Posts

A relaxed take on Python list comprehensions: translate them back into the equivalent for-loop, and check what's actually true about variable leaking and speed on Python 3.14.

用比較白話的方式聊 Python 列表推導式：把它翻回普通的 for 迴圈來看，順便用 Python 3.14 實測一下變數外洩跟效能到底是怎樣。

Your first Claude Code skill won't look like the polished examples in tutorials. It'll look like a prompt you've typed three times in a row, saved into a four-line markdown file. This post walks that minimum shape, shows the three things that break, and compares it to a real seventeen-line production-grade skill from the framework I use daily.

你的第一個 skill 不會長得像書裡那些 production-grade 的成熟形態，它會長得像「你重複打三次的同一個 prompt」。從那裡開始，比從一個成熟框架的 skill 倒著學容易很多。

I asked Claude to draft me a skill that calls OpenAI's Codex CLI. It came back as thirteen lines of markdown. The thirteen lines aren't the skill — they point to where the skill actually lives. That split between dispatcher and contract is what separates a skill from a prompt.

我請 AI 幫我寫一個能從 Claude Code 呼叫 Codex CLI 的 skill，它給我 13 行 markdown。13 行很小，但 skill 跟 prompt 真正的差別不在這 13 行裡——在它指過去的那一份東西裡。

MCP（Model Context Protocol）一年內成為 AI 業界標準，2026 年卻接連爆出 RCE、tool poisoning、rug pull 等資安漏洞。本文整理多方專家觀點，並提出我的看法：真正要補的是治理這一層。

MCP became the industry's default agent-to-tool interface in barely a year, then 2026 brought a wave of RCE, tool poisoning, and rug-pull disclosures. Weighing the expert debate, my take: the real exposure is a governance gap that better protocol design alone won't close.

一個 skill 會多可預測，大概就看它的邊界劃得多清楚。把它當能力清單，它會亂跑；把它當合約（講好輸入、輸出、不碰什麼），它就比較像一個設計良好的 API。

An agent skill behaves predictably to the exact degree its boundary is specified. Treat it as a capability list and it drifts; treat it as a contract (declared inputs, outputs, and scope), and it behaves like a well-designed API.