vibehacker
News
GitHub (nutlope/hallmark) ·

Hallmark v2 is an MIT design skill that lints agent-built pages for AI-slop tells

Together AI's skill for Claude Code, Codex, Cursor and OpenCode, trending on GitHub this week, deals three of fifty themes, then runs sloplint at eight widths to flag tells like eyebrows over every heading or a colored word in the headline, with a fresh-context subagent reviewing last. Install with npx skills add nutlope/hallmark -g, or use /hallmark audit ./index.html to just get a report on an existing page.

Read at github.com

More news

View all

HashiCorp Vault will issue AI agents short-lived, scoped credentials it can revoke mid-task

Announced Oct 27 at IBM TechXchange, Vault ties each agent to an IBM Agent Identity record (owner, lifecycle, granted authority) and hands it short lived, least privilege credentials, revoking the session in real time if the agent tries something outside its permissions. Vault's agent model caps access by the human's policy, an agent ceiling policy, and per task authorization requests (HashiCorp)…

IBM Newsroom

Cursor's Design Mode updates Annotate: click, draw or speak on your running app to direct the agent

In the Agents Window browser (Cursor 3.24.18+), click Annotate or press Cmd+Shift+D , then pick elements, box in an area, edit text or CSS in place, or dictate a note; each note sends the agent element details, a cropped screenshot and, in React, Vue and Svelte, the component stack. It only works on apps you run in Cursor's built in browser, and batched notes stay tied to the page you wrote them on (docs)…

Cursor Blog

OpenAI plans to buy Google's TPUs, adding a second chip supplier alongside Nvidia

The Information reported Oct 27 that OpenAI intends to buy Google's tensor processing units, with no terms, volumes or timeline disclosed, and OpenAI is already hiring engineers to optimize its frontier models for TPU training and inference. It lands a week after OpenAI put its models on Google Cloud and the same day Google said Oracle will offer TPUs through its cloud (The Next Web)…

Reuters (via Investing.com)

mcp-warden is a local MCP credential broker so your coding agent never sees your API keys

Shown on HN Oct 27, the Rust, Apache 2.0 tool keeps secrets in your OS keychain and lets Claude Code, Cursor, Codex or Cline call APIs, SSH or databases only through scoped presets, checking an allow list before injecting the credential and returning just the result. Sensitive presets can require an approval prompt, and every call lands in a local SQLite audit log (HN)…

GitHub (ermoluk/mcp-warden)

Spotted something we missed? Start a thread.