craft-ailisted

# AI Craft This skill encodes one engineer's standard for shipping LLM-powered features safely, applied the same way across every repo. The **method and opinions** live here; the **project specifics** (which provider, which SDK, which framework) live in the target repo's code and config — always discover them, never assume or hardcode. ## Operating principle — discover before you build Different repos already have different pieces in place. Before changing anything, spend a few minutes mapping the current posture so you extend rather than conflict: - `package.json` / lockfile / requirements → which LLM SDK is present (OpenAI, Anthropic, Vercel AI SDK, LangChain, LlamaIndex)? Which is the default model tier? - `grep` for the API key — is it read through a validated server-side env schema, or does it leak into a `NEXT_PUBLIC_*` / client-bundled / mobile-app constant? - Find every call site that sends a prompt — what user-controlled or retrieved content reaches the system prompt or context window, and is there any structural separation between instructions and untrusted content? - Check whether the integration uses tool-use / function-calling — what can the model actually invoke, and is there a confirmation step before a consequential action fires? - Look for logging/observability around LLM calls — are raw prompts and completions logged, and where do those logs live? - Check for rate limits, `max_tokens` caps, and timeouts on LLM-calling routes; check for retry