GitLab

Headlines · 4

1. 2d
   AI squeezes the middle: how firms are rebuilding the chain of command

   TMTPost published a commentary by consultant Mu Sheng arguing that AI has changed the basic conditions of organizational design: real-time data and AI analysis let executives manage a wider, deeper span of control, while AI underpins much of front-line analytical output, squeezing out middle managers whose main job was relaying information. The piece cites Amazon's plan to cut roughly 30,000 corporate roles (about 14,000 in a first round), with more than 78% of disclosed cuts concentrated at L5–L7, and notes that Microsoft and others deny reducing managers by widening spans of control; in China, JD.com Retail stripped managerial status from its C4 and C5 ranks and Tencent piloted a "project owner" system in some business lines. The author argues middle management will be compressed rather than eliminated, leaving people who can design systems or deliver offline value, and that organizational model — not technology — is the real moat.

   钛媒体 · 🔥 3
2. 3d
   Vercel Labs open-sources agent skills CLI

   Vercel Labs has published an open-source command-line tool, skills, for managing the "agent skills" ecosystem, which it says supports OpenCode, Claude Code, Codex, Cursor and 75-plus other coding agents. Users can install SKILL.md skill packages with npx skills add from GitHub shorthand, full GitHub, GitLab or Azure Repos URLs, any git URL, direct download links or local paths, and can use npx skills use to generate a prompt for a single skill without installing it or to launch a supported agent with that prompt. The CLI also offers list, find, update, remove and init subcommands, project-level or global installation, symlink or copy methods, and reuses existing Git, GitHub CLI or SSH authentication for private repositories.

   GitHub Trending（每日） · 🔥 0
3. 4d
   SlugFest: npm Trusted Publishing flaw hit 1,500+ packages as AI agents raise risk

   Security firm Bloom Security disclosed a vulnerability dubbed SlugFest in npm Trusted Publishing: npm originally bound trust to a GitHub repository's human-readable slug rather than recording its permanent repository identifier, so once a repo is renamed, transferred or deleted, the old address can be claimed by someone else and satisfy the original trust configuration — granting publishing access without stealing the maintainer's credentials. A registry-wide scan found more than 1,500 vulnerable packages with over 10 million combined downloads and more than one million downloads per month, though Bloom notes these are only packages configured for Trusted Publishing. Bloom also measured AI-driven installs inside large enterprises, finding a typical endpoint receives roughly 70 agent-installed packages a month versus close to 350 on developer machines, and said it blocked one customer's AI agent from installing an affected package. npm implemented a fix before publication and confirmed the remediation; Bloom recommends storing immutable repository and owner identifiers and checking trust bindings after renames or transfers.

   The Next Web · 🔥 0
4. 4d
   Ex-SenseTime VP's startup Firmior AI raises over $10M for private enterprise agents

   Firmior AI, a Chinese enterprise-agent platform company founded only three months ago, said it has closed seed and angel rounds totaling more than $10 million, with the angel round co-led by Jinqiu Fund and the Hong Kong High-Talent Startup Investment Fund, while seed investors joined as individuals from several industries and serve as strategic advisors. Based in Shenzhen's Qianhai and Hong Kong, it was founded and is led by CEO Leo Liu, a former first vice president and commercialization head at SenseTime who also held roles at SAP, Oracle and Microsoft and served as CEO of GitLab's China joint venture. The company is building a full-stack, private-deployment enterprise agent platform spanning an inference server layer (FEAS), a middle layer called Firmior OS for enterprise memory, knowledge, workflows and governance, and three applications: Firmior Code, Firmior Work and Firmior Expert. Firmior AI says its first enterprise customer bought the full platform in its first quarter and expanded the purchase after one month of use, with daily agent token calls up fivefold within two months and a 92.5% 30-day active rate — figures the company attributes to that single customer.

   钛媒体 · 🔥 0

Experience and discussion from the community

Share my GitLab experienceAsk about GitLab