35,684 results · Most relevant
The second takeaway is to diversify your business. Jake believes you have to be more than just content: by expanding into e-commerce and pop-up shops he expanded revenue streams and built traffic sources beyond Google.
Edu's recommendation to teams: start with the skill. Skills are cheap to write, easy to iterate on, and useful from day one. Once a team is sure a task is worth automating, move it into Orbit and turn it into a workflow: the predictable parts become deterministic code, the model is called only where it adds value, and each run becomes more reliable and less expensive than an open-ended session. Workflows run in the background, so engineers do not have to sit with an open session and guide step-by-step — meaning less context switching and more time for the work that needs them.
When a user messages a shared agent session, inject the message as a user.message that identifies the sender by name (e.g., 'this is coming from Gabe').
Give the agent a reply tool (e.g., the Slack post tool) so the agent decides when it wants to reply or post; don't mirror whatever the agent responds directly into the chat channel — make replies explicit via a tool.
Kevin's team stored agent test findings in a SQLite database instead of markdown files because markdown doesn't scale to 1,000 tests. This also enabled concurrency with multiple sub-agents running locally, each executing tests and storing results.
An ordered rule-authoring sequence in the Qodo portal: (1) Qodo will not automatically create a rule from codebase analysis — it comes up as a suggestion for you to review; (2) edit the generated rule details, which include examples of good code and bad code to make it very clear to AI agents what good and bad is; (3) define the category and warning levels before accepting it; (4) once happy, accept and activate the rule. Rules can be scoped to specific repositories for granularity, either designed yourself or inferred by the tool.
Nnenna Ndukwe advises pulling down rules from your context management layer and determining which rules are relevant for the task at hand.
After Qodo's review surfaces issues, Nnenna Ndukwe runs an agent skill to automatically resolve them — copy and paste the agent prompt meant to fix the suggestions that pop up, or run the Qodo PR resolver to automatically resolve identified issues instead of fixing each manually. When the resolver runs, it pulls down all issues Qodo has already identified, from critical to high severity. After the auto-fix run, the agent runs verification code, makes commits, and commits are blocked if not structured correctly. All issues in the demonstration PR were resolved after the auto-fix run. Fixes and deferrals are documented when inspecting Qodo's PR findings.
The 'all issues resolved' outcome is a single demonstration data point.
Nnenna Ndukwe recommends operationalizing your context by maintaining a repo with rules, skills, and related artifacts to leverage for planning, code generation, and code review. For teams, she suggests storing team skills and rules outside your local repo (e.g., in a context management layer like Unblocked) unless you have a good use case for keeping them in-repo, so context can be pulled down wherever you are.
After making a code change and doing a local review, run a verification prompt to ensure that everything passes. In her demo, Codex ran the verification automatically on its own because of the way the repo was set up, but this would be a best practice for walking through that process.
Nnenna Ndukwe recommends reading the repo rules before implementing a coding change to determine which rules are relevant for that particular change, and using TDD and BDD skills to ensure proper tests are written before implementing the code change. It is the agent's job to determine which repo rules are relevant for a requested coding change so it can adhere to them, and to read the rules and use any relevant skills to determine the constraints during planning. She also suggests asking the agent to explain why each selected repo rule will be relevant for the upcoming task.
Nnenna Ndukwe recommends always running a local code review, no matter which tool you use (Codex, Claude Code built-in review, Qodo, or anything else), because there are always small changes you could make earlier before another developer has to see your code.
Nnenna Ndukwe demonstrates getting skills and rules into the agent: copy-paste the agent prompts from the workshop README to get started; prompt your agent to install or verify Qodo skills, read agents.md and rules, and select relevant repo-local rule IDs for the task; run the repo's installer to copy committed local skill folders into the agent skills directory. If you don't want to install skills externally, use the repo's local skills. If your coding rules are literally in a rules directory, Qodo can easily ingest them — it will copy and paste most of the rule contents into the portal. Qodo will not automatically create a rule from a codebase convention — it comes up as a suggestion for you to review first. When reviewing a suggested rule, edit it and include examples of good code and
Endorsed; no stated uncertainty.
Javier Garza describes the traditional threat modeling process: the first step is to scope the system — identify architecture, assets, data flow, and trust boundaries; after scoping, identify threats and determine mitigations, then validate and iterate. He also stresses reviewing threat models continuously as the architecture evolves, not just once at creation.
Javier Garza recommends that when you want real-time information from an agentic tool, you use the MCP protocol with a tool that gives you the functionality you need, because LLMs alone are like a static database; and that when your AI tool lacks a capability, you can go to Claude Code or Copilot and create an MCP server for it. He also notes you can publish an MCP server to GitHub so people can download and install it easily, and that a prompt like 'Create an MCP server that does this and that' works.
Javier Garza recommends defining trust boundaries in AI systems at points like data injection and content construction, where external input enters the system.
Javier Garza recommends sanitizing outputs from AI systems and ensuring that people cannot get information out of the system prompt to defend against system prompt leakage. He also recommends treating prompts and extracted outputs as non-executable input, not as trusted executable content.
Javier Garza recommends defending against vector and embedding weaknesses by using monitoring and logging, permission and access controls, data validation, and reviewing and removing malicious or misleading data from embedding stores.
Javier Garza recommends that when having an AI tool create an app, you also tell it to design a testing process and a security review, not just the app, and that you can tell the AI agent to simulate an attack (e.g., prompt injections) so you can address the weaknesses it finds. He also mentions automatic threat enumeration from a data flow diagram when threat modeling AI systems.
Javier Garza recommends designing APIs and user interfaces that encourage responsible use of LLMs, putting automatic validation of LLM outputs, putting a good system prompt, and fine-tuning the model to ensure output quality, to defend against over-reliance and misinformation.
Choose sources → to get a library of your own and a daily brief.