# Blog — Liran Tal

AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks.

Canonical: https://lirantal.com/blog

*   Sep 5, 2026 · 18 min read

    ## [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

    Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.

    *   [hermes](/tag/hermes)
    *   [matrix](/tag/matrix)
    *   [homelab](/tag/homelab)
    *   [tailscale](/tag/tailscale)
    *   [proxmox](/tag/proxmox)

     [![](/_astro/self-host-hermes-agent-matrix-e2ee-proxmox.D6XUPjt5_Ua06g.png)](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026 · 17 min read

    ## [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

    A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.

    *   [ai](/tag/ai)
    *   [ai agents](/tag/ai-agents)
    *   [llm](/tag/llm)
    *   [knowledge management](/tag/knowledge-management)

     [![](/_astro/practical-second-brain-llm-markdown-knowledge-graph.CEcxBkpJ_Z19xT21.png)](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026 · 16 min read

    ## [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)

    How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.

    *   [ai](/tag/ai)
    *   [ai agents](/tag/ai-agents)
    *   [llm](/tag/llm)
    *   [productivity](/tag/productivity)

     [![](/_astro/building-second-brain-llms-ai-agents.B3w2y6mA_2fR1l0.png)](/blog/building-second-brain-llms-ai-agents)

*   Jul 17, 2026 · 12 min read

    ## [Invisible Unicode Can Hijack Gemini CLI Agent Skills](/blog/gemini-cli-invisible-unicode-skill-injection)

    I disclosed a Gemini CLI prompt injection where invisible Unicode tag characters in SKILL.md caused the agent to run a hidden command. Google closed the report as out of scope because the workspace was trusted and YOLO mode was enabled.

    *   [security](/tag/security)
    *   [ai agents](/tag/ai-agents)
    *   [gemini cli](/tag/gemini-cli)
    *   [prompt injection](/tag/prompt-injection)
    *   [unicode](/tag/unicode)

     [![](/_astro/gemini-cli-invisible-unicode-skill-injection.AW0ivLkB_Z2nFK4g.png)](/blog/gemini-cli-invisible-unicode-skill-injection)

*   Jul 2, 2026 · 11 min read

    ## [Build Agent Workflows Around State Ownership, Not Timing](/blog/build-agent-workflows-around-state-ownership)

    A practical pattern for turning a fragile Codex state migration into a reusable skill with backups, process ownership, validation, and a terminal helper.

    *   [codex](/tag/codex)
    *   [agentic-development](/tag/agentic-development)
    *   [developer-tools](/tag/developer-tools)
    *   [automation](/tag/automation)

     [![](/_astro/build-agent-workflows-around-state-ownership.BjADEWUr_23EDIL.png)](/blog/build-agent-workflows-around-state-ownership)

*   Jun 30, 2026 · 12 min read

    ## [How to Turn a Custom Terminal Setup into Portable Dotfiles with chezmoi](/blog/portable-terminal-dotfiles-chezmoi)

    A practical guide to turning a custom macOS terminal setup into portable, reviewable dotfiles with chezmoi, Homebrew Bundle, zsh modules, Starship, and a public-safe repository workflow.

    *   [dotfiles](/tag/dotfiles)
    *   [terminal](/tag/terminal)
    *   [macos](/tag/macos)
    *   [chezmoi](/tag/chezmoi)
    *   [zsh](/tag/zsh)
    *   [starship](/tag/starship)
    *   [developer-tools](/tag/developer-tools)

     [![](/_astro/portable-terminal-dotfiles-chezmoi.CIGhyhT9_2erb6U.png)](/blog/portable-terminal-dotfiles-chezmoi)

*   Jun 18, 2026 · 18 min read

    ## [DevRel in 2026: Thematic Shifts, Product-centric Advocacy and the Rising Tide of Coding Agents](/blog/devrel-2026-thematic-shifts-product-centric-advocacy-coding-agents)

    Explore DevRel in 2026: how coding agents, AI builders, X-first communities, DevRel engineering, and product-centric advocacy are reshaping the field.

    *   [devrel](/tag/devrel)

     [![](/_astro/devrel-2026-thematic-shifts-product-centric-advocacy-coding-agents.DqDULCVh_11jcBs.jpg)](/blog/devrel-2026-thematic-shifts-product-centric-advocacy-coding-agents)

*   May 10, 2026 · 12 min read

    ## [Coding Agents Do Not Replace Technical Proficiency — They Demand More of It](/blog/coding-agents-do-not-replace-technical-proficiency)

    LLMs and coding agents amplify developer capability but they do not substitute for it. Engineering experience determines whether you steer these tools toward sound architecture or blindly accept generated output that drifts from your conventions.

    *   [ai](/tag/ai)
    *   [developer experience](/tag/developer-experience)
    *   [software engineering](/tag/software-engineering)
    *   [coding agents](/tag/coding-agents)

     [![](/_astro/coding-agents-do-not-replace-technical-proficiency.jTwhgEmj_XAayt.png)](/blog/coding-agents-do-not-replace-technical-proficiency)

*   May 9, 2026 · 16 min read

    ## [Is Prompt Injection an Unsolvable Problem in AI?](/blog/is-prompt-injection-unsolvable-problem-ai)

    Prompt injection is not a bug you patch but an architectural limit baked into how LLMs process language. This post traces the problem from Gödel and Hofstadter to modern jailbreaks, agent skill supply chains, and why defenders must shift from elimination to survivability.

    *   [security](/tag/security)
    *   [ai](/tag/ai)
    *   [prompt injection](/tag/prompt-injection)
    *   [llm](/tag/llm)
    *   [ai agents](/tag/ai-agents)

     [![](/_astro/is-prompt-injection-unsolvable-problem-ai.CNHPYK7E_1xccHK.png)](/blog/is-prompt-injection-unsolvable-problem-ai)

*   May 2, 2026 · 14 min read

    ## [Managing AI Agents and Skills with APM](/blog/managing-ai-agents-and-skills-with-apm)

    Microsoft's Agent Package Manager brings package.json-style manifests and lockfiles to Claude Skills, MCP servers, and other agent artifacts, with hands-on recipes and sharp edges we hit in practice (collections path, meta-packages, security).

    *   [ai agents](/tag/ai-agents)
    *   [skills](/tag/skills)
    *   [mcp](/tag/mcp)
    *   [supply chain](/tag/supply-chain)

     [![](/_astro/managing-ai-agents-and-skills-with-apm.Cv8OZfsE_27cY3B.png)](/blog/managing-ai-agents-and-skills-with-apm)

*   May 1, 2026 · 11 min read

    ## [Validated Fastify Configuration with dotenv, env-schema, and @fastify/env](/blog/fastify-dotenv-envschema-config)

    Hands-on walkthrough: wire Fastify to load .env files, validate environment variables with JSON Schema, and expose config on the server instance, using the dotenv-org/examples Fastify reference PR as the source of truth.

    *   [fastify](/tag/fastify)
    *   [node.js](/tag/node-js)
    *   [configuration](/tag/configuration)
    *   [dotenv](/tag/dotenv)

     [![](/_astro/fastify-dotenv-envschema-config.Cuj1cxfO_1F2Dy9.png)](/blog/fastify-dotenv-envschema-config)

*   Apr 22, 2026 · 15 min read

    ## [Cursor Agent Hooks: Lint and Build Checks After Each Turn](/blog/cursor-stop-hook-lint-build-verification)

    How to wire a Cursor stop hook that runs pnpm lint and pnpm build after every agent turn, returns followup\_message with captured output on failure, and avoids silent breakage from Cursor's bundled Node on PATH—plus loop limits, debug toggles, and when to choose postToolUse or sessionEnd instead.

    *   [cursor](/tag/cursor)
    *   [hooks](/tag/hooks)
    *   [developer experience](/tag/developer-experience)
    *   [nodejs](/tag/nodejs)
    *   [ci](/tag/ci)

     [![](/_astro/cursor-stop-hook-lint-build-verification.DNm2VBK0_1Mw8Sh.png)](/blog/cursor-stop-hook-lint-build-verification)

*   Apr 20, 2026 · 12 min read

    ## [LLM Security Automation Isn’t a Drop-In Scanner Yet](/blog/llm-security-automation-isnt-a-drop-in-scanner-yet)

    An LLM Security Scanning and Review is a strong assist but a weeak gate. Why a \`/security-review\` slash command or agent harness is not a drop-in replacement for deterministic scanners yet: nondeterminism, confabulation, latency, cost, exploitability of generated code, and findings variance—grounded in how agent loops work and what BaxBench measures.

    *   [security](/tag/security)
    *   [llm](/tag/llm)
    *   [code review](/tag/code-review)
    *   [sast](/tag/sast)
    *   [machine learning](/tag/machine-learning)

     [![](/_astro/llm-secure-code-review-not-solved.GrIIxSzP_1sXo2o.png)](/blog/llm-security-automation-isnt-a-drop-in-scanner-yet)

*   Mar 30, 2026 · 8 min read

    ## [All About Jest, Timers, and Mocks](/blog/jest-timers-and-mocks)

    How to use Jest fake timers, advance time safely in tests, and pair timer control with mocks and spies without flaky or misleading assertions.

    *   [jest](/tag/jest)
    *   [testing](/tag/testing)
    *   [javascript](/tag/javascript)

     [![](/_astro/jest-timers-and-mocks.D3IestBi_95dmV.png)](/blog/jest-timers-and-mocks)

*   Mar 29, 2026 · 19 min read

    ## [How to Build a Coding Agent Benchmark with Claude's Agent SDK](/blog/how-to-build-a-coding-agent-benchmark-with-claudes-agent-sdk)

    A step-by-step walkthrough of building a benchmarking framework for AI coding agents using the Claude Agent SDK, including architecture decisions, scoring strategies, and code examples.

    *   [agent-sdk](/tag/agent-sdk)
    *   [benchmarking](/tag/benchmarking)
    *   [claude code](/tag/claude-code)

     [![](/_astro/how-to-build-a-coding-agent-benchmark-with-claudes-agent-sdk.y5AuuToC_1jc5lX.jpg)](/blog/how-to-build-a-coding-agent-benchmark-with-claudes-agent-sdk)

*   Mar 28, 2026 · 1 min read

    ## [Agentic Growthhacking Tactics with Bots and AI](/blog/agentic-growthhacking-tactics-with-bots-and-ai)

    Examples of agentic growthhacking tactics using bots and AI, as well as strategies for sourcing user pain points on social media platforms.

    *   [marketing](/tag/marketing)
    *   [devrel](/tag/devrel)
    *   [gtm](/tag/gtm)

     [![](/_astro/agentic-growthhacking-tactics-with-bots-and-ai.C4hHhm2I_qE15G.jpg)](/blog/agentic-growthhacking-tactics-with-bots-and-ai)

*   Nov 22, 2025 · 3 min read

    ## [Tools for Self-Published Authors](/blog/tools-for-self-published-authors)

    If you're starting out as a new author, you're going to need all the help you can get. I curated a list of tools that can help you get started with publishing content and books.

    *   [author](/tag/author)
    *   [self-published](/tag/self-published)
    *   [writing](/tag/writing)

     [![](/_astro/tools-for-self-published-authors.BphsrNK-_1S2rP6.jpg)](/blog/tools-for-self-published-authors)

*   Oct 15, 2025 · 4 min read

    ## [Pre‑Signed URL Upload Architecture (Cloudflare R2 + Hono Workers)](/blog/pre-signed-url-upload-architecture-cloudflare-r2-hono-workers)

    The following is a reference implementation and architecture for secure direct browser uploads to Cloudflare R2 using pre-signed URLs generated by a Hono application on Cloudflare Workers.

    *   [architecture](/tag/architecture)
    *   [upload](/tag/upload)
    *   [cloudflare](/tag/cloudflare)

     [![](/_astro/pre-signed-url-upload-architecture-cloudflare-r2-hono-workers.bY9sxeEd_Z38Ok8.jpg)](/blog/pre-signed-url-upload-architecture-cloudflare-r2-hono-workers)

*   Oct 14, 2025 · 9 min read

    ## [Building Cloudflare R2 Pre-signed URL Uploads with Hono: A Complete Implementation Guide](/blog/cloudflare-r2-presigned-url-uploads-hono)

    A comprehensive guide to implementing secure file uploads using Cloudflare R2 and Hono, including common pitfalls and best practices

    *   [hono](/tag/hono)
    *   [cloudflare](/tag/cloudflare)
    *   [storage](/tag/storage)

     [![](/_astro/cloudflare-r2-presigned-url-uploads-hono.WJMm10ah_ZAY1nH.jpg)](/blog/cloudflare-r2-presigned-url-uploads-hono)

*   Oct 12, 2025 · 4 min read

    ## [A RESTful HTTP Mental Model to Understand MCP](/blog/a-restful-http-mental-model-to-understand-mcp)

    For those familiar with RESTful HTTP architecture, would it make sense to describe the Model Context Protocol (MCP) in a similar way?

    *   [ai](/tag/ai)
    *   [mcp](/tag/mcp)
    *   [software architecture](/tag/software-architecture)

     [![](/_astro/restful-http-mental-model-to-understand-mcp.BJyOYSSi_Z14mXpN.jpg)](/blog/a-restful-http-mental-model-to-understand-mcp)

*   Oct 7, 2025 · 4 min read

    ## [A Proposed Evaluation Framework for MCP Server Security](/blog/mcp-server-security-evaluation-framework)

    How do you securely integrate a new MCP Server into Cursor or other agentic workflows? what security practices do you consider to evaluate the risks?

    *   [ai](/tag/ai)
    *   [mcp](/tag/mcp)
    *   [security](/tag/security)

     [![](/_astro/mcp-server-security-evaluation-framework-logo.CZi2e61B_FchLG.png)](/blog/mcp-server-security-evaluation-framework)

*   Oct 5, 2025 · 6 min read

    ## [Evaluation Framework for MCP Security Threats and Risks](/blog/evaluation-framework-for-mcp-security-threats-and-risks)

    How to evaluate and categorize security threats and risks associated with Model Code Protocol (MCP) in light of recent security incidents.

    *   [ai](/tag/ai)
    *   [MCP](/tag/mcp)
    *   [security](/tag/security)

     [![](/_astro/mcp-security-threats-and-risks.akMmTKlb_24MVFf.png)](/blog/evaluation-framework-for-mcp-security-threats-and-risks)

*   Oct 3, 2025 · 4 min read

    ## [The Cursor Agentic Jira MCP Attack Explained with Toxic Flow Analysis](/blog/the-cursor-jira-mcp-attack-explained-with-toxic-flow-analysis)

    A breakdown of the Cursor + Jira MCP 0-Click attack, how it was exploited, and why developers are at the center of it all. Understanding MCPs, Toxic Flows, and the implications for AI-assisted coding environments.

    *   [ai](/tag/ai)
    *   [MCP](/tag/mcp)
    *   [security](/tag/security)

     [![](/_astro/the-cursor-jira-mcp-attack-explained-with-toxic-flow-analysis.DDqXsmRM_Z1BA0KJ.jpg)](/blog/the-cursor-jira-mcp-attack-explained-with-toxic-flow-analysis)

*   Sep 24, 2025 · 3 min read

    ## [The Uprising of Model Context Protocol (MCP) Security Research](/blog/the-uprising-of-model-context-protocol-mcp-security-research)

    The Model Context Protocol (MCP) is gaining traction in the AI community, and with its rise comes a wave of security research. This article explores the emerging security landscape surrounding MCP, highlighting key vulnerabilities and the importance of robust security measures in this evolving protocol.

    *   [ai](/tag/ai)
    *   [mcp](/tag/mcp)
    *   [security research](/tag/security-research)

     [![](/_astro/MCP_logo_bleeding_colored_red.KTYPhij6_ZFXwLm.png)](/blog/the-uprising-of-model-context-protocol-mcp-security-research)

*   Sep 21, 2025 · 4 min read

    ## [Agent Rules is the Missing Link in AI-Powered Development](/blog/agent-rules-missing-link-ai-powered-development)

    How agent-rules open source project is helping create consistent and deterministic security in AI coding assistants.

    *   [ai](/tag/ai)
    *   [agent-rules](/tag/agent-rules)
    *   [opensource](/tag/opensource)

     [![](/_astro/agent-rules-for-ai-coding-agents.BzPsNPe8_Z2wwBBm.png)](/blog/agent-rules-missing-link-ai-powered-development)


Newer posts

[

Older posts

](/blog/2)