侧面板
编报时的 AI 中文解读
Purge Community 是一个为 DeepSeek Harness 设计的插件，用于解除宿主默认策略限制，提供提示词、规则和技能管理，并带有自检和诊断功能。适用于希望更灵活控制模型行为的 DSH 用户。
- migasrias2/geckoboxTypeScript · 66 Stars
多机任务调度、编码代理管理、远程开发
查看原始资料
作者描述
Run Claude Code, Codex or any coding agent on any of your computers, and jobs across all of them at once. Free, MIT, no relay, no limits.
编报时的 AI 中文解读
一个命令行工具和SDK，让你在自己选择的电脑上运行Claude Code、Codex等编码代理，并可在多台电脑上同时执行任务。适合需要在多台机器上并行运行编码任务的开发者。
- lklbar666/mcd-saver-checkupPython · 64 Stars
差价审计、凑单检测、习惯审计
查看原始资料
作者描述
麦当劳省钱体检：不看你想吃什么，先看你已经亏在哪。基于麦当劳中国 MCP 的差价审计 Skill——枚举所有买法，用 calculate-price 逐个复算，报差额、归因与凑单临界点。
编报时的 AI 中文解读
基于麦当劳中国MCP的省钱审计Skill，通过枚举所有买法并用calculate-price复算，报告差额、归因与凑单临界点，帮助用户发现已发生的亏损。
其余 2 个项目见收录列表。