GitHub listed fourteen projects this Tuesday morning. Eight had been featured before, seven of them within the past week, and none showed a change big enough to bring it back, so today's edition has five first-time picks. NVIDIA's SkillSpector leads because it answers a timely question: is this agent skill safe to install? Postiz is a self-hostable social media scheduler that has just shipped urgent security fixes, OpenBot is a desktop workspace for several AI agents at once, Agent Reach lets an agent read platforms that ordinary web search misses, and Huashu Design turns a one-line request into a prototype, deck or animation. Curation order reflects practical interest, not GitHub rank. Trending is not a release date or an endorsement.
Picks are listed in curation order, not GitHub’s rank; each card shows the rank GitHub displayed when the page was checked. Stars measure attention, not security, quality or fitness for use, and no project here was installed or run. “Stars today” is GitHub’s own displayed figure for its daily window, not an audited rolling 24-hour count.
What it does. A security scanner for AI agent skills (Claude Code, Codex, MCP and similar). It scans a folder, single SKILL.md, Git repository, URL or zip file against 71 patterns in 17 categories, including prompt injection, data exfiltration, privilege escalation, supply-chain and memory-poisoning risks, with an optional LLM second pass, and reports a 0-100 risk score as terminal, JSON, Markdown or SARIF output.
Caveat. A scanner lowers risk but cannot prove a skill is safe: static patterns miss novel tricks and flag harmless text, and the README's figure that 26.1% of 31,132 analysed skills had vulnerabilities is the project's own research. The optional LLM pass sends skill content to the provider you configure and uses your API credits. Requires Python 3.12+ or Docker, and installs further third-party packages. We did not install or test it.
Attention, not endorsement
GitHub showed
“214 stars today” as displayed for GitHub’s daily window; not an audited rolling 24-hour count
What it does. An open-source social media scheduler with a calendar, cross-posting, team collaboration, analytics, RSS auto-posting, AI writing and image tools, a public API and webhooks, plus MCP and CLI access so AI agents can draft and schedule posts. It runs as Postiz Cloud or self-hosted with Docker on your own Postgres and Redis.
Caveat. Both releases flag security advisories and ask all users to upgrade immediately; the commits name a JWT bypass and local-file access fix, so self-hosters must keep up with patches. Self-hosting also means creating your own developer apps on each social network, and Meta, YouTube or TikTok approval can take weeks. AI features need your own provider keys. AGPL-3.0 applies if you modify and serve it. We did not install or test it.
Attention, not endorsement
GitHub showed
“188 stars today” as displayed for GitHub’s daily window; not an audited rolling 24-hour count
What it does. A desktop workspace for persistent AI teammates: each agent, backed by Codex, Claude Code, Grok, OpenCode, Gemini, Cursor or Cline, gets its own workspace and conversation, with message queues, file transfers, agent-to-agent messaging, shared channel chats, an embedded browser agents can control, and optional computer use. Builds exist for macOS, Windows and Linux.
Caveat. A development preview: agents run with full access and no per-action approval after first-launch consent, so they can change files, run commands and use the network unattended. It is source-available under PolyForm Noncommercial 1.0.0, not an open-source license: commercial use needs a paid license. Optional accounts use the maker's cloud service, and model costs are your providers'. We did not install or test it.
Attention, not endorsement
GitHub showed
“176 stars today” as displayed for GitHub’s daily window; not an audited rolling 24-hour count
What it does. A command-line layer that lets AI agents read platforms ordinary web search misses: GitHub, YouTube subtitles and transcripts, Reddit, LinkedIn jobs, X, Bilibili, Xiaohongshu, V2EX, Xueqiu and podcasts, through one agent-reach command that picks a working tool for each site and falls back to another when one breaks.
Caveat. Login channels copy a site's login from your Chrome, and platforms may restrict accounts used for automation; the README itself advises a secondary account. Some channels are labelled experimental and the 1.6.0 release shipped with several untested on the release machine (Reddit, Instagram, LinkedIn among them). Scraping may conflict with a site's terms. The PyPI package of the same name is not this project. We did not install or test it.
Attention, not endorsement
GitHub showed
“746 stars today” as displayed for GitHub’s daily window; not an audited rolling 24-hour count
What it does. An HTML-native design skill for Claude Code, Codex, Cursor and other agents: from one sentence it produces clickable app or web prototypes, HTML slide decks with editable PPTX export, timeline animations as MP4 or GIF, infographics and a five-point design review. Version 3.0 proposes six directions to pick three from and ships a library of 84 styles with samples.
Caveat. The main README and examples are in Chinese (an English README exists). The author calls it an 80-point skill: no layer-editable Figma output, no 3D or physics animation, and weaker results for a brand designed from scratch. The timings in its table are the author's claims. Older skills CLI versions install only SKILL.md and miss the scripts it needs. We did not install or test it.
Attention, not endorsement
GitHub showed
“251 stars today” as displayed for GitHub’s daily window; not an audited rolling 24-hour count
Every repository GitHub listed, in GitHub’s order, with the figures it displayed when the page was checked (): 5 picked today, 8 covered in an earlier digest, 1 not covered. For projects covered before, growth compares the total stars at our first pick with today’s displayed total.
JavaScript · 896 stars today · 290,094 stars in total
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
Covered before — first picked 16 Oct 2026 at 280,607 stars; now 290,094: +9,487 stars (+3.4%) in 11 days, about 862 a day.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
TypeScript · 176 stars today · 1,696 stars in total
A local-first desktop workspace for persistent AI teammates. Run Codex, Claude, and Grok with dedicated workspaces, task queues, file sharing, browser control, and agent-to-agent collaboration.
Python · 2,297 stars today · 89,915 stars in total
VoiceStudio is the open-source, fully-local ElevenLabs alternative — voice cloning, voice design, video dubbing, dictation, transcription & audiobook creation in 646 languages.
Covered before — first picked 15 Oct 2026 at 67,106 stars; now 89,915: +22,809 stars (+34.0%) in 12 days, about 1,901 a day. Also picked 19 Oct 2026, 26 Oct 2026.
language not shown · 638 stars today · 224,925 stars in total
A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
Not covered yet.
Following Our Picks
Every project picked in an earlier digest, biggest growth first. “Then” is the total at our first pick’s metadata check; “now” is GitHub’s API star count checked . Growth measures attention, not quality or safety.
All 14 listing entries were inspected. Exact primary public GitHub repository metadata, README, recent releases and recent commits were checked for all 14 at about 07:01 UTC; all were active and unarchived. Thirteen had an API-detected license; nightly-labs/openbot showed NOASSERTION, and its LICENSE file was read directly (PolyForm Noncommercial 1.0.0).
Seven entries had been featured in the previous seven days and were left out without a material change: JetBrains/thinkrail, TauricResearch/TradingAgents and debpalash/VoiceStudio (26 October; VoiceStudio's stable v0.5.7 of 26 October rolls in the phone apps we described yesterday, still labelled preview), Nutlope/hallmark, makecindy/cindy, pbakaus/impeccable and pollen-robotics/microduck (25 October). Since those cards they show incremental releases, beta builds, small fixes or no commits.
affaan-m/ECC (featured 16 October) was not repeated: its latest release, v2.2.3 of 1 October, predates that card. multica-ai/andrej-karpathy-skills, a single CLAUDE.md guideline file, was not picked: GitHub detects no license and it has had no commits since 20 April.
The preceding seven calendar dates, 20-26 October, were checked for local history; all seven editions exist.
The official listing was captured at 08:00:35 Europe/Paris. Literal stars-today labels are GitHub's displayed period figures; API total stars and README evidence were checked separately at the times shown per card. They are not an independently audited rolling 24-hour growth measurement.
Feature, performance and security claims are the maintainers' own, including SkillSpector's research figures. No candidate code, installer, skill, plugin, hook or model was installed, downloaded or run, and none of this is a security audit or endorsement.