A Simple and Universal Product Rehearsal Engine, Speccing Anything. 简洁通用的产品推演引擎,推演万物。
# Add to your Claude Code skills
git clone https://github.com/xiaojilele-glitch/WhyBuddyLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@chevrotain/cst-dts-gen: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@chevrotain/gast: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@mermaid-js/parser: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "body-parser: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "chevrotain: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "dockerode: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "engine.io: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "engine.io-client: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "langium: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash-es: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"severity": "high"
},
{
"type": "npm-audit",
"message": "mermaid: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "socket.io-adapter: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "xlsx: Prototype Pollution in sheetJS",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T15:15:18.985Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how WhyBuddy compares with popular alternatives.
WhyBuddy is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by xiaojilele-glitch. A Simple and Universal Product Rehearsal Engine, Speccing Anything. 简洁通用的产品推演引擎,推演万物。. It has 371 GitHub stars.
WhyBuddy failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/xiaojilele-glitch/WhyBuddy" and add it to your Claude Code skills directory (see the Installation section above).
WhyBuddy is primarily written in TypeScript. It is open-source under xiaojilele-glitch on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh WhyBuddy against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
SlideRule · product rehearsal engine
Clarify ideas, ship a runnable product.
把想法问清楚,把产品跑起来
Live demo · sliderule.ai · Repo
[!IMPORTANT] North Star: An AI claiming something is done does not count. Only artifacts that pass deterministic gates count.
The only product main line is SlideRule at
/agent-loop/sliderule./autopilotis the archived v4 demo. See NORTH_STAR.md.
SlideRule (Chinese product name 面团 AI) is a product rehearsal engine. You type one sentence. It rehearses a gated product plan — then lets you run it.
A slide rule is an engineer’s analog calculator: scales, a cursor, and alignment before you trust a number. SlideRule is the same idea for product decisions — not a magic one-click app factory, but a rehearsal instrument. Every step is visible. Every artifact must pass a deterministic gate. Only then does a runnable application appear.
Compared with “an LLM with a long prompt”, six things actually run:
spec → pages → structure → bind → closure. A hop that did not change a deliverable must not report ok.pages must not hijack rehearse / refine.slide-rule-python (FastAPI :9700) is the live engine. Node thin-proxies /api/sliderule and /api/agent-loop.arch_graph.py and arch-graph-ts.mjs fail undeclared edges, new cycles, and a growing function-body import ratchet.Write a PRD for days, align for weeks, wait months to learn the direction was wrong — or spend one coffee on a visible rehearsal and decide.
🏆 TRAE「一切皆可 Skill · SOLO」Pioneer Skill Award. Entry · Announcement
The static demo runs in the browser — no backend, no key:
Watch a captured end-to-end rehearsal, open finished examples and run the generated app, or BYOK (OpenAI-compatible key stays in the browser) for a live topic.
flowchart LR
U["One-sentence intent"] --> CTRL["Control plane<br/>scope · assumptions"]
CTRL -->|rehearse| SPEC["spec"]
SPEC --> PAGES["pages"]
PAGES --> STRUCT["structure"]
STRUCT --> BIND["bind"]
BIND --> CLOSE{"Publish closure<br/>fail-closed"}
CLOSE -->|closed| APP["Browser live runtime"]
CLOSE -->|blocked| AWAIT["park · refine · repair"]
AWAIT --> CTRL
| Step | Stage | What happens | Who |
|---|---|---|---|
| 1 | Intent | One sentence in the composer | Client |
| 2 | Park | Control plane parks a scope card | rehearsal_control |
| 3 | Confirm | “Start rehearsal” is forcedTool=rehearse |
Control plane |
| 4 | First pass | spec → pages → structure → bind in one go |
spec-first pipeline |
| 5 | Assumptions | Model’s silent forks become a card; confirm to continue | spec.assumptions |
| 6 | Closure | Evidence for the six skills, or park | publish closure |
| 7 | Run / refine | Browser runtime, or refine / repair / next hop |
Live runtime + control plane |
WhyBuddy/
├── client/ # Vite + React rehearsal UI
├── server/ # Express thin proxy
├── slide-rule-python/ # FastAPI authority engine
│ ├── services/ # util / core / flow
│ ├── architecture.toml # architecture gate
│ └── arch_graph.py
├── shared/ # cross-language contracts
├── skills/sliderule/ # TRAE Skill package
├── scripts/ # dev:all · TS architecture compiler
└── docs/ # generated architecture graphs
Authoritative graphs are generated from code (do not hand-edit):
util 125 · core 59 · flow 30docs/SlideRule V5.2–V6.0 are historical lab notes, not the live map.
The rehearsed model is not diagrams — the browser renders an operable system. Preview runtime: zero backend, zero database.
Run the app (desktop / tablet / phone), switch roles, drive approvals, edit data in place, try declared AIGC, export with evidence.
git clone https://github.com/2686521696/WhyBuddy.git && cd WhyBuddy
cp .env.example .env
Fill at least LLM_API_KEY (any OpenAI-compatible provider) and SESSION_SECRET. Without an LLM key the stack still boots; rehearsals fall back to deterministic templates.
docker compose up -d --build
Open http://localhost:3000/agent-loop/sliderule
| Service | Port | Role |
|---|---|---|
app |
3000 (host) → 3001 |
Node + bundled frontend; SlideRule API thin-proxies to Python |
python |
9700 (network-internal) |
Rehearsal engine: spec-first hops, control plane, evidence gates, publish closure |
Main line needs no database (JSON file store). mysql is an optional profile for legacy accounts: docker compose --profile accounts up -d.
docker compose logs -f app python
docker compose down # keep data volumes
docker compose down -v # wipe data
Required: LLM_API_KEY / LLM_BASE_URL / LLM_MODEL / SESSION_SECRET (64-char random hex in production).
Optional, fail-closed: WEB_SEARCH_API_KEY, E2B_API_KEY.
Production — pull, don’t build (.github/workflows/deploy-images.yml):
docker compose -f docker-compose.prod.yml pull && docker compose -f docker-compose.prod.yml up -d
# SLIDERULE_REGISTRY=ghcr.io SLIDERULE_IMAGE_OWNER=2686521696 SLIDERULE_IMAGE_TAG=latest
TLS-intercepting proxies: drop a PEM .crt into docker/certs/ before building.
Not in compose: Lobster Executor (DinD, opt-in), Redis (off), Feishu (mock).
.env is never baked into images.
Node.js 22+ · pnpm · Python 3.11+ with slide-rule-python/.venv · Docker optional (executor isolation)
git clone https://github.com/2686521696/WhyBuddy.git && cd WhyBuddy
pnpm install
pnpm run dev:all # Vite :3000 + Node :3001 + Lobster :3031 + Python :9700
# pnpm run dev:sliderule # lean: Vite :3000 + Python :9700
# pnpm run dev:frontend # UI on