DEV Community: Magithar Sridhar

I Built a Nutrition-Scoring Bot Inside Telegram, and Swiggy Just Approved It

Magithar Sridhar — Fri, 24 Jul 2026 00:58:55 +0000

Part 1 of 2: the premise and the problem. Part 2 is the architecture deep-dive, how I cut the reply time from 30 seconds to 5.

The problem I kept having

I order a lot of packaged snacks off Swiggy Instamart. I almost never check the nutrition label before adding something to cart, not because I don't care, but because the label is a photo of tiny text three taps deep. By the time I find it, I've already decided I want the thing.

I built it end to end (Python, FastAPI, Redis, the Telegram Bot API) as a side project, without a team. It's still an early, working prototype, not a polished product. A few weeks in, it got approved into Swiggy's Builders Club, their official program for developers building on top of their platform (I posted about the approval on LinkedIn). That was the point where "side project" started feeling like something worth writing up properly.

The JTBD, in one line: see what you're eating before you buy it, without leaving your chat.

Demo Video:

Why Telegram, why solo

No app to install, no account to create: if you can message a bot, you can use it. That constraint also forced the scope down to something a solo developer could actually ship: no UI to design beyond a chat card, no app store review, no separate onboarding flow.

I built it end to end (Python, FastAPI, Redis, the Telegram Bot API) as a side project, without a team. It's still an early, working prototype, not a polished product. A few weeks in, it got approved into Swiggy's Builders Club, their official program for developers building on top of their platform. That was the point where "side project" started feeling like something worth writing up properly.

The part that wasn't obvious going in

The hard part of this project was never "call an API and show the result." Swiggy's product search doesn't return nutrition data at all, just name, brand, price, and a stock flag. Every score has to be assembled from other sources: external food databases, web search, and, when nothing structured exists, an LLM taking its best guess.

That's a very different engineering problem than a CRUD bot. It means deciding what to trust when your sources disagree or don't exist caching a verified fact very differently from an AI's best guess and, because "packaged snacks" here means Indian packaged snacks, realizing partway through that the standard European nutrition-scoring formula (Nutri-Score) doesn't actually discriminate well on the products people here are buying, and needs tuning

The first working version of all this took ~30 seconds to reply. In a chat interface, that's dead on arrival.

What's next

Part 2 is the architecture post: how the reply time came down to 5-8 seconds, why the caching strategy encodes confidence and not just staleness, and what it took to localize a food-scoring formula for a market it wasn't built for. If any of that sounds familiar (building on an API that doesn't give you the data you actually need, or caching LLM output you don't fully trust), that post is for you.

Drop a comment if you want the Telegram link to try it, or if you've hit a similar "the API doesn't have the field I need" wall on something you're building. Curious what workarounds other people have landed on. (Code's closed-source for now while this is still prototype-stage; happy to answer questions about the approach in the comments.)

A working prototype, built solo with Python, FastAPI, Redis, and the Telegram Bot API. Currently part of Swiggy's Builders Club.

A Reader Asked What My Security Check Actually Verifies. The Honest Answer Sent Me Back to the Code.

Magithar Sridhar — Fri, 17 Jul 2026 17:09:02 +0000

Someone replied on Mastodon to my launch post with a question I didn't have a good answer for:

curious what the security check actually verifies. known CVEs / package provenance is one bar, "this maintainer won't quietly change hands in 8 months" is a much harder one and honestly the one that's bitten people more. still, a tool suggesting the right library beats finding out mid-project it was the wrong one.

I went to check what "security check" actually meant in my own skill, expecting to defend it. Instead I found the weakest rule in the whole file.

What Was Actually There

Phase 3.5's hard gate had this line:

DISCARD (set security: "BLOCKED") if:
- Has a dependency with a known CVE

No data source. No API. Nothing telling the model where to look. In practice this depended entirely on whatever a web search happened to surface for that candidate, which is a fancy way of saying it usually did nothing. And the commenter's actual point, maintainer handoff, wasn't checked at all. Contributors were extracted in Tier 1 and then never used anywhere.

Two gaps, and the second one was the sharper of the two. A known CVE gets patched, gets a CVSS score, gets a GitHub Security Advisory. A quiet maintainer handoff has none of that until someone notices the malware. In event-stream's case, below, that took months.

Building the Real CVE Check

OSV.dev is free, unauthenticated, and covers npm, PyPI, Go, and crates.io from one endpoint:

curl -s -X POST "https://api.osv.dev/v1/query" \
  -d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.15"}'

Straightforward, except for one trap I only found by testing against a real vulnerable package. Query requests==2.19.0 on PyPI and you get advisories back labeled PYSEC-2018-28 with severity: UNKNOWN. Looks like nothing to worry about. But aliases links it to GHSA-x84v-xcm2-53pg, and that one is rated HIGH. PyPI's advisory feed duplicates every GHSA entry under its own ID, and the PyPI-native copy just doesn't carry a severity field. Skip the dedupe and the one advisory that matters hides behind a label that says "unknown."

Building the Publisher-Continuity Check, Badly, Three Times

This is the one the commenter actually asked for, and getting it right took three attempts, each one falsified by testing against real npm data instead of my assumptions about what would work.

Attempt 1: flag any human-to-human publisher change. Tested it against express. False positive. It's not a handoff, it's a healthy team rotating releases among four maintainers over a decade. Same failure on lodash and chalk.

Attempt 2: require that the old publisher never publishes again. This is the technically correct definition of a handoff, and it's useless. Tested against 13 well-known packages: it fired on 8 of them, including react, debug, and semver. Nearly every long-lived package has some handoff somewhere in its history. A rule that fires on most of npm isn't a signal, it's noise, and noise trains people to stop reading warnings.

Attempt 3: same rule, but only report the most recent handoff, and only if it's under 12 months old. This is what shipped. Swept it across 98 popular packages:

n=98  FIRE=7 (7.1%)  STALE=50 (51.0%)  CLEAN=41

51% of those packages carry a stale handoff somewhere in their past. The recency filter is doing the real work. Without it, this thing is worthless.

I broke it once more trying to "improve" it. I replaced the hardcoded bot exclusion list (GitHub Actions, npm, etc.) with a regex, thinking it would generalize better to automation accounts I hadn't thought of. Fire rate on the same 98 packages jumped from 7.1% to 33.7% overnight. The bug: GitHub Actions has a space in it, my character class only covered [-_], so the single most important filter silently stopped matching and every CI-migrated package started reading as a handoff.

Fixed the regex, then measured it head-to-head against the plain hardcoded list on the same list again. Identical result, 7.1% both. The regex bought nothing. Its one apparent win was a rule I'd written specifically to catch a package I'd just watched it fail on, which is fitting my sample, not generalizing. I threw it out and kept the simpler thing.

Does the Recency Filter Still Catch event-stream?

The real test is event-stream, the 2018 incident where right9ctrl took over publish rights from the original maintainer and shipped a targeted credential-stealing payload three versions later. I ran the check as if I were adopting the package at different points in time:

as of 2018-08-01 (before handoff)             -> no handoff
as of 2018-10-01 (before malware disclosed)   -> WARN: dominictarr -> right9ctrl
as of 2018-11-26 (disclosure day)             -> WARN: dominictarr -> right9ctrl
as of 2026-07-17 (today)                      -> 94mo old, not reported

The handoff happened on 2018-09-05. My 12-month recency window means the check would have flagged it any time up to 2019-09-05, and specifically on 2018-10-01, a full seven weeks before the malicious code was publicly disclosed on 2018-11-26. On the day it mattered, OSV would have returned nothing. Advisories don't exist before disclosure. That's the exact complementarity the commenter was pointing at: one check catches what's already known, the other catches something the industry hasn't found yet.

Real fires from the 98-package sweep, none of them noise: dougwilson stepping back from cors and morgan, and wikirik picking up both sequelize and validator in the same window. That second one isn't evidence of anything wrong, but it's exactly the kind of pattern worth a human glance instead of a silent PASS.

What It Doesn't Catch

Worth saying plainly, because a security gate that oversells its coverage is worse than no gate. ua-parser-js, rc, and coa are three real npm supply-chain compromises, and in all three the attacker published under the legitimate maintainer's own account. Publisher continuity reads completely clean on all of them. Only the OSV check catches those, and only after someone disclosed it.

And publisher continuity is npm-only. PyPI's package index has no per-release uploader field at all, just an upload timestamp. Python candidates get an explicit N/A (unsupported ecosystem) instead of a number that implies something was checked.

It Found One For Real

I ship checks, then I re-run whatever eval I already had to make sure I didn't just add a rule that looks right and does nothing. I have a paired skill-on/skill-off comparison that keeps recommending vector databases for the same test project, so I re-ran that same prompt to see if the new OSV check actually changed anything.

It did. chromadb, the library that had won every previous run of that comparison, came back with CVE-2026-45829:

curl -s -X POST "https://api.osv.dev/v1/query" \
  -d '{"package":{"name":"chromadb","ecosystem":"PyPI"},"version":"1.5.9"}'

CRITICAL, pre-authentication code injection, and no patched version at any point in the current release history. I didn't take OSV's word for the "no fix" part, I checked the GitHub Advisory API directly too: first_patched_version: null. Chroma got discarded before it ever reached scoring, for the first time in every run I'd done. The rule wasn't decoration, it changed a real recommendation the moment it had a real vulnerability to work with.

Reading the actual advisory, it only fires in Chroma's server mode with trust_remote_code set to true, a flag most embedded, in-process usage never sets. I still discarded it unconditionally, that's the point of a hard CRITICAL-with-no-fix rule, but a block that doesn't say why isn't much more useful than no explanation at all. So the DISCARD rule now also carries the advisory's stated trigger condition into security_note, quoted straight from OSV instead of summarized by me:

DISCARD (set security: "BLOCKED", add security_note) if:
- OSV returns a CRITICAL or HIGH advisory ... with no `fixed` version available
  — set security_note to the advisory's summary, including any trigger
  condition (specific mode, flag, or endpoint) verbatim from OSV

Still blocks regardless of the condition. The note doesn't narrow the rule, it just means the person reading the block can tell "unsafe for me" apart from "unsafe in a mode I don't use," instead of taking a bare BLOCKED at face value.

What Changed

Live in v1.4.6, across all four adapters. Phase 3.5 now runs both checks against live data before scoring anything:

npx skills add Magithar/SKILLmama -a claude-code

github.com/Magithar/SKILLmama, Apache 2.0.

The lesson from this one isn't really about supply-chain security. It's that "make it more general" is not automatically an improvement, and the only way I found that out was by measuring the before and after on the same data instead of trusting that the more sophisticated version was the better one. Twice in this round the simpler rule beat the smarter-looking one, and both times, only running it and counting told me which. And the check itself only proved it was more than decoration once I went back and re-ran the same eval that had been sitting there the whole time, which is exactly what caught Chroma.

I Asked the Same Question With and Without My Own Skill. The Version Without It Won on One Thing That Mattered.

Magithar Sridhar — Fri, 17 Jul 2026 16:56:31 +0000

In my last post, I ran an eval harness against SKILLmama and found two bugs. There was a third finding I held back, because it came from a different kind of test, and it's the one that actually changed a real recommendation.

The idea is simple, and it comes straight from the paired-evaluation method in the SkillsBench paper: take one question, run it twice, once with the skill, once without, same project, same everything else. Compare what comes back.

I hadn't actually done this yet. Every eval run up to that point only tested SKILLmama with itself turned on. So I ran the real comparison, on a real external project, not a toy example.

The Setup

Project: nutri-bot, a Telegram bot I built separately, FastAPI backend, Redis for caching, Gemini and Groq for LLM calls, deployed on Render's free tier. No vector database anywhere in it yet.

Question, asked both ways: "What vector DB should I use for RAG in my FastAPI app?"

Skill-off: a plain agent, given read access to the repo, no web search, no structured pipeline, just its own judgment plus whatever it found by reading the files.

Skill-on: SKILLmama, full pipeline, live web search, verified GitHub stars and PyPI downloads, security screening, the whole thing.

What Skill-Off Said

It read requirements.txt, .env.example, and SETUP.md, then recommended pgvector or Upstash Vector, and specifically warned against Chroma or FAISS running in-process:

On Render's free/small web dynos your process can restart or spin down, so an in-memory or local-disk vector index disappears or desyncs. Only reasonable if your corpus is tiny and rebuildable in a few seconds on startup.

It also tied the embedding model choice to the LLM already in use (Gemini's text-embedding-004, since the app already calls Gemini) and asked what the RAG was actually for before locking in a recommendation.

No live verification. It said so itself when I asked it to self-report: five options seriously compared, no star counts or download numbers checked, pure judgment from reading the repo.

What Skill-On Said

SKILLmama's pipeline ran the full search, verified real numbers, and produced a scored table:

Candidate	Compat	Pop	Maint	Simple	Score
Chroma	8	10	10	9	9.05
Qdrant	6	10	8	6	7.30
pgvector	3	10	7	3	5.55

Chroma came out on top, recommended specifically because it's in-process and needs no extra infrastructure.

That's the exact property skill-off had just flagged as a deployment risk on this platform. SKILLmama's Compatibility check verifies things like whether a required env var exists or whether a CLI is on PATH. It had no check for whether the app's actual hosting target keeps local disk around between restarts. So it confidently scored the one candidate that would silently lose its data on the next deploy.

The Uncomfortable Part

Grounded, verified, live-searched data still lost to a plain agent that just read SETUP.md and thought about it for a second. Not because the plain agent was smarter. Because it happened to look at the one file that mattered for this specific question, and my scoring formula had never told SKILLmama to look there at all.

This is exactly the failure mode Schmid's talk was warning about, and exactly why "run the ablation" isn't optional. If I'd stopped after the first eval run, where I only tested SKILLmama against itself, I would have shipped a skill that confidently recommends the wrong answer for a common deployment shape, and never known.

The Fix

Phase 4 now runs a Deployment Persistence Check before scoring any candidate that stores data locally or in-process. It looks for the same signals the plain agent found by reading a doc file, but does it systematically:

fly.toml      -> persistent only if it has a [[mounts]] section
railway.toml  -> persistent only if a volume is configured
render.yaml   -> persistent only if it has a disk: block
vercel.json   -> always ephemeral, serverless by design
docker-compose.yml -> persistent only if volumes: maps the data path

If a deployment target is detected and none of that is configured, Compatibility gets capped and the output carries an explicit warning instead of a clean-looking number.

Re-ran the same question after the fix. Chroma's Compatibility dropped from 8 to 5, with the warning attached. The score gap to Qdrant narrowed to under half a point, which triggered SKILLmama's own tiebreaker rule, and the output now recommends Qdrant Cloud as the safer default if the data is going to accumulate over time, Chroma only if the corpus is small enough to rebuild on every cold start. Same conclusion the plain agent reached, just with verified stars, downloads, and a security pass attached to it.

Then the Same Prompt Found Something Worse

That wasn't the end of it. The old security gate had a rule that just said "has a dependency with a known CVE," with no data source behind it, so in practice it depended on whatever a search happened to surface that day. I replaced it with a real check: query OSV.dev for the exact version being recommended, across npm, PyPI, Go, and crates.io.

Then I re-ran this same eval to make sure the new check actually worked end to end. It did, and it took out the library that had won every single prior run:

curl -X POST https://api.osv.dev/v1/query \
  -d '{"package":{"name":"chromadb","ecosystem":"PyPI"},"version":"1.5.9"}'

Chroma's current latest release carries CVE-2026-45829, a CRITICAL pre-authentication code injection vulnerability, and there is no patched version. I checked that directly against the GitHub Advisory API rather than trusting the OSV response alone: first_patched_version: null. Chroma is now BLOCKED before it reaches scoring, and Qdrant wins outright, no narrow tiebreaker needed.

Reading the advisory closer, it only triggers in Chroma's server mode with trust_remote_code set to true, an opt-in flag most embedded, in-process usage never touches, including nutri-bot's. The rule still blocks regardless of that, on purpose. I don't want a discovery skill quietly deciding a CRITICAL CVE doesn't apply to you. But a block with no explanation isn't much better than no block at all, so the same day, I changed the rule to quote the advisory's stated trigger condition straight from OSV into the output. Still an unconditional block, now with the context to judge it yourself instead of taking my word for it.

What Changed

Live in v1.4.6, across all four adapters. The full run, both outputs unedited, is in evals/skill-on-vs-skill-off-comparison.md, and the run-by-run log including this one is in evals/skillmama-ablation.md, if you want the actual transcripts instead of my summary of them.

npx skills add Magithar/SKILLmama -a claude-code

github.com/Magithar/SKILLmama, Apache 2.0.

The lesson isn't "plain agents beat structured pipelines." It's that a pipeline is only as good as the checks someone remembered to put in it, and the fastest way to find the one you forgot is to run the version without it side by side and see where it wins. The second lesson, from finding the CVE, is that "the checks someone remembered to put in" needs re-running every time you change what those checks actually do, not just once when you write them.

I Watched a Talk Called "Don't Ship Skills Without Evals," Then Checked If Mine Had Any

Magithar Sridhar — Fri, 17 Jul 2026 16:52:19 +0000

I came across a talk by Philipp Schmid from Google DeepMind, titled "Don't Ship Skills Without Evals." His point, boiled down: everyone's writing skills for AI agents right now, almost nobody tests them, and because LLMs are non-deterministic, eyeballing the output during development ("looks right to me") tells you almost nothing about what happens once the thing hits real usage.

That landed uncomfortably close to home. SKILLmama has four skill files, install instructions across four agents, and a scoring formula I'd been trusting on faith since v1.0. I'd never once actually tested whether it did what it claimed. So I built a small eval harness and ran it. Three bugs, first try.

What I Actually Built

Nothing fancy. A markdown file at evals/skillmama-ablation.md: five prompts that should trigger SKILLmama, five that shouldn't, mapped straight to the Trigger and Do-NOT-activate rules already in the skill file. A result log underneath it.

Should trigger:
1. "What vector DB should I use for RAG in my FastAPI app?"
2. "Find me the best job queue for my Node stack, self-hosted only."
3. "/skillmama" (no args)
4. "Scan my project and tell me what I'm missing."
5. "Recommend something for authentication, must have MCP support."

Should NOT trigger:
6. "How do I configure Redis pub/sub in Python?"
7. "Why is my pgvector query returning zero results?"
8. "Can you review this auth middleware I wrote for security issues?"
9. "I've decided to use Stripe for payments, walk me through the webhook setup."
10. "What's the difference between REST and GraphQL?"

First run: 10 for 10. The trigger logic held up. Good sign, but it's the easy part of the test. It only checks whether the skill turns on. The harder question is whether the pipeline is any good once it fires, and answering that meant pointing it at an actual project instead of a checklist.

Bug One: Silent Failure on the Wrong Directory

I ran the vector-DB prompt from inside SKILLmama's own repo, mostly because that's where my terminal happened to be. SKILLmama scanned the current directory for FastAPI files, correctly found none (it's a docs repo, not a FastAPI app), and just... proceeded. Empty stack profile, and it kept searching anyway like nothing was wrong.

That's the kind of failure nobody reports, because nothing looks broken. It just quietly gives worse answers.

The fix: if the user states a stack inline and the scanned directory shows no trace of it, stop and ask which directory to scan instead of completing an empty pass.

I didn't find FastAPI in this directory, this doesn't look like that
project. Want me to scan a different folder, or should I search based
on what you told me with no local verification?

Bug Two: Confident Numbers That Weren't Verified

SKILLmama's Compatibility score already had a rule: verify locally before scoring, don't just infer. Check .env.example for the right env var, check whether a required CLI is on PATH, don't guess.

Maintenance, sitting right next to it in the same formula, had no equivalent rule. When I ran an actual search, two of three candidates got their last-commit date from a search result. The third got a number from general knowledge of how active that org usually is. All three sat in the same table, looking equally solid.

Fix: Maintenance now runs by the same rule Compatibility already had, verify before scoring, don't infer. If a real last-commit date can't be found, the score shows N/A (unverified) instead of a confident-looking guess, and the total renormalizes across whatever factors are left.

Bug Three Needed a Different Kind of Test

The first two bugs came from just running the pipeline and watching it. The third one needed something closer to what Schmid's talk was actually about: comparing the skill against no skill at all, same question, same project, run in parallel. That's its own story, long enough to deserve a separate post rather than a paragraph here. Short version: it exposed a blind spot in how SKILLmama scored a candidate's fit for a specific hosting platform, and fixing it flipped an actual recommendation. That fix ships alongside that post, not with the two below.

What Changed

The first two fixes are live now, v1.4.4 and v1.4.5, across all four adapters (Claude Code, Claude.ai, OpenAI Codex, and Antigravity), kept in sync so none of them quietly drift from the others.

npx skills add Magithar/SKILLmama -a claude-code

If you want to see the full run log, exact prompts, exact outputs, both bugs as they actually surfaced and not cleaned up after the fact, the eval harness lives at evals/skillmama-ablation.md.

github.com/Magithar/SKILLmama, Apache 2.0.

Credit where it's due: this whole detour started with Philipp Schmid's talk and the SkillsBench paper it references (Li et al., arxiv.org/abs/2602.12670). It found that human-written skills lift task performance by around 15 to 16 percentage points on average, and that AI-generated skills often add filler that does nothing but burn tokens. If you maintain a skill and haven't run it against a labeled prompt set yet, that's the whole homework assignment. Took less time than writing this post did.

The Bug Was in My Own Instructions, Not My Code

Magithar Sridhar — Tue, 14 Jul 2026 16:48:28 +0000

In my last article, a reader's comment exposed a hole in SKILLmama's design, and I shipped Phase 1.5 to fix it. This time, nobody had to point anything out to me. I did something I should have done a long time ago: I actually opened Antigravity, followed my own README, and watched what happened.

It didn't work.

The Recording

SKILLmama supports four agents — Claude Code, Claude.ai, OpenAI Codex, and Antigravity — and the README has always promised the same thing for all four: install it, then ask a capability question, and you get a scored, ranked recommendation with a compatibility/popularity/maintenance/simplicity breakdown.

I had never actually verified that claim for Antigravity. So I opened it, typed:

find me the best vector database for a Python project

And got back a plain, generic answer. No stack scan. No constraint question. No scoring table. Just the kind of freeform response you'd get from any assistant with no skill loaded at all.

SKILLmama wasn't running. It wasn't even trying.

The Wrong Guesses

My first assumption was reasonable: the npx skills add CLI I'd been telling people to use must be installing to a path Antigravity doesn't check. I went and read the CLI's own source (vercel-labs/skills) to find the real path. Found what looked like the answer. Copied the skill file there by hand. Restarted Antigravity. Tested again.

Still nothing. Same generic answer.

Second guess. Maybe I had the wrong directory entirely. I tried another path that seemed plausible from the CLI's agent config. Restarted again. Tested again.

Still nothing.

Two wrong guesses in a row are usually a sign you're debugging the wrong layer. I was reverse-engineering a tool that manages the skill, when I should have been reading what the agent itself actually documents about where it looks.

The Real Answer Was in the Docs I Hadn't Read

antigravity.google/docs/skills — the actual, official documentation for how Antigravity discovers skills. I hadn't opened it once before this.

It states, plainly, two locations:

Project scope: <workspace-root>/.agents/skills/<skill-folder>/
Global scope:  ~/.gemini/config/skills/<skill-folder>/

Neither of my two guesses matched. The CLI's own source code — the thing I'd trusted as ground truth — pointed somewhere Antigravity was never going to look.

I copied the skill to the real path, restarted Antigravity one more time, and asked it directly: "Which skills are installed?"

SKILLmama — AI-Native Capability Discovery Engine

There it was, listed under Global & Built-in Skills, sitting right next to Antigravity's own native commands. I asked the same vector-database question again — this time invoking it explicitly — and got back exactly what the README had been promising the whole time: a constraint question, then a scored breakdown.

It worked. It had just never worked the way I'd been telling people to install it.

Closing the Loop

Once I had a real repro, I checked whether anyone else had already run into this — and found an open issue on vercel-labs/skills asking for the exact fix Antigravity actually needs. I added my repro to it: what the CLI installs today, what Antigravity actually reads, and how to reproduce the mismatch. Not my repo to fix, but worth leaving evidence for whoever does.

The README now leads with the manual install to the correct path — confirmed, not assumed — and only mentions the CLI as a secondary option with an explicit warning about where it currently goes wrong.

Bonus: While I Was In There

Chasing down the Antigravity bug surfaced two more things worth fixing in the same pass:

Scoring got more honest. The Compatibility score used to be inferred purely from your detected stack. Now, before scoring, SKILLmama checks your actual environment — does the required env var exist in .env.example? Is the CLI on your PATH? A missing dependency now shows up as a flag on the score instead of a silently inflated number.

The four adapters had quietly drifted apart. codex/AGENTS.md and antigravity/PROMPT.md still carried leftover wording from an earlier two-stage architecture that had since been dropped — meaning the instructions Codex and Antigravity were actually running had subtly diverged from the canonical pipeline in skillmama/SKILL.md. Consolidated all three back to running identical logic, with only the genuinely agent-specific bits (like install syntax) left different.

What Changed

All of this is live in v1.4.3. For Antigravity specifically:

mkdir -p ~/.gemini/config/skills/skillmama
curl -sL https://raw.githubusercontent.com/Magithar/SKILLmama/main/skillmama/SKILL.md \
  -o ~/.gemini/config/skills/skillmama/SKILL.md

Restart Antigravity, then invoke it explicitly: SKILLmama find me a vector database for this project.

github.com/Magithar/SKILLmama — Apache 2.0.

The lesson wasn't really about Antigravity. It was that "the README says it works" and "I watched it work" are two different claims, and I'd been treating the first one as good enough. It isn't. If you maintain something with install instructions for more than one platform, go run them yourself — not the happy path you remember writing, the actual one, today.

10 Common Unity Networking Issues (and How to Fix Them)

Magithar Sridhar — Mon, 06 Jul 2026 21:21:30 +0000

Multiplayer bugs in Unity rarely look like networking bugs. They look like "the game froze," "the player teleported," or "it worked in the Editor and broke in the WebGL build." By the time you've traced it back to the actual cause, you've usually burned an afternoon.

Here are 10 issues that show up constantly in Unity networking code (WebSocket-based, Socket.IO, or otherwise) with the actual root cause and the fix. A few of these come straight out of real regression tests and commit history in socketio-unity, an MIT-licensed Socket.IO v4 client for Unity. The rest are patterns you'll recognize if you've shipped a multiplayer game.

1. Reconnect wipes your room/namespace state

Symptom: Connection drops for two seconds, comes back, and the player is no longer in their room/lobby/channel, even though the server never removed them.

Cause: A common (bad) reconnect implementation tears down the whole client and rebuilds it from scratch, including the list of channels/namespaces the player had joined. The reconnect "succeeds" at the transport level but silently drops application-level state.

Fix: Reconnect logic should preserve subscriptions across the transport reset and only re-emit join/connect for namespaces the client already had open. If you're rebuilding the socket object on every reconnect attempt, stop. Reconnect the transport, keep the namespace map.

// Wrong: rebuilds everything, loses namespace state
void OnReconnect() => CreateFreshEngine();

// Right: reuses the existing namespace map
void OnReconnect() => ReconnectEngine(); // _namespaces untouched

2. "get_gameObject can only be called from the main thread"

Symptom: Random UnityException thrown from inside a network event handler, but only sometimes, usually right when the server sends something.

Cause: Your WebSocket/network library delivers callbacks on its own I/O thread. Any Unity API call (transform.position =, Instantiate, even some Debug.Log paths) from that thread throws.

Fix: Never touch Unity APIs directly in a network callback. Queue the work and drain the queue from Update() on the main thread.

socket.OnMessage += data => {
    UnityMainThreadDispatcher.Enqueue(() => {
        // Safe: runs on the main thread next Update()
        player.transform.position = ParsePosition(data);
    });
};

This is table stakes for any Unity networking layer. If the library you're using doesn't do this for you automatically, you're going to hit this bug in production, not in testing.

3. `Connect()` hangs with no timeout

Symptom: State sits at Connecting indefinitely. No error, no timeout, no exception. Just silence. Usually happens against a misconfigured server or a proxy that accepts TCP but drops the app-level handshake.

Cause: Most networking code has a timeout for "can't reach the server" (connection refused) but not for "reached the server, and it's just... not responding." A raw TCP/WebSocket accept succeeding is not the same as the protocol handshake completing.

Fix: Add an explicit handshake timeout that's separate from the reconnect backoff, and make sure it only applies to the initial connect. Reconnect attempts should use their own backoff.

config.connectTimeoutMs = 10000; // abort with OnError(Timeout) if no handshake in 10s

Don't ship without a default. Set it to 0 only if you have a specific reason to wait indefinitely.

4. WebGL builds behave nothing like the Editor

Symptom: Everything works in Editor and Standalone. WebGL build either doesn't connect, drops messages, or corrupts binary data.

Cause: WebGL doesn't have real threads or a real socket API. Your networking code has to bridge into browser JavaScript via a .jslib plugin, which means a completely different code path (and completely different failure modes) than every other platform. String/byte marshalling between C# and JS is a common place for subtle bugs, for example framing a socket ID and message body with a delimiter character that can also appear inside the message body.

Fix: Don't assume "works on Desktop" implies "works on WebGL." Test the WebGL build specifically, and when framing multi-part messages across the JS/C# boundary, pick a split strategy that can't be broken by message content. For example, split on the first occurrence of a delimiter that's guaranteed not to appear in the ID (like a GUID), not by a fragile index heuristic.

// Fragile: assumes id length is always under 40 chars
var id = raw.substring(0, 40);

// Robust: split on first colon; GUIDs never contain one
var idx = raw.indexOf(':');
var id = raw.substring(0, idx);
var msg = raw.substring(idx + 1); // safe even if msg itself contains colons

5. IL2CPP stripping deletes types that only exist at runtime

Symptom: A MonoBehaviour or class works perfectly in the Editor, then throws MissingMethodException or silently no-ops in an IL2CPP build, but only in the build, never in Play mode.

Cause: IL2CPP's code stripper removes anything it can't prove is used, based on static analysis of scene/prefab references. If you create a component at runtime via AddComponent<T>() or reflection rather than referencing it in a scene, the stripper doesn't see the reference and deletes it.

Fix: Explicitly preserve runtime-created types in link.xml.

<linker>
  <assembly fullname="YourAssembly">
    <type fullname="YourNamespace.RuntimeCreatedComponent" preserve="all" />
  </assembly>
</linker>

If you add a new MonoBehaviour that's instantiated dynamically (not dragged into a scene), add it to link.xml in the same PR. This is the single most common "works everywhere except the build I'm about to ship" bug in Unity networking code.

6. A malformed binary packet crashes the whole handler pipeline

Symptom: One bad server message and the client stops processing all subsequent binary events, or throws a NullReferenceException that spams every frame.

Cause: Binary protocols (file transfer, voice chat, custom serialization) often use a placeholder/reference scheme for large payloads. If a malformed or truncated packet is missing an expected field, code that assumes the field is always present throws. If that throw happens inside a per-frame processing loop instead of being caught at the boundary, it repeats forever.

Fix: Validate untrusted server input at the parsing boundary, not deep in application logic, and wrap binary assembly in a try/catch that routes to your normal error channel instead of letting the exception propagate.

try {
    var payload = BinaryPacketAssembler.Build(placeholders, buffers);
    Handle(payload);
} catch (Exception e) {
    OnError?.Invoke(new SocketError(ErrorType.Protocol, e.Message));
    // don't rethrow - one bad packet shouldn't kill the pipeline
}

Never assume a server-supplied packet is well-formed. Even from your own server, a proxy or version mismatch can produce malformed data.

7. "Heartbeat timeout" that isn't actually a network problem

Symptom: Client disconnects with a heartbeat/ping timeout error. You blame the network, check your server, find nothing wrong, and it happens again an hour later.

Cause: If your event handlers, once correctly dispatched to the main thread (see #2 for the threading model), do something slow like a big JSON parse, a physics query, or an asset load, they can block the main thread long enough that the ping/pong cycle misses its deadline. The client concludes the connection died when actually the game stalled.

Fix: Before assuming it's a server/network issue, profile your event handlers for anything synchronous and slow. Keep handlers cheap; defer heavy work to a coroutine or the next frame instead of doing it inline in the callback.

8. Namespace/room auth fails silently

Symptom: Client connects to the root namespace fine, but a sub-namespace/room never triggers its connect event and no error appears anywhere obvious.

Cause: Joining an authenticated namespace/channel usually requires passing an auth payload at connect time, not after. If you connect without it, or with an empty object, in many implementations the server just silently fails the namespace-level connect while the underlying transport stays fine. Nothing crashes, so nothing looks wrong.

Fix: Always listen for a connect_error on the namespace itself, and double-check you're passing auth at the point of connection, not as an afterthought:

// Wrong - no auth, silently rejected
socket.Of("/admin");

// Right
socket.Of("/admin", new { token = sessionToken });
socket.Of("/admin").OnConnectError += err => Debug.LogError(err);

9. Reflection-based config breaks silently when a dependency renames a field

Symptom: A dedicated-server or multi-transport setup (for example, switching ports based on platform) works, then silently uses the wrong port after an unrelated dependency update. No compile error, no exception.

Cause: Code that sets configuration via reflection (GetField/GetProperty by string name, because the target type is defined in a third-party package you don't want a hard dependency on) is invisible to the compiler. If the third-party library renames a field from a public field to a property (or vice versa) in an update, your reflection call finds nothing, fails silently, and the fallback/default value gets used instead.

Fix: If you must use reflection for soft dependencies, check both field and property, and log loudly (not silently swallow) when neither is found. A silent fallback to a default value is exactly the kind of bug that survives in production for weeks.

var field = type.GetField("port");
if (field != null) { field.SetValue(transport, port); return; }

var prop = type.GetProperty("port");
if (prop != null) { prop.SetValue(transport, port); return; }

Debug.LogWarning($"Could not find 'port' field or property on {type.Name} - falling back to inspector value");

10. Two reconnect timers running at once

Symptom: After a rough network patch, you see reconnect attempts firing twice as often as configured, or backoff resetting unpredictably.

Cause: If your reconnect controller's Start() isn't idempotent, calling it twice (for example, once from OnDisconnect and once from a manual retry button, or once per re-entrant event) spins up a second timer loop instead of being a no-op.

Fix: Guard Start() explicitly, and don't remove the guard during a refactor just because it looks redundant in the happy path. It's there for the unhappy path.

public void Start() {
    if (_enabled) return; // idempotency guard - do not remove
    _enabled = true;
    ScheduleNextAttempt();
}

The common thread

Almost none of these are "hard" bugs. They're boundary bugs. Main thread vs. network thread. Editor vs. IL2CPP build. Desktop vs. WebGL. Trusted code vs. untrusted server input. Every one of them is invisible until you cross the specific boundary that triggers it, which is exactly why they tend to surface in a build the day before a demo instead of in day-to-day Editor testing.

If you're building Socket.IO-based multiplayer for Unity and would rather not rediscover these the hard way, socketio-unity is an MIT-licensed Socket.IO v4 client that handles the main-thread dispatch, reconnect state preservation, WebGL bridge, and IL2CPP stripping concerns above out of the box, with a public test suite covering the regressions.

Install via UPM: https://github.com/Magithar/socketio-unity.git?path=/package

A Reader Pointed Out My "Ask First" Principle Only Covered Half My Tool — So I Fixed It

Magithar Sridhar — Tue, 30 Jun 2026 22:50:34 +0000

In my last article, I added Flow B to SKILLmama: run /skillmama with no arguments, and it scans your project, finds capability gaps, and asks before it searches. The whole point was to stop the AI from guessing what you need.

Then @alexshev left this comment:

Having the AI ask first is underrated because it changes the contract from answer-generation to ambiguity-reduction. The best agents I have used spend a little time shrinking the unknowns before they touch code.

"Ambiguity-reduction over answer-generation." That's a sharper framing of the idea than I'd come up with myself. But reading it back, I realized the comment had quietly exposed a hole in my own design.

The Hole

SKILLmama has two entry points:

Flow B — /skillmama with no args → scan → ask → search
Flow A — /skillmama find me a job queue → scan → search

Flow B asked first. Flow A didn't.

When you named a capability directly, SKILLmama scanned your project for stack context — and then went straight to searching and ranking. It reduced the ambiguity it could see from your files, but it never reduced the ambiguity it couldn't: budget, license, self-hosted vs. hosted, "must work with what I already run."

So /skillmama find me a job queue on a solo side project would happily return an enterprise-grade, infra-heavy #1 pick — technically the highest score, practically wrong for the person asking. The commenter's principle applied perfectly to Flow B. Flow A was still in answer-generation mode.

The Fix: Phase 1.5

I added one step to Flow A: Confirm Constraints.

Phase 0   — parse the request
Phase 1   — scan the project
Phase 1.5 — if no constraints were stated: ask ONE informed question, then STOP   ← new
Phase 2   — derive search terms
Phase 3   — search
...

The key word is informed. Because Phase 1 already scanned your stack, the question isn't a generic "any constraints?" — it's built from what it just found:

SKILLmama: I see you're on Python / FastAPI / PostgreSQL / Docker / OpenAI.
Before I search — any constraints? (e.g. self-hosted, open-source only,
free tier, must integrate with PostgreSQL). Reply "none" to search with no filters.

Then it stops and waits — same hard stop that makes Flow B collaborative.

The Three Rules That Keep It From Being Annoying

A clarifying question is only good if it doesn't fire when it shouldn't. So Phase 1.5 has guardrails:

1. It only fires when you gave no constraints. If you already said find me an open-source job queue, the constraint is on the table — it skips the question and searches immediately. No nagging.

2. It degrades gracefully. If there are no project files to scan (empty folder, fresh repo), it doesn't print a broken I see you're on [nothing] sentence. It falls back to a generic constraint question instead.

3. It asks once. No re-prompting loops. One question, your answer (or "none"), then it runs.

Why "One Informed Question" Beats "A Form"

I could have made Flow A ask the same three questions Flow B asks. I didn't, on purpose.

Flow B earns three questions because it's doing open-ended discovery — it found a handful of gaps and needs to know which ones matter, what your constraints are, and what it missed. Flow A already knows the capability. The only real unknown left is constraints. Asking more than that would be friction for its own sake.

The contract the commenter described — shrink the unknowns before you touch code — doesn't mean "ask everything." It means ask for the smallest input that most changes the output. For a scored ranking, that input is constraints: a single "must be self-hosted" can reorder the entire top 3.

What Changed

Phase 1.5 is live in v1.4.0 across all four adapters — Claude Code, Claude.ai, OpenAI Codex, and Antigravity. Both entry points now reduce ambiguity before they act; they just ask the right number of questions for how much they already know.

npx skills add Magithar/SKILLmama

github.com/Magithar/SKILLmama — Apache 2.0.

And if you've got a sharp observation about where it still guesses instead of asking — leave a comment. The last one became a release.

I Got Tired of Asking "What Am I Missing?" — So I Made My AI Ask First

Magithar Sridhar — Tue, 30 Jun 2026 20:11:39 +0000

In my first article, I built SKILLmama: an AI skill that finds, scores, and ranks the best library for your exact stack.

In my second article, I added a security gate — because a high score means nothing if the tool is dangerous.

Both of those workflows had the same assumption baked in: you already know what you're looking for.

You type /skillmama find me a job queue for Node.js and it searches, scores, and returns ranked picks. That's great when you have a specific gap in mind.

But most of the time, you don't. You're deep in building something and you haven't stopped to ask: do I have auth? do I have observability? do I have a queue? You find out the hard way — when a feature ships without rate limiting, or when something breaks and there's no error tracking.

So I flipped the workflow. In v1.3, /skillmama with no arguments scans your project first and asks what to find.

The Old Flow vs. The New Flow

Before (Flow A — still exists):

/skillmama find me an auth library for Next.js
    ↓
scan project for stack context
    ↓
search → score → recommend

Now (Flow B — triggered when no capability is given):

/skillmama
    ↓
deep scan: reads package files, config, source structure
    ↓
gap analysis: what's missing for this type of project?
    ↓
ask 3 questions — STOP and wait for your answer
    ↓
you pick a gap → search → score → recommend

Both flows converge at the same search and scoring pipeline. Flow B just adds the scan and Q&A in front.

What the Scan Actually Does

When you run /skillmama with no arguments, it reads:

Package files (package.json, pyproject.toml, go.mod, etc.)
Config and infra (Dockerfile, docker-compose.yml, .env.example, vercel.json, fly.toml)
README.md and CLAUDE.md
Source file structure (file listing, not full reads)
2–4 representative source files — the entry point, a route handler, a model

From that, it builds a Stack Profile:

Language:      TypeScript
Framework:     Next.js 14
Database:      Postgres via Prisma
Auth:          none detected
Caching:       none detected
AI/LLM:        OpenAI SDK
Queue/Jobs:    none detected
Search:        none detected
Storage:       none detected
Email:         none detected
Payments:      none detected
Observability: none detected
Testing:       Vitest

Gap Analysis: Not Everything Missing Is a Problem

Once the Stack Profile is built, SKILLmama doesn't just flag every empty row as a gap. It looks at what the project is actually doing and assigns severity:

High — typical for this type of app, likely needed soon
Medium — useful but not urgent
Low — speculative / nice-to-have

For a Next.js app with OpenAI already wired up, the output might look like this:

## SKILLmama — Project Scan

Stack detected: TypeScript / Next.js 14 / Postgres / OpenAI / no auth

Capability gaps found:

| # | Gap              | Severity | Why it matters for your stack                              |
|---|------------------|----------|------------------------------------------------------------|
| 1 | Authentication   | High     | No auth detected — any route is publicly accessible        |
| 2 | Rate limiting    | High     | OpenAI calls with no rate limiting = unbounded cost risk   |
| 3 | Observability    | Medium   | No error tracking — you'll find out about failures late    |
| 4 | Email sending    | Medium   | Common for Next.js apps with user accounts                 |
| 5 | Vector/RAG layer | Low      | OpenAI is present but no vector store — may be intentional |

A few quick questions before I search:
1. Which gap(s) would you like me to find options for?
2. Any constraints? (self-hosted, open-source, must have MCP support, etc.)
3. Anything I missed about your project or plans?

Then it stops. It does not proceed until you reply.

Why the Hard Stop Matters

The first version of this flow I sketched out just picked the highest-severity gap automatically and ran with it. That was wrong for two reasons:

1. Severity is relative to intent. A High gap for a consumer SaaS is a Low gap for an internal tool. The scanner doesn't know which one you're building — you do.

2. You might want to address multiple gaps in order. If you reply "1 and 2", SKILLmama runs the full search and scoring pipeline once per gap and presents each as its own results block. You get ranked picks for auth and rate limiting in one session, not just the first one.

The hard stop is what makes Flow B collaborative rather than presumptuous.

After You Answer

Once you reply — say "1 and 3, open-source preferred" — SKILLmama sets:

capability = Authentication, Observability
constraints = open-source preferred

And jumps straight to Phase 2 (deriving search terms). It skips Phase 0 and Phase 1 entirely — the stack is already known from the scan, so there's nothing left to parse.

From there, the same pipeline runs as always:

Phase 2 — derive search terms
Phase 3 — 5-tier search (GitHub → MCP → npm/PyPI → Templates)
Phase 3.5 — security gate (libraries)
Phase 3.6 — companion skills search
Phase 3.7 — security gate (skills)
Phase 4 — score each candidate
Phase 5 — present results

For the auth gap on a Next.js + Postgres stack, that produces something like:

Scoring all candidates against TypeScript / Next.js 14 / Postgres:

| Candidate   | Compat | Pop | Maint | Simple | Score    |
|-------------|--------|-----|-------|--------|----------|
| NextAuth.js | 10     | 9   | 9     | 9      | **9.55** |
| Lucia        | 9      | 7   | 10    | 8      | **8.75** |
| Clerk        | 8      | 8   | 10    | 10     | **8.90** |

#1 — NextAuth.js · Score: 9.55/10
The de facto auth layer for Next.js — first-party adapter, zero config for most providers.
- Compatibility: 10/10 — built for Next.js, Prisma adapter available
- Popularity:     9/10 — 22k stars, 800k npm downloads/week
- Maintenance:    9/10 — committed 1 week ago
- Simplicity:    9/10  — provider config only, Prisma adapter is one import
- Security:      PASS
- Install: npm install next-auth

What Changed in the Adapters

Flow B is live across all four adapters:

Adapter	How to trigger Flow B
Claude Code	`/skillmama` (no args)
Claude.ai	`/skillmama` (no args)
OpenAI Codex	`"scan my project and tell me what I need"`
Antigravity	`"scan my project and tell me what I need"`

Install

Any agent (via skills CLI):

npx skills add Magithar/SKILLmama

Claude Code:

npx skills add Magithar/SKILLmama -a claude-code

The -a claude-code flag matters: without it, non-interactive installs can silently skip wiring the skill into .claude/skills/, and /skillmama won't show up. Or copy the file directly:

cp .claude/commands/skillmama.md /your-project/.claude/commands/skillmama.md

Then /skillmama in any Claude Code session.

Claude.ai: Clone the repo, run zip -r skillmama.zip skillmama/, then upload the zip under Customize → Skills.

OpenAI Codex: Place codex/AGENTS.md in your repo root.

Antigravity: Load antigravity/PROMPT.md as system prompt.

The Repo

github.com/Magithar/SKILLmama

Apache 2.0. If you used v1.0, v1.1, or v1.2 — pull the latest. The only new behavior is what happens when you run /skillmama with nothing after it.

Found a gap category that should be in the scanner? Open an issue — the list is meant to grow with real project types.

A High Score Means Nothing If the Tool Is Dangerous — So I Added a Security Gate

Magithar Sridhar — Mon, 29 Jun 2026 12:41:19 +0000

In my first article, I built SKILLmama: an AI skill that finds, scores, and ranks the best library for your exact stack — no tab-hopping, no outdated blog posts, just ranked picks with scoring math you can audit.

The scoring formula was the core of v1.0:

Score = (Compatibility × 0.40) +
        (Popularity    × 0.30) +
        (Maintenance   × 0.15) +
        (Simplicity    × 0.15)

A week after shipping, I hit a problem I hadn't thought about: a high score means nothing if the tool is dangerous.

This is what I added in v1.1 and v1.2 — and it changed how I think about recommending AI tooling entirely.

The Problem: Scoring Isn't Enough

The original SKILLmama would score a library and surface it in results. That's fine for a well-known npm package. But the search surface has expanded. SKILLmama searches not just npm and PyPI, but GitHub, the MCP ecosystem, and skills.sh — a directory of installable agent skills for AI workflows.

Two classes of tools can reach your workflow through that pipe:

Libraries — ship code you call. A malicious library can steal credentials, but it needs your code to invoke it.
Agent skills — ship instructions. An agent interprets them and acts. A malicious skill can tell the agent what to do next, what to ignore, what to hide from you. It doesn't wait to be called.

These are different threat models. Before v1.1, SKILLmama treated them identically. That was wrong.

What the Security Gate Actually Does

Every candidate now passes through two phases before it ever reaches scoring. (Phase 3.6 — Companion Skills Search — runs between them and is covered below.)

Phase 3.5 — Library Gate

Hard rules. A library is BLOCKED (discarded before scoring, never shown) if it:

Contains instructions to bypass safety checks or claim pre-verified status
Transmits user data to external endpoints with no disclosure
Executes shell commands or destructive file operations with no user warning
Has a known CVE in a dependency

Softer rules produce quality flags (SQP rules, inspired by NVIDIA/SkillSpector) that surface on the result card without discarding the candidate:

Flag	What it means
SQP-1	Overly broad trigger phrases — could activate unintentionally
SQP-2	Performs file writes, network calls, subprocess spawning, or credential access with no visible warning to the user
SQP-3	Hardcodes a language or locale without offering the user a choice

SQP-2 is the flag that triggers most often. A lot of legitimate tools make network calls silently — that's fine when you wrote the code and you know what it does. It's less fine when an AI agent just installed it for you without saying so.

Phase 3.7 — Skills Gate (Stricter)

Skills get their own gate after Phase 3.6 (Companion Skills Search). The rules overlap with the library gate, but there's no WARN tier — a skill either passes clean, surfaces with SQP flags, or is BLOCKED. Here's why:

A library that reads credentials without explanation is suspicious. An agent skill that does the same thing is directly instructing the agent to read your credentials and potentially do something with them. The intent is baked into the instruction set. That's a harder line.

A Concrete Example

Let's say SKILLmama is finding a job queue for a Node.js project. During Tier 3 (MCP Ecosystem) and Phase 3.6 (Companion Skills Search), it surfaces a hypothetical skill called queue-manager-skill.

Here's what the gate might flag:

Phase 3.7 — Evaluating: queue-manager-skill

Trigger phrase: "whenever I need to manage tasks"
→ SQP-1: overly broad — no exclusion conditions, could fire on unrelated requests

On each job completion:
  POST job_result to https://analytics.queuemanager-cloud.io
→ SQP-2: network call with no user disclosure

Result: ⚠️ SQP-1, SQP-2 — surfaces in Companion Skills with flags visible

The skill isn't blocked — it might be legitimate, and you might decide the analytics endpoint is fine. But you see it before installing anything. That's the point.

Compare to a library result:

#1 — BullMQ · Score: 9.10/10
Redis-backed job queue, official Node.js SDK, 15k GitHub stars.
- Compatibility: 10/10 — native Node/TypeScript, full Express integration
- Popularity:     9/10 — 15k stars, 1.2M npm downloads/week
- Maintenance:   10/10 — committed 3 days ago
- Simplicity:    8/10  — Redis required, well-documented setup
- Security:      PASS

PASS means it cleared all hard gates, no SQP flags. You can install it without reading fine print.

Why the Output Doesn't Shout About It

One deliberate decision: Phases 3.5 and 3.7 don't appear as sections in the output. There's no "Security Report" block. Security findings appear inline on each candidate card only.

The reason: if security is a separate section, developers scroll past it. If it's on the card, it's part of the decision — you see the score and the security line together. A PASS blends into the card. An ⚠️ SQP-2 stands out where it matters.

Blocked candidates are silently discarded — they never appear in results, never in "Also Considered." If something is genuinely dangerous, you don't need to know it lost; you just don't see it.

Companion Skills: Why This Became Necessary

In v1.2, SKILLmama added Phase 3.6: after finding library candidates, it also searches skills.sh and GitHub for installable agent skills that pair with top picks.

For the vector database example from the first article, that looks like:

Companion Skills:
- qdrant-memory-skill (skills.sh) — Security: PASS
  Adds Qdrant as persistent memory for your AI agent; install alongside qdrant-client

This is where the stricter gate on skills stopped being theoretical. Once SKILLmama was actively surfacing skills alongside libraries, it needed to actually evaluate them — not assume that anything on skills.sh was safe by virtue of being listed there. The ecosystem is too new for that assumption to hold.

The threshold I landed on: anything that an agent will interpret as instructions gets a harder gate than code you call yourself. You can audit code. Instructions are harder to reason about at a glance — that asymmetry is why the gate is stricter.

What This Looks Like in Practice

Full output for /skillmama find me a job queue for my Node.js + Redis project:

Scoring all candidates against Node.js / Redis / Express:

#1 — BullMQ · Score: 9.10/10
Redis-backed queue with full TypeScript support and battle-tested at scale.
- Compatibility: 10/10 — built for Node/Redis, native TypeScript
- Popularity:     9/10 — 15k stars, 1.2M downloads/week
- Maintenance:   10/10 — committed 3 days ago
- Simplicity:    8/10  — Redis required, excellent docs
- Security:      PASS
- Install:        npm install bullmq

#2 — bee-queue · Score: 7.85/10
Lighter alternative; fewer features, faster setup.
- Compatibility:  9/10 — Node/Redis native
- Popularity:     6/10 — 3.5k stars, 180k downloads/week
- Maintenance:    8/10 — committed 2 weeks ago
- Simplicity:    9/10  — minimal config, fast local setup
- Security:      PASS

Also Considered: Agenda (MongoDB-based, no Redis dep), p-queue (in-process only)

Companion Skills:
- bullmq-agent-skill · ⚠️ SQP-2 — performs Redis writes with no user confirmation prompt
  Automates job scheduling from natural language; review before installing

Next Steps:
1. npm install bullmq and spin up Redis via docker run redis to validate locally
2. If you want to skip Redis infra, evaluate Agenda — MongoDB-native
3. Review the SQP-2 flag on bullmq-agent-skill before installing in any automated pipeline

Install

Any agent (via skills CLI):

npx skills add Magithar/SKILLmama

Claude Code:

npx skills add Magithar/SKILLmama -a claude-code

The -a claude-code flag matters: without it, non-interactive installs can silently skip wiring the skill into .claude/skills/, and /skillmama won't show up. Or copy the file directly:

cp .claude/commands/skillmama.md /your-project/.claude/commands/skillmama.md

Then /skillmama in any Claude Code session.

Claude.ai: Clone the repo, run zip -r skillmama.zip skillmama/, then upload the zip under Customize → Skills.

OpenAI Codex: Place codex/AGENTS.md in your repo root.

Antigravity: Load antigravity/PROMPT.md as system prompt.

The Repo

github.com/Magithar/SKILLmama

Apache 2.0. The security gate is live across all four adapters. If you used v1.0, pull the latest. The only user-visible changes are the Security: line on each result card and a Companion Skills section when agent skills are found.

Security findings from real use? Drop them in the issues — the SQP ruleset is meant to grow.

A Deterministic Scoring Engine That Finds the Best Library for Your Exact Stack

Magithar Sridhar — Fri, 19 Jun 2026 02:17:07 +0000

Every developer knows this feeling.

You need a vector database. Or a job queue. Or a .dwg parser for Node.js. You open a browser tab, search GitHub, open five more tabs, try to compare stars and last-commit dates, get distracted by a Medium post from 2019, and 45 minutes later you've picked something based on vibes.

There's a better way. I built it.

SKILLmama finds, scores, and ranks the best library, SDK, or tool for your exact stack — no tab-hopping, no outdated blog posts, just ranked picks with scoring math you can audit.

It works with Claude Code, Claude.ai, OpenAI Codex, and Antigravity.

The Problem With How We Pick Libraries

Most library selection looks like this:

Google "best [thing] for [framework]"
Find a Reddit thread from 3 years ago
Pick the one with the most upvotes
Discover 6 months later that it hasn't been maintained since 2021

The real question isn't "what's popular" — it's "what fits my stack, has active maintenance, won't take a week to integrate, and is popular enough to have community support?" Those are four separate signals, and you need all four weighted correctly.

The Scoring Formula

SKILLmama scores every candidate on four dimensions:

Score = (Compatibility × 0.40) +
        (Popularity    × 0.30) +
        (Maintenance   × 0.15) +
        (Simplicity    × 0.15)

Factor	Weight	What it measures
Compatibility	40%	Language/framework fit, official SDK, integration effort
Popularity	30%	GitHub stars, npm/PyPI weekly downloads
Maintenance	15%	Days since last commit, release cadence
Simplicity	15%	Setup effort, documentation quality

Compatibility is weighted highest because a library built for Java won't help you in a Python project, no matter how popular it is. Popularity comes second because the ecosystem around a library matters. Maintenance and simplicity round it out.

Every score is 1–10 per dimension. No black box. You can see exactly why something ranked #1.

The 5-Tier Search Hierarchy

SKILLmama doesn't just search one place. It works through five tiers in order, stopping when it has 8+ candidates:

Tier	Source	What it finds
1	skills.sh	Reusable skills and capability patterns
2	GitHub	Open-source libraries, frameworks, SDKs
3	Smithery / MCP Ecosystem	AI-native tools installable as MCP servers
4	npm / PyPI / pkg.go.dev	Package registries with download signals
5	Curated Templates	LangGraph, OpenHands, cookbook examples

Tier 3 is the interesting one. The MCP ecosystem is growing fast — if there's an MCP server for your capability, you might be able to plug it directly into your AI workflow instead of writing integration code. SKILLmama surfaces that option explicitly.

The Security Gate

But a high score means nothing if the tool is unsafe. Before any candidate gets scored, it passes through a two-layer security and quality check.

The hard gate discards candidates that are genuinely unsafe: CVE dependencies, undisclosed data exfiltration, jailbreak instructions, or destructive operations with no user warning. These never reach the scoring phase.

The quality flags (SQP rules, inspired by NVIDIA/SkillSpector) surface softer issues without discarding the candidate:

SQP-1 — Vague trigger phrases that could activate unintentionally
SQP-2 — Missing warnings on file writes, network calls, or credential access
SQP-3 — Hardcoded language or locale without user opt-in

Every result card shows a Security line: PASS, ⚠️ SQP-2 — [finding], or 🚫 BLOCKED. You always know what you're installing. No surprises. No silent risks.

How It Works

┌─────────────────────────────────────────────────────────┐
│                      USER REQUEST                       │
└─────────────────────────┬───────────────────────────────┘
                          │
                          ▼
              ┌───────────────────────┐
              │   PHASE 0             │
              │   Understand Request  │
              │   Extract: capability,│
              │   stack, constraints  │
              └───────────┬───────────┘
                          │
                          ▼
                   ◇ Capability
                     vague?
                   /         \
                 YES           NO
                  │             │
                  ▼             │
          Ask 1 clarifying      │
          question, await       │
          user response         │
                  │             │
                  └──────┬──────┘
                         │
                         ▼
              ┌───────────────────────┐
              │   PHASE 1             │
              │   Architecture Scan   │
              └───────────┬───────────┘
                          │
                          ▼
                   ◇ In a project
                     repo?
                   /         \
                 YES           NO
                  │             │
                  ▼             │
        Read: package.json,     │
        Dockerfile, README,     │
        source files            │
                  │             │
                  └──────┬──────┘
                         │
                         ▼
              ┌───────────────────────┐
              │   PHASE 2             │
              │   Capability Gap      │
              │   Detection           │
              │                       │
              │   Define:             │
              │   CAPABILITY          │
              │   STACK               │
              │   CONSTRAINTS         │
              │   SEARCH_TERMS (3–5)  │
              └───────────┬───────────┘
                          │
                          ▼
              ┌───────────────────────┐
              │   PHASE 3             │
              │   5-Tier Search       │
              └───────────┬───────────┘
                          │
              Tier 1 ── skills.sh
                 ↓
              Tier 2 ── GitHub (stars, recency, contrib)
                 ↓
              Tier 3 ── MCP Ecosystem
                 ↓
              Tier 4 ── npm / PyPI registries
                 ↓
              Tier 5 ── Templates & Cookbooks
                          │
                   ◇ 8+ candidates found?
                   /              \
                 YES               NO
                  │                │
            Skip remaining    Continue tiers
            tiers                  │
                  └──────┬─────────┘
                         │
                         ▼
              ┌────────────────────────────────────────┐
              │   PHASE 3.5 — Security & Quality Gate  │
              │                                        │
              │   Hard Gate:                           │
              │   🚫 BLOCKED → discard, never score    │
              │   ⚠️  WARN   → show, user confirms     │
              │                                        │
              │   Quality flags (SQP rules):           │
              │   SQP-1  Vague triggers                │
              │   SQP-2  Missing user warnings         │
              │   SQP-3  Policy violations             │
              └───────────────┬────────────────────────┘
                              │
                              ▼
              ┌────────────────────────────────────────┐
              │   PHASE 4 — Score Each Candidate       │
              │                                        │
              │   Score = (C × 0.40) +                 │
              │           (P × 0.30) +                 │
              │           (M × 0.15) +                 │
              │           (S × 0.15)                   │
              └───────────────┬────────────────────────┘
                              │
                              ▼
              ┌────────────────────────────────────────┐
              │   PHASE 5 — Present Results            │
              │                                        │
              │   #1, #2, #3 — full score breakdown    │
              │   Also Considered — table              │
              │   MCP callout (if found)               │
              │   Next Steps (3 actions)               │
              └────────────────────────────────────────┘

End-to-End Example

Prompt:

/skillmama find me a vector database for my FastAPI + Python project

Phase 1 — Architecture Scan

SKILLmama reads your project files first:

✓ pyproject.toml  → Python 3.11, FastAPI, SQLAlchemy
✓ Dockerfile      → containerized, no GPU
✓ .env.example    → OPENAI_API_KEY present → RAG use case confirmed

Detected stack: Python / FastAPI / PostgreSQL / Docker / OpenAI

Phase 2 — Capability Gap Detection (runs internally)

CAPABILITY : vector database for RAG / semantic search
STACK      : Python / FastAPI / Docker / OpenAI
CONSTRAINTS: containerizable, Python client, active maintenance

Phase 3 — 5-Tier Search

Tier 1 skills.sh  → "qdrant-memory-skill", "chroma-rag-skill"
Tier 2 GitHub     → qdrant (17k★), chroma (14k★), pgvector (11k★), milvus (29k★)
Tier 3 MCP        → qdrant-mcp-server, chroma-mcp
Tier 4 PyPI       → qdrant-client (380k/wk), chromadb (620k/wk), pgvector (180k/wk)
Tier 5 Templates  → LangChain + Qdrant RAG template, FastAPI + Chroma starter

Phase 4 — Scoring

Candidate	Compat	Popular	Maint	Simple	Score
Qdrant	9	8	10	9	9.05
pgvector	10	7	9	7	8.65
Chroma	8	8	9	10	8.55
Milvus	6	9	10	4	7.05

Phase 5 — Output

#1 — Qdrant · Score: 9.05/10
Docker-native, official Python client, active MCP server for AI workflows.
- Compatibility: 9/10  — official qdrant-client SDK, FastAPI examples in docs
- Popularity:    8/10  — 17k GitHub stars, 380k PyPI downloads/week
- Maintenance:  10/10  — committed 2 days ago, weekly releases
- Simplicity:   9/10  — docker run + pip install, 5-min setup
- Security:     PASS  — no findings
- Install: docker run -p 6333:6333 qdrant/qdrant && pip install qdrant-client

#2 — pgvector · Score: 8.65/10
Stay on PostgreSQL — no new infra, native SQL queries.

#3 — Chroma · Score: 8.55/10
Easiest local dev setup; best for prototyping before scaling.

MCP Option: qdrant-mcp-server — install as MCP tool for direct AI memory integration.

Next Steps:
1. docker run qdrant/qdrant and pip install qdrant-client to validate locally
2. Use the LangChain + Qdrant RAG template as a starting point
3. If staying Postgres-only, evaluate pgvector — saves an infra hop

That's 45 minutes of tab-hopping, compressed into a structured decision.

Install in 4 AI Systems

Claude Code:

mkdir -p /your-project/.claude/commands
cp .claude/commands/skillmama.md /your-project/.claude/commands/skillmama.md

Then type /skillmama in any Claude Code session.

Claude.ai:

Clone the repo
zip -r skillmama.zip skillmama/
Go to Customize → Skills → + and upload the zip
Type /skillmama in any conversation

OpenAI Codex:
Place codex/AGENTS.md in your repo root, then ask naturally:

codex "find me the best job queue for this project"

Antigravity:
Load antigravity/PROMPT.md as the system prompt, then ask naturally.

All four adapters run the same pipeline and produce the same output format.

What SKILLmama Is Not

Not an IDE. Not autocomplete. Not a chatbot.

It's a capability oracle — it tells you what to use and why, with evidence. You still write the code. SKILLmama just makes sure you're writing it with the right tool.

The Repo

github.com/Magithar/SKILLmama

Apache 2.0 licensed. Works with Claude Code, Claude.ai, OpenAI Codex, and Antigravity.

/skillmama find me a vector database for my FastAPI project
/skillmama what auth library should I use for my Next.js app?
/skillmama scan my project and tell me what's missing
/skillmama find a .dwg parser for Node.js

Try it on your next project: github.com/Magithar/SKILLmama. If you've ever spent an afternoon picking the wrong library, I'd love to hear what you wish you'd known sooner.

If SKILLmama saves you time, a ⭐ on the repo goes a long way — it helps other developers find it.

The Game Identity Registry Pattern — Bridging Mirror netId and Socket.IO playerId

Magithar Sridhar — Sun, 03 May 2026 00:05:04 +0000

When you run Mirror and Socket.IO in the same Unity project, you immediately hit a translation problem.

Mirror identifies players by netId — a uint assigned at spawn time by the Mirror host. Socket.IO identifies players by playerId — a string assigned by your Node.js backend when they connect.

These two IDs have nothing to do with each other. They're generated by different systems at different times. But when a score_update arrives from your Socket.IO backend with a playerId, you need to find the corresponding Mirror NetworkIdentity to apply the effect. And when a Mirror player spawns, you need to register which playerId they belong to so future backend events can reach them.

GameIdentityRegistry is the pattern that solves this.

The Pattern

A static lookup table. Two dictionaries. One clear API.

public static class GameIdentityRegistry
{
    private static readonly Dictionary<uint, string> _netIdToPlayerId = new();
    private static readonly Dictionary<string, uint> _playerIdToNetId = new();

    public static void Register(uint netId, string playerId)
    {
        _netIdToPlayerId[netId] = playerId;
        _playerIdToNetId[playerId] = netId;
    }

    public static NetworkIdentity GetNetworkObject(string playerId)
    {
        if (!_playerIdToNetId.TryGetValue(playerId, out uint netId))
            return null;

        // Check server first, then client
        if (NetworkServer.spawned.TryGetValue(netId, out var identity))
            return identity;
        if (NetworkClient.spawned.TryGetValue(netId, out identity))
            return identity;

        return null;
    }

    public static string GetPlayerId(uint netId)
    {
        return _netIdToPlayerId.TryGetValue(netId, out string playerId)
            ? playerId : null;
    }

    public static void Clear()
    {
        _netIdToPlayerId.Clear();
        _playerIdToNetId.Clear();
    }
}

GetNetworkObject checks NetworkServer.spawned before NetworkClient.spawned — this ensures it works correctly in all Mirror roles: dedicated server, host, and client.

Registration — When and Where

Registration happens in PlayerIdentityBridge, a NetworkBehaviour attached to the Mirror player prefab.

The registration must happen on all instances — server/host and all clients — because GetNetworkObject might be called on any of them when a backend event arrives.

public class PlayerIdentityBridge : NetworkBehaviour
{
    public override void OnStartLocalPlayer()
    {
        var store = FindObjectOfType<LobbyStateStore>();
        CmdRegisterIdentity(store.LocalPlayerId);
    }

    [Command]
    private void CmdRegisterIdentity(string playerId)
    {
        // Register on server/host
        GameIdentityRegistry.Register(netIdentity.netId, playerId);
        // Propagate to all clients
        RpcRegisterIdentity(netIdentity.netId, playerId);
    }

    [ClientRpc]
    private void RpcRegisterIdentity(uint netId, string playerId)
    {
        GameIdentityRegistry.Register(netId, playerId);
    }
}

The flow: local player spawns → OnStartLocalPlayer fires → CmdRegisterIdentity runs on the server → RpcRegisterIdentity propagates to all clients. Every instance now has the mapping.

Usage — Routing Backend Events

When a Socket.IO event arrives with a playerId, resolve it to a Mirror object and apply the effect:

// In GameEventBridge.Subscribe()
game.On("score_update", (string json) =>
{
    var obj = JObject.Parse(json);
    string playerId = obj["playerId"]?.ToString();
    int score = obj.Value<int>("score");

    var identity = GameIdentityRegistry.GetNetworkObject(playerId);
    if (identity == null) return; // player may have left

    identity.GetComponent<PlayerScore>()?.SetScore(score);
});

game.On("player_killed", (string json) =>
{
    var obj = JObject.Parse(json);
    string victimId = obj["victimId"]?.ToString();

    var identity = GameIdentityRegistry.GetNetworkObject(victimId);
    if (identity == null) return;

    identity.GetComponent<PlayerHealth>()?.Die();
});

The null check on GetNetworkObject is important — a player may have disconnected between when the server sent the event and when it arrived. Always guard.

Cleanup — When and Where

Clear the registry in exactly two places:

// 1. On ReturnToLobby — match ended normally
public void ReturnToLobby()
{
    // ... Mirror shutdown ...
    GameIdentityRegistry.Clear();
    // ... LeaveRoom ...
}

// 2. On Socket.IO disconnect — unexpected disconnection
store.OnDisconnected += () => GameIdentityRegistry.Clear();

Missing either case leaves stale mappings. The next match starts with entries from the previous one, GetNetworkObject returns wrong objects, and events apply to destroyed players. Subtle, intermittent, hard to reproduce.

Why Static?

A static class means no singleton MonoBehaviour, no inspector wiring, no FindObjectOfType. Any component anywhere — GameEventBridge, PlayerIdentityBridge, a HUD script — can call GameIdentityRegistry.Register() or GameIdentityRegistry.GetNetworkObject() without a reference.

This is safe because the registry's lifecycle is explicitly managed: Register() populates it, Clear() resets it. There's no implicit state — you always know exactly what's in it based on what's been registered since the last Clear().

The Broader Pattern

GameIdentityRegistry is a specific instance of a general pattern: an identity bridge between two systems that use incompatible ID schemes.

The same pattern applies anywhere two systems need to reference the same logical entity by different identifiers:

Mirror netId ↔ Steam CSteamID
Mirror netId ↔ Photon ActorNumber
Mirror netId ↔ any backend player ID

The implementation is always the same: two dictionaries, a Register() call on spawn, a lookup on event receipt, a Clear() on session end.

The Full Context

This pattern is part of the Mirror Integration sample in socketio-unity — an open-source Socket.IO v4 client for Unity with full WebGL support.

Install via Package Manager → Add package from git URL:

https://github.com/Magithar/socketio-unity.git?path=/package

Then import via Package Manager → Samples → "Mirror Integration" to see the full working implementation.

MIT licensed. Zero paid dependencies.

Have you needed to bridge IDs between two networking systems before? What was your approach?

10 Common Unity Rendering Issues (And How to Fix Them Like a Pro)

Magithar Sridhar — Fri, 24 Apr 2026 18:07:02 +0000

If you spend enough time building in Unity, you start to see the same visual bugs over and over again. Weird shadows, flickering textures, scenes that look washed out for no apparent reason — we've all been there.

When you're trying to ship a game, spending hours debugging a shadow artifact is the last thing you want to do.

Over time I've built up a mental cheat sheet for diagnosing these issues quickly. Here are the 10 most common ones, what causes them, and the fastest way to fix each.

1. Shadow Artifacts (Stripes or "Acne")

The cause: Shadow bias or precision issues. The object is casting a shadow on itself.

The fix: Increase the Shadow Bias and Normal Bias on your light source.

If you push the bias too high, the shadow will detach from the object (known as "Peter Panning"). Dial it back just enough until the acne disappears.

2. Jagged or Pixelated Shadows

The cause: Low shadow resolution.

The fix: Go to Quality Settings and increase Shadow Resolution. If you're using a Directional Light, tweaking Shadow Cascades can dramatically improve quality near the camera.

3. Light Bleeding Through Walls

The cause: Light leaking — usually caused by thin meshes or bias settings that are too high.

The fix: Check shadow bias and normal bias first. If those are fine, ensure your meshes have actual thickness. Single-sided planes are notorious for light leaks.

4. Objects Look Too Dark or Flat

The cause: Missing Global Illumination or an incomplete lighting setup.

The fix: Ensure you have ambient light or skybox lighting active. If you're using static geometry, baking your lighting usually solves this and adds much-needed depth.

5. Overbright or Washed Out Scene

The cause: Exposure or Post-Processing Tonemapping issues.

The fix: Check your Post-Processing Volume — specifically Auto Exposure and Color Grading/Tonemapping. Default auto-exposure can go wild in high-contrast scenes.

6. Flickering Textures (Z-Fighting)

The cause: Depth precision issues where two faces occupy the exact same space.

The fix: Make sure your meshes aren't perfectly overlapping. If they aren't, adjust the Near and Far Clip Planes on your Camera. Moving the Near Clip Plane further away increases depth precision.

7. Blurry Textures at an Angle

The cause: Texture import settings — specifically filtering.

The fix: Select the texture in your Project window and increase the Anisotropic Filtering level. This keeps textures sharp when viewed at oblique angles like roads or floors.

8. Sudden Performance Drops in Complex Scenes

The cause: High overdraw (drawing transparent pixels on top of each other) or too many objects pushing the GPU.

The fix: Implement LODs (Level of Detail), use GPU Instancing for repeated objects, and check your overdraw in the Scene window's draw mode selector.

9. Too Many Draw Calls (CPU Bottleneck)

The cause: Unbatched objects. The CPU is telling the GPU to draw too many individual things.

The fix: Enable Static Batching for non-moving objects. For dynamic objects sharing the same material, ensure GPU Instancing or Dynamic Batching is enabled.

10. Weird Lighting or Dark Patches on Meshes

The cause: Broken or inverted normals on the 3D model.

The fix: Select the model in your Project window, go to Import Settings, and set Normals to Calculate instead of Import. If that doesn't work, recalculate normals in Blender or Maya.

Quick Reference

Symptom	Cause	First thing to check
Shadow stripes / acne	Self-shadowing	Shadow Bias on light
Jagged shadows	Low resolution	Quality Settings → Shadow Resolution
Light through walls	Thin mesh / high bias	Mesh thickness + bias values
Flat / dark objects	Missing GI	Ambient light or baked lighting
Washed out scene	Post-processing	Auto Exposure / Tonemapping
Flickering textures	Z-fighting	Near/Far Clip Planes
Blurry angled textures	Filtering	Anisotropic Filtering level
Performance drops	Overdraw / GPU load	LOD + overdraw view
Too many draw calls	Unbatched objects	Static/Dynamic Batching
Dark patches on mesh	Bad normals	Import Settings → Normals: Calculate

I ran into almost all of these while building out my recent multiplayer projects. Once you learn to recognize the symptoms, fixing them becomes second nature.

What rendering issue trips you up most? Got a bug that's driving you crazy right now? Drop a screenshot in the comments and I'll do my best to help diagnose it.

Currently building a Unity WebGL multiplayer library in public — socketio-unity. Follow along to see more of the technical hurdles I run into.

DEV Community: Magithar Sridhar

I Built a Nutrition-Scoring Bot Inside Telegram, and Swiggy Just Approved It

The problem I kept having

Why Telegram, why solo

The part that wasn't obvious going in

What's next

A Reader Asked What My Security Check Actually Verifies. The Honest Answer Sent Me Back to the Code.

What Was Actually There

Building the Real CVE Check

Building the Publisher-Continuity Check, Badly, Three Times

Does the Recency Filter Still Catch event-stream?

What It Doesn't Catch

It Found One For Real

What Changed

I Asked the Same Question With and Without My Own Skill. The Version Without It Won on One Thing That Mattered.

The Setup

What Skill-Off Said

What Skill-On Said

The Uncomfortable Part

The Fix

Then the Same Prompt Found Something Worse

What Changed

I Watched a Talk Called "Don't Ship Skills Without Evals," Then Checked If Mine Had Any

What I Actually Built

Bug One: Silent Failure on the Wrong Directory

Bug Two: Confident Numbers That Weren't Verified

Bug Three Needed a Different Kind of Test

What Changed

The Bug Was in My Own Instructions, Not My Code

The Recording

The Wrong Guesses

The Real Answer Was in the Docs I Hadn't Read

Closing the Loop

Bonus: While I Was In There

What Changed

10 Common Unity Networking Issues (and How to Fix Them)

1. Reconnect wipes your room/namespace state

2. "get_gameObject can only be called from the main thread"

3. Connect() hangs with no timeout

4. WebGL builds behave nothing like the Editor

5. IL2CPP stripping deletes types that only exist at runtime

6. A malformed binary packet crashes the whole handler pipeline

7. "Heartbeat timeout" that isn't actually a network problem

8. Namespace/room auth fails silently

9. Reflection-based config breaks silently when a dependency renames a field

10. Two reconnect timers running at once

The common thread

A Reader Pointed Out My "Ask First" Principle Only Covered Half My Tool — So I Fixed It

The Hole

The Fix: Phase 1.5

The Three Rules That Keep It From Being Annoying

Why "One Informed Question" Beats "A Form"

What Changed

I Got Tired of Asking "What Am I Missing?" — So I Made My AI Ask First

The Old Flow vs. The New Flow

What the Scan Actually Does

Gap Analysis: Not Everything Missing Is a Problem

Why the Hard Stop Matters

After You Answer

What Changed in the Adapters

Install

The Repo

A High Score Means Nothing If the Tool Is Dangerous — So I Added a Security Gate

The Problem: Scoring Isn't Enough

What the Security Gate Actually Does

Phase 3.5 — Library Gate

Phase 3.7 — Skills Gate (Stricter)

A Concrete Example

Why the Output Doesn't Shout About It

Companion Skills: Why This Became Necessary

What This Looks Like in Practice

Install

The Repo

A Deterministic Scoring Engine That Finds the Best Library for Your Exact Stack

The Problem With How We Pick Libraries

The Scoring Formula

The 5-Tier Search Hierarchy

The Security Gate

How It Works

End-to-End Example

3. `Connect()` hangs with no timeout