5 Things To Steal From Everything Claude Code (ECC) — Transcript

Full transcript

1. 0:00Affaan Mustafa put his entire Claude Code setup on GitHub.
2. 0:03It now sits at two hundred and fifty thousand stars.
3. 0:06He won an anthropic hackathon last September,
4. 0:08and shipped a product built entirely with agents.
5. 0:11Then he published the setup he used.
6. 0:13The video that carried it to a wide audience published
7. 0:15four days ago says two hundred and fourteen thousand.
8. 0:18It counts 64 agents and two hundred and sixty-two skills.
9. 0:22The repo's own README today says 68 agents and two hundred and eighty-six skills.
10. 0:27Those aren't rival counts, they're older ones.
11. 0:30The repo moves faster than the videos made about it,
12. 0:32which tells you exactly what the numbers are worth,
13. 0:34so put them down and pick up the question underneath.
14. 0:37Somebody asked it on Reddit, in plain words, and nobody really answered.
15. 0:41Is everything Claude Code really that good?
16. 0:43Not, is it impressive?
17. 0:45Is it worth installing?
18. 0:46The repo calls itself the Agent Harness Performance Optimization System.
19. 0:50Skills, instincts, memory, security, and research-first development.
20. 0:54That's four promises in one line, and the parts behind them are real.
21. 0:58It's readme sums up the loop it installs in seven words.
22. 1:01Plan, test, implement, review, verify, remember, improve.
23. 1:06Install it once and that becomes how your agent works.
24. 1:09Here's what's actually in it, counted in a fresh clone this morning.
25. 1:1268 agents, Two hundred and eighty-six skills, 94 slash commands,
26. 1:16A hundred and twenty-two rule files, and 23 hooks, all living in one file.
27. 1:21The readme that describes all of it runs two thousand two hundred lines.
28. 1:24The documentation folder alone is 15 megabytes, translated into 22 languages.
29. 1:30Cloning the whole thing pulls down 88 megabytes.
30. 1:32And it isn't only for Claude Code.
31. 1:34The repo ships configuration for 19 different agents and editors.
32. 1:38From Codex and Cursor to Zed and Kimi.
33. 1:40you will use one of them.
34. 1:42So this is a real body of work, not a scam.
35. 1:44The licence is MIT, which means every piece of it is yours to copy.
36. 1:49The problem only starts when you install all of it.
37. 1:52And in this video, we're going over what the full install really costs,
38. 1:55the five pieces worth stealing, and what to leave in the repo.
39. 1:59Here's the part the tour videos skip,
40. 2:00a skills body only gets read when the skill fires.
41. 2:03But its name and its description sit in your
42. 2:05context from the first token of every session,
43. 2:07same for every subagent.
44. 2:09That metadata is the price of admission.
45. 2:11So I measured it.
46. 2:12The names and descriptions of those two hundred and
47. 2:14eighty-six skills come to eighty-five thousand characters.
48. 2:17That's roughly twenty-one thousand tokens,
49. 2:19standing in your context before you ask for anything.
50. 2:22The 68 subagent descriptions add another twenty thousand characters,
51. 2:26which is about five thousand tokens more.
52. 2:28The repo's own instruction file puts a thousand on top of that.
53. 2:31Put together,
54. 2:32a full install parks about twenty-seven thousand
55. 2:35tokens in your window before you type a word.
56. 2:37Against a two hundred thousand token context, that is 14% gone every session.
57. 2:4314% sounds survivable until you remember what shares that window.
58. 2:47Your files, your diffs, your tool results and the conversation itself.
59. 2:50Every skill you will never call is competing
60. 2:52with the code you are actually working on.
61. 2:54and the repo knows.
62. 2:55Its own readme carries the line.
63. 2:57Optimize the context window.
64. 2:59Persist everything else.
65. 3:00Then it ships two hundred and eighty-six skills.
66. 3:03The Reddit thread from a minute ago asked exactly this.
67. 3:06Doesn't it load too much?
68. 3:08The top reply says the token usage of the descriptions is minimal.
69. 3:11Twenty-one thousand tokens is not minimal.
70. 3:13Two honest caveats.
71. 3:15Tokens are estimated at four characters each,
72. 3:18so the real figure moves with the tokenizer,
73. 3:20and none of this says the skills are bad.
74. 3:22It says they are not free, and that most of them are not yours.
75. 3:25Now, if you're new here, welcome.
76. 3:27This is AI Dive,
77. 3:28where I break down the AI releases that matter
78. 3:30and the tools worth keeping in your stack.
79. 3:32Right now, 99% of the people watching this are not subscribed.
80. 3:37and subscribing matters more than it sounds.
81. 3:38It tells YouTube the video is worth your time, so the next one reaches more people.
82. 3:42So take one second and click subscribe.
83. 3:45then open the bell and pick all so YouTube tells you the day a new one is up.
84. 3:48And to everyone who just did, thank you.
85. 3:50You keep this channel going.
86. 3:52So the repo is worth raiding.
87. 3:54Here are the five pieces I would take, and the first two need no install at all.
88. 3:58The first is AgentShield.
89. 4:00It is a security auditor for agent configurations.
90. 4:02It lives on NPM as its own package and it took
91. 4:05five and a half thousand downloads last week.
92. 4:07One command points it at a directory.
93. 4:09It audits your agent files, your hooks,
94. 4:12your servers, your permissions, and your secrets.
95. 4:15And it takes flags for output format, severity floor, and safe automatic fixes.
96. 4:20It's readme explains why it exists, with numbers from January.
97. 4:2412% of one agent skill marketplace turned out to be malicious.
98. 4:28That is three hundred and forty-one skills out of two thousand eight hundred.
99. 4:32One breach compromised a million and a half API tokens.
100. 4:35Those are the package's claims, not our measurements.
101. 4:37and here is its limit.
102. 4:39It was last published in March, while the repo itself was updated yesterday.
103. 4:43Its own readme still describes the ecosystem at forty-two thousand stars,
104. 4:48against two hundred and fifty thousand today.
105. 4:50The scanner is six months behind the thing it ships with.
106. 4:53Keep number two costs nothing to try.
107. 4:55The readme publishes a settings block.
108. 4:58The model set to sonnet.
109. 4:59The thinking budget cut from thirty-two thousand down to 10.
110. 5:02Compaction moved from 95% to 50% and subagents pushed onto the cheapest model.
111. 5:08The README claims about 60% of the model cost and 70% of the hidden thinking cost.
112. 5:13Those are its figures, not ours.
113. 5:15And they are a trade.
114. 5:17A smaller default model and cheap sub-agents
115. 5:19will cost you on the hard reviews.
116. 5:21Keep number three is the one thing in this repo I have not seen anywhere else.
117. 5:25The repo calls them instincts.
118. 5:27An instinct is a small learned behaviour with a confidence score,
119. 5:31not a rule you wrote,
120. 5:32a pattern the system noticed you repeating and wrote down for you.
121. 5:36The first version only watched at the end of a session.
122. 5:38This one watches before and after every tool call,
123. 5:41which is why it actually catches anything.
124. 5:43Each instinct carries a weight between zero point three and zero point nine.
125. 5:47The analysis runs in a background agent on the cheap model,
126. 5:50so it is not eating your main context to do it.
127. 5:52Version two point one made them project scoped.
128. 5:55Your React patterns stay in the React project.
129. 5:57The repo's own word for what that fixed is contamination.
130. 6:00And when the same instinct shows up,
131. 6:02in two different projects, it gets promoted to global.
132. 6:05That is the part I like.
133. 6:06The system decides what is universal by watching, instead of asking you.
134. 6:10This is not a stub either.
135. 6:12The tool behind it runs two thousand two hundred lines, with six commands.
136. 6:16And the path it describes is instincts, then clusters, then a real skill.
137. 6:20and they are portable.
138. 6:22Export your Instinct library, hand it to someone on your team, and they import it,
139. 6:26which is the first sane answer I have seen to
140. 6:28onboarding a person onto your agent setup.
141. 6:30Now the string attached, all of it rides on the hook runtime,
142. 6:33which is the exact part of this repo you are made to opt into on purpose.
143. 6:37Refuse the hooks, and you do not get this,
144. 6:39and a confidence score is a heuristic, not a measurement.
145. 6:43Keep number 4 is three skills that account for context instead of spending it.
146. 6:47A context budget, a compaction adviser, and a token budget adviser.
147. 6:51The repo that costs you 14% also ships the tools to see it.
148. 6:55The compaction rule alone is worth taking,
149. 6:57compact after research and before you implement,
150. 7:00after a milestone, after debugging,
151. 7:02after an approach fails,
152. 7:04and never in the middle of an implementation where
153. 7:06you lose the file paths and the half-finished state.
154. 7:09That is four pieces,
155. 7:11and every one of them is buried in a repo that wants
156. 7:12to hand you two hundred and eighty-six skills.
157. 7:15which is keep number five.
158. 7:16The installer ships seven profiles and the smallest one says in
159. 7:19its own description that it leaves the hook runtime out entirely.
160. 7:23You can also skip profiles, and name the skills you want, one by one.
161. 7:27And there is an adviser that takes a plain sentence
162. 7:29about your work and returns the components that match,
163. 7:32with a preview before anything is written to disk.
164. 7:34And the installer refuses to guess about the hooks.
165. 7:37Any install that would put the hook runtime on your machine stops,
166. 7:40prints what those hooks can do, and waits for you to say yes or no.
167. 7:44Do it that way, and the bill from earlier stops being 14%,
168. 7:48and becomes a fraction of it.
169. 7:49I am not going to give you a figure for that,
170. 7:51because I did not measure every combination.
171. 7:53But the floor is honest,
172. 7:55even the smallest profile still carries the agents and the rules,
173. 7:58so naming the skills by hand is the only way to pay for exactly what you use.
174. 8:02Now the other column, four things, I would leave exactly where they are.
175. 8:05First, the 68 agents as a set.
176. 8:08They cost you about five thousand tokens of standing context,
177. 8:11and most of them are language reviewers and build fixers.
178. 8:13C++, plus plus.
179. 8:15C sharp.
180. 8:15Django, Kotlin.
181. 8:17For stacks you do not write in, take the two that match your work.
182. 8:21The set is not a package deal.
183. 8:22Second, the 94 slash commands.
184. 8:25The README already treats them as temporary,
185. 8:27calling them convenient entry points while the repo moves to a skills-first surface.
186. 8:32There is even a folder of retired ones.
187. 8:34And commands are the easiest thing in this whole ecosystem to write yourself.
188. 8:38Third, and this is the one.
189. 8:39Every hook in this setup lives in a single file.
190. 8:42Two hundred and ninety-one lines, 40 kilobytes, 23 hooks.
191. 8:46Eight of them run before every tool call.
192. 8:48Seven run every time the agent stops.
193. 8:51and the code is not in a script you can open.
194. 8:53Every hook is squeezed onto one line.
195. 8:55Thirty-three thousand characters of it and
196. 8:57the longest single line runs to two thousand.
197. 8:59Now be fair about it.
198. 9:01The descriptions beside them are readable, and some are good.
199. 9:04One blocks the agent from editing your linter config and says why.
200. 9:07It steers the agent to fix the code instead of weakening the rules.
201. 9:11That is a hook worth having.
202. 9:12So the problem is not the intent.
203. 9:14The code is public, and it is MIT.
204. 9:16The problem is that the intent is the only part you can read,
205. 9:19and the repo says it first.
206. 9:21Hooks run shell commands, and you should treat them as executable configuration.
207. 9:26and fourth the ballast.
208. 9:28Configuration for 19 harnesses and 15 megabytes of documentation
209. 9:31in 22 languages for a tool you run in one language in one place.
210. 9:36So, raid it, do not install it.
211. 9:38The scanner, the settings block, the instinct system,
212. 9:42the three skills that count your context,
213. 9:44and the installer that gets you the first four without the rest.
214. 9:47the number that decides it is twenty-seven thousand tokens of standing
215. 9:50context for a full install against a window of two hundred thousand.
216. 9:53And the licence makes the RAID legitimate.
217. 9:56It is MIT.
218. 9:57Copying five directories out of this repo is the intended use, not a workaround.
219. 10:01On Reddit, people keep asking whether to pick superpowers or this one.
220. 10:05They are not the same kind of thing.
221. 10:06One is a discipline for how the agent works, the other is a parts bin,
222. 10:10and the answer for a parts bin is to take parts.
223. 10:12Two limits on all of this.
224. 10:14Everything here was measured today on version two point two point one.
225. 10:18The repo was updated yesterday and it has a
226. 10:20hundred and ten open pull requests waiting.
227. 10:22It moves.
228. 10:23And none of this measures whether the skills make the answers better,
229. 10:26it measures what they cost you to have,
230. 10:28those are different questions and only one of them fits in a video.
231. 10:32That's the dive.
232. 10:33If this earned a minute of your day,
233. 10:34the Super Thanks button below keeps them coming.
234. 10:37Subscribe and hit the bell so the next one reaches you.
235. 10:40See you in the next one.