116 points donk8r 8 hours ago 20 comments
hyperionultra 7 hours ago | parent
Uf, how much tokens?
jesse_dot_id 6 hours ago | parent
At least 150k on my relatively small FastAPI project, but hit my session limit. Continuing in a few hours.
chrisweekly 1 hour ago | parent
Oof. YAGNI. 150k tokens is where you start hitting the "dumb zone" (model attention issues and inconsistent adherence to instructions).
prodigycorp 5 hours ago | parent
Hi Cloudflare people, if you are reading this. Please clean up your Cloudflare. Skills. There are way too many skills for the platform. You should consolidate all of your skills into a single skill and route everything thru that skill. The way it is right now pollutes our context window.
m00dy 4 hours ago | parent
I'm sure they read here.
dewey 4 hours ago | parent
They actually do.
bravetraveler 3 hours ago | parent
John Cloudflare: https://news.ycombinator.com/user?id=eastdakota
mooktakim 2 hours ago | parent
I really don't understand why they didn't create an "app store" style skills library where it could be approved and scanned for security issues
simlevesque 47 minutes ago | parent
14 skills with short descriptions doesn't seem like an issue to me.
9el 4 hours ago | parent
Any clues why "an OS-enforced sandbox" is in requirements?
nicce 3 hours ago | parent
Probably to save their skin if agent starts to do some unexpected things and bringing havoc. But I doubt that OpenAI models with normal subscription, for example, wont even work with this skill.
gbrindisi 4 hours ago | parent
Shameless plug: in case someone finds this requiring too many tokens, we shared the recipe on how we built our own in house audit skill so that it can easily be replicated and tuned to different environments https://www.synthesia.io/post/automating-code-security-revie...
gyanchawdhary 2 hours ago | parent
This is awesome. Thanks for sharing
wslh 53 minutes ago | parent
Tip for security professionals using LLMs: audit skills that explicitly frame the task as security research sometimes trigger refusals from the top OpenAI and Anthropic models because they guard against misuse. What works for me: separate skills for bug classes (and bugs in general) without the security framing, plus another skill that combines their findings to spot security bugs.
viraptor 2 minutes ago | parent
If you're a security professional, go through their validation. You won't get the security refusals anymore. Well... you'll still get the occasional downgrade from Fable, but not the "oh no, I can't do exploits for you" breaks.