Ideas Lab

Real problems people complain about online, pulled every morning and scored out of 100. Build, validate, or skip. How scoring works

Ideas
4,163
BUILD
689
Sources
8
Last sync
3h ago
4,163 ideas

AI Subroutines – Run automation scripts inside your browser tab

We built AI Subroutines in rtrvr.ai. Record a browser task once, save it as a callable tool, replay it at: zero token cost, zero LLM inference delay, and zero mistakes.The subroutine itself is a deterministic script composed of discovered network calls hitting the site's backend as well as page interactions like click/type/find.The key architectural decision: the script executes inside the webpage itself, not through a proxy, not in a headless worker, not out of process. The script dispatches requests from the tab's execution context, so auth, CSRF, TLS session, and signed headers get added to all requests and propagate for free. No certificate installation, no TLS fingerprint modification, no separate auth stack to maintain.During recording, the extension intercepts network requests (MAIN-world fetch/XHR patch + webRequest fallback). We score and trim ~300 requests down to ~5 based on method, timing relative to DOM events, and origin. Volatile GraphQL operation IDs are detected and force a DOM-only fallback before they break silently on the next run.The generated code combines network calls with DOM actions (click, type, find) in the same function via an rtrvr.* helper namespace. Point the agent at a spreadsheet of 500 rows and with just one LLM call parameters are assigned and 500 Subroutines kicked off.Key use cases:- record sending IG DM, then have reusable and callable routine to send DMs at zero token cost- create routine getting latest products in site catalog, call it to get thousands of products via direct graphql queries- setup routine to file EHR form based on parameters to the tool, AI infers parameters from current page context and calls tool- reuse routine daily to sync outbound messages on LinkedIn/Slack/Gmail to a CRM using a MCP serverWe see the fundamental reason that browser agents haven't taken off is that for repetitive tasks going through the inference loop is unnecessary. Better to just record once, and

Hacker News5mo agoToolAI

72FL score
0Sign in to vote

New audit: unpinned-tools

I've been thinking about this one recently in the context of trivy's [ongoing issues](https://github.com/aquasecurity/trivy/discussions/10425): it's good to hash-pin actions, but a lot of actions internally just fetch whatever "latest" version of a binary is available as a GitHub release. Consequently, even hash-pinned actions can be a vector for distributing malicious builds, since "latest" is always a mutable concept (and without immutable releases, previous tags may also be mutable). So, we should have an audit for this. Like with `cache-poisoning`, we'll probably want to use the coordinate API and start with a fixed set of well-known actions that are known to install binaries. Some good initial candidates: - `aquasecurity/trivy-action` - `taiki-e/install-action` Each of these will require slightly different coordinates/nuances. For example `trivy-action` has the `version:` input, but `version: latest` should still be flagged. In contrast `install-action` has no `version:` input, but the `tool:` input should have a `@version` suffix. Those are the relatively easy cases; it might also be nice to be able to flag actions like `astral-sh/setup-uv`, but the wrinkle with those is that they also support a `version-file` input and by policy zizmor doesn't attempt to parse files outside of workflows/actions/etc. for supporting information. So `setup-uv` and similar would be subject to higher false positive rates. There are also actions that never make sense to flag, like our own `zizmor-action`: `zizmor-action` has a `version:` input that defaults to `latest`, but under the hood `latest` is actually hash-pinned within the repo itself and is therefore immutable and changes only when the action itself changes. By way of example, here would be some steps that an audit here should flag: ```yaml - uses: aquasecurity/trivy-action@whatever # FLAG: no `version:` input - uses: taiki-e/install-action@whatever with: tool: cargo-hack # FLAG: no `@version` prefix - uses

GitHub6mo agoToolAI

62FL score
0Sign in to vote