标签：#r

When you give an LLM a tool, you hand it a real function and let it choose the arguments. Those tools are everything your agent can do to a real system: read a file, write to your database, send an email, run a shell command, delete data. They are your risk surface, and most teams have never looked at it in one place. So we did. We ran scan across a batch of popular open-source TypeScript AI agents. A few of the things it found, none of them exotic: A coding agent whose grep and glob tools, which sound read-only, actually shell out through execSync . Its bash tool passes a model-chosen string straight to spawn . Arbitrary command execution, behind three innocuous names. A query tool that fires an HTTP DELETE . A "query" that deletes. A calculator that runs eval on whatever the model types, in a widely-used agent framework. Arbitrary code execution behind the friendliest name in the box. A send-email tool that posts to an array of recipients, so the model chooses who gets mailed. The single most common finding, in almost every agent we scanned: a fetch tool aimed at whatever URL the model supplies. That is a door to your internal network (an SSRF surface). Notice the pattern. The dangerous tools are not named dangerous . They are named grep , query , calculator . A name is a claim. The code is the evidence. See your own agent's tools scan reads that evidence. One command, no install, no signup, no code change: npx @agentx-core/scan . It lists every tool the model can call and ranks each one by what it can do, from read-only up to destructive: 🔍 AGENTX SCAN (TypeScript · 3 files · 5 tools) =========================================================================== RISK TOOL GUARD WHY ---- ---- ------ ------------------------ high calculator yes calls `eval` lib/tools/compute.ts:4 high grep yes calls `execSync` lib/tools/system.ts:8 med sendEmail yes calls `mailer.send` lib/tools/io.ts:5 med fetchUrl yes outbound req to agent-controlled host (SSRF) lib/tools/io.ts:11 2

Effortlessly deploy cloud software factories. Discussion | Link

submitted by /u/dfbaggins [link] [留言]

One memory for every AI you use Discussion | Link

Introduction As developers, we're often drawn to the fast-paced and ever-evolving world of technology. The thrill of learning new skills, the rush of solving complex problems, and the satisfaction of building something from scratch can be incredibly exhilarating. However, this enthusiasm can sometimes tip into an unhealthy obsession, leading to burnout. The Psychological Impact of Constant Learning The tech industry is notorious for its fast pace, with new technologies and frameworks emerging every month. This creates a sense of FOMO (fear of missing out) among developers, who feel pressure to stay updated and relevant. The constant learning curve can be mentally draining, leading to feelings of anxiety and stress. Example: Consider the popular saying 'You can't be good at everything.' This is a crucial fact to acknowledge in our ever-evolving tech world. Example of prioritizing learning paths learning_paths = [ ' AI ' , ' Cloud ' , ' Cybersecurity ' ] priority_path = input ( ' What path do you want to prioritize? ' ) if priority_path in learning_paths : print ( ' Great choice! ' ) else : print ( ' Consider your options carefully. ' ) Environmental Factors: Workplace Culture and Resources The workplace culture and availability of resources can significantly impact a developer's likelihood of burnout. A toxic work environment, lack of support, or inadequate resources can exacerbate burnout, while a supportive and inclusive culture, mentorship, and access to resources can help mitigate it. Recognizing Early Signs of Burnout and Implementing Self-Care Burnout can sneak up on us, but there are early warning signs to look out for. If you're consistently feeling exhausted, disconnected from work, or struggling to focus, it may be time to take a step back and reassess your priorities. Implementing self-care practices, such as exercise, meditation, or hobbies outside of work, can help maintain a healthy work-life balance. ## Conclusion As developers, we need to acknowledge