GitHub Trending Weekly Digest — November 2–7, 2026
If you only glanced at the trending page this week, here's the one-line version: the ecosystem is busy building the scaffolding that AI coding agents actually need to be useful. Reusable "skills" collections showed up everywhere, agents got new ways to drive real desktops and browsers, and a wave of infrastructure landed to give them memory, context, and parallel workspaces.
I merged six days of Top 5 snapshots (Nov 2–7), deduplicated by repo URL, and ranked everything by how many days it stuck around. Twenty projects made the cut. Here's what mattered.
Persistent Champions (3+ days on the board)
These three never dropped off, and between them they tell the whole story of the week.
mattpocock/skills
🔗 github.com/mattpocock/skills — 4 days on the board
What it does: Matt Pocock opened up the set of agent skills from his own .agents directory — the toolkit he says he uses for engineering work every single day. Skills split into Engineering and Productivity, and into two invocation styles: user-invoked skills (triggered only when you type them, meant for orchestration) and model-invoked skills (triggered either by you or automatically when a task matches, carrying reusable discipline). A user-invoked skill can call a model-invoked one, but not another user-invoked skill. The lineup covers grill-me, tdd, diagnosing-bugs, to-spec, code-review, domain-modeling, prototype, research, and more.
Why it matters: These skills exist to fix the failure modes Matt kept hitting with coding agents — the agent not doing what you meant (fix it with a "grilling session" up front), the agent being too verbose (anchor it with a shared CONTEXT.md vocabulary), code that doesn't work (feedback loops via types, browsers, and TDD red-green-refactor), and codebases turning into mud (design-focused skills that investigate rather than rescue). His pitch against heavier frameworks like GSD, BMAD, or Spec-Kit: those take over your process and your control along with it, whereas these are small, easy to edit, and composable with any model.
Tech: Mostly Shell. Install either as a managed, auto-updating Claude Code plugin (claude plugins install mattpocock-skills) or as editable files copied into your project via npx skills@latest add mattpocock/skills — just don't do both, or every skill gets duplicated. Skills live as SKILL.md files; a native Codex plugin is on the roadmap.
NVIDIA/auto-ontology
🔗 github.com/NVIDIA/auto-ontology — 3 days on the board
What it does: Auto-Ontology is NVIDIA's Python framework that runs as a service next to your database and compiles its metadata into an ontology: business terms mapped to columns, reviewed SQL expressions under each term, and the relationships between tables (bridge tables included). Agents query through the ontology; humans review, edit, and certify the definitions in a web UI or API. Answers come back with the SQL and the agent's steps, and you can inspect rows, download CSVs, or view charts right in the chat.
Why it matters: It bills itself as an open context layer that helps agents give fewer wrong answers on enterprise data. The argument is sharp — a revenue number delivered faster is worthless if it's wrong. Instead of pasting a schema into the context window (where tokens balloon per table and column, joins get improvised, and unanswerable questions get confidently answered anyway), the ontology hands the agent only the terms and tables a question actually touches, plus an answerability check that makes it ask for clarification instead of guessing. A companion auto-ontology-eval repo benchmarks the approach against raw-schema prompting on BIRD, BEAVER, and others.
Tech: Python. Next.js + Better Auth + Prisma frontend, FastAPI + LangChain backend for the text-to-SQL agent, a FastMCP server, and Postgres + pgvector (PostgreSQL 17). Connects to ten engines including Snowflake, Databricks, ClickHouse, Trino, and DuckDB. Model roles default to NVIDIA NIM (Nemotron 3.5) but accept any OpenAI-compatible endpoint. Quickstart via Docker Compose and uv.
thedotmack/claude-mem
🔗 github.com/thedotmack/claude-mem — 3 days on the board
What it does: claude-mem is a persistent memory-compression system built for Claude Code (with support for a long list of other agent environments too). During a session it quietly captures observations of tool use, generates semantic summaries, and injects the relevant context back into later sessions.
Why it matters: This is the "the agent forgets everything between sessions" problem, solved. It keeps project knowledge continuous across reconnects and session ends. Features include tiered memory retrieval with visible token cost, a mem-search skill to query project history, a web viewer for the live memory stream, and a <private> tag to keep sensitive content out of storage entirely. You get fine-grained control over what gets injected, and you can reference any past observation by ID.
Tech: TypeScript. Install with npx claude-mem install or the /plugin command inside Claude Code. The core is five lifecycle hooks (SessionStart, UserPromptSubmit, PostToolUse, Stop, SessionEnd) plus a worker service with an HTTP API, a SQLite schema with FTS5 search, and hybrid search via a Chroma vector database. Heads up: the plain npm install -g claude-mem only installs the SDK — it won't register the hooks or set up the worker.
Multi-Day Appearances (2 days)
vercel-labs/agent-desktop
🔗 github.com/vercel-labs/agent-desktop — 2 days on the board
What it does: A CLI and C library that lets an AI agent read and operate desktop apps through the OS accessibility tree, on macOS, Windows, and Linux. One snapshot returns JSON where every actionable element carries a ref; the agent acts on a ref, snapshots again to verify, and the loop stays on the agent's side — no pixel matching. When the UI shifts, stale actions come back as STALE_REF or AMBIGUOUS_TARGET, prompting a fresh snapshot.
Why it matters: This is reliable computer use done right: the agent sees an app's real UI structure and manipulates it, with stable refs and safely retryable actions, instead of guessing from pixels. It's headless by default — actions go through the accessibility API without moving the pointer or stealing focus, and only a global --headed switch allows physical input.
Tech: Rust, installed as a global npm package with native x64 and ARM64 binaries. macOS needs Accessibility permission; Linux needs at-spi2-core and talks over AT-SPI. Each release ships a libagent_desktop_ffi for in-process calls (there's a Python ctypes example). Development uses cargo test and cargo clippy.
D4Vinci/Scrapling
🔗 github.com/D4Vinci/Scrapling — 2 days on the board
What it does: A Python web-scraping framework that bundles HTTP requests, a stealth browser, parsing, and concurrent crawling into one library — it immodestly calls itself "The BEST Web Scraping framework." It handles static pages, JavaScript rendering, site interaction, and pulling data straight from the APIs behind a page, with reusable sessions, proxy rotation, auto-retries, pause/resume, and built-in export.
Why it matters: It covers the whole pipeline, from grabbing a few fields to collecting an entire site into clean Markdown — including Cloudflare Turnstile/Interstitial handling, adaptive element tracking, and similar-element matching. And you can drive it from Python, the terminal, an interactive shell, or hand it to an AI agent via its MCP server and Agent Skill.
Tech: Python. Fetcher for single pages, Spider + Response for crawlers, selectors across CSS, XPath, text, and regex, and exports to JSON, JSONL, CSV, and XML.
max-sixty/worktrunk
🔗 github.com/max-sixty/worktrunk — 2 days on the board
What it does: A CLI for managing git worktrees, built for workflows where you run AI agents in parallel. The entry point is wt, with wt switch, wt list, wt merge, and wt remove as the core verbs. Worktrees are addressed by branch name, paths come from a configurable template, and there's LLM-generated commit messages, an interactive picker with CI status and diff/PR previews, and wt switch pr:123 to jump straight onto a PR's branch.
Why it matters: Once agents like Claude Code or Codex can churn on long tasks unsupervised, you might be juggling 5–10 of them at once. Git worktrees give each agent its own directory, but raw git worktree is clunky — creating one makes you type the branch name three times. Worktrunk makes worktrees feel as simple as branches, and shares a copy-on-write build cache so ten worktrees can each have their own target/ and node_modules/ on APFS, btrfs, or XFS without rebuilding or copying.
Tech: Rust. Install via Homebrew, cargo install, winget, pacman, or conda-forge. Shell integration via wt config shell install.
Single-Day Standouts
Fourteen repos cracked the Top 5 for a single day. Ordered by star velocity:
cloudflare/security-audit-skill
🔗 github.com/cloudflare/security-audit-skill — +2,088
What it does: A skill that turns a coding agent into a security auditor. It orchestrates isolated agents across six phases — recon, vulnerability hunting by coverage, candidate verification, structured output, independent verification, and a target-agnostic report. Cloudflare's own vulnerability-discovery harness grew out of this skill.
Why it matters: Findings are written as machine-readable confirmed / needs_validation / rejected records, each independently verified by a different agent than the one that found it. Run it repeatedly on the same repo and results accumulate, using prior records to fill coverage gaps. Cloudflare says a single run finds roughly half of what many repeated runs find combined.
Tech: JavaScript, installed via npx skills add. Needs a coding agent whose model supports tool calls and parallel sub-agents, plus Node.js for the zero-dependency validators. To execute target code it also wants an OS-enforced sandbox with the network off; without it, leads stay as needs_validation.
Donchitos/Claude-Code-Game-Studios
🔗 github.com/Donchitos/Claude-Code-Game-Studios — +1,380
What it does: A template you clone to start your own project, configuring a single Claude Code session as a game-dev team organized like a real studio hierarchy — 49 agents, 74 skills, 15 hooks, 14 path-scoped coding standards, and 62 doc templates. Agents form three tiers (directors, department leads, specialists), and process rigor is dialed via project.yaml across minimal, standard, and full.
Why it matters: Solo AI game-building has no structure — nothing stops you hardcoding magic numbers, skipping design docs, or shipping spaghetti, with no QA pass and no design review. This bolts a real studio's structure onto the session: defined responsibilities, escalation paths, and quality gates. You still make every call, but a team asks the right questions and catches mistakes early. Interestingly, the author ran the same brief at four rigor levels, and blind reviewers ranked the heavier "standard" build last.
Tech: Shell — 18 bash scripts under .claude/hooks/, agents as Markdown + YAML frontmatter. Needs Git, Claude Code, Python 3, and Bash, with jq recommended. Ships agent sets for Godot 4, Unity, and Unreal Engine 5.
floci-io/floci
🔗 github.com/floci-io/floci — +1,082
What it does: A free, open-source local AWS emulator for dev, test, and CI. All AWS services live at http://localhost:4566; point your AWS SDK, CLI, Terraform, CDK, or OpenTofu at it and credentials can be any non-empty value. It bills itself as a drop-in replacement for LocalStack — just swap the image.
Why it matters: LocalStack's Community edition sunset in March 2026, started requiring an auth token, and froze security updates; Floci positions itself as the successor. Its comparison table claims a roughly 24 ms startup, around 13 MiB idle memory, a roughly 90 MB image, and an MIT license — against LocalStack Community's roughly 3.3 s, 143 MiB, and 1.0 GB. For services where in-process emulation would hurt fidelity (Lambda, RDS, ECS, EKS, and more), it runs real Docker containers instead of shallow mocks.
Tech: Java, with JAX-RS / Vert.x routing and pluggable storage backends (memory, hybrid, persistent, wal). Container-backed services pull real images like postgres:16-alpine and valkey:8. Ships as a Docker image, a CLI, and standalone binaries for Linux, macOS, and Windows.
JustVugg/colibri
🔗 github.com/JustVugg/colibri — +803
What it does: An inference engine written in pure C with no engine dependencies — and also an open research platform. It treats storage, RAM, and VRAM as one unified inference hierarchy to run MoE models from 744B up to 2.8T parameters on consumer and heterogeneous hardware. It currently supports nine model families (GLM-5.2/5.3, Kimi K3, DeepSeek V4 Flash, and others), one C file each.
Why it matters: The goal is to push inference performance across the whole hardware/software boundary — model formats, memory tiers, storage I/O, scheduling, kernels — so big models lean less on scarce hardware and cost less to run. The trick: keep the MoE dense part resident in RAM as int4, stream routed experts from disk on demand, and back it with per-layer LRU caching and an optional VRAM tier. No speed SLA, but the default policy won't silently change model precision or routing semantics.
Tech: A single C file plus a few headers — no BLAS, Python, or GPU required at runtime. Supports CPU, CUDA, Metal, and NUMA memory, with a local cluster mode that offloads routed FFNs to workers on other Macs over persistent TCP.
garrytan/gstack
🔗 github.com/garrytan/gstack — +608
What it does: Garry Tan's open-source skill collection that turns Claude Code (and other coding agents) into a virtual engineering team — a CEO rethinking the product, an engineering manager locking architecture, a designer, a reviewer hunting production bugs, a QA lead opening a real browser, a security officer running OWASP and STRIDE audits, and a release engineer shipping PRs. All slash commands, all Markdown, all free, MIT-licensed. He calls it the open-source software factory he uses every day.
Why it matters: It aims at founders, first-time Claude Code users, and senior engineers alike, handing you structured roles instead of a blank prompt, with strict review, QA, and release automation on every PR. The flow chains Think → Plan → Build → Review → Test → Ship → Reflect, each step's output feeding the next.
Tech: TypeScript skills as Markdown slash commands. Needs Claude Code, Git, and Bun v1.4.2+. Browser skills prefer the Aside browser (macOS 15+) and fall back to a bundled Chromium. Support for a dozen other agents is marked experimental.
Hyprland (hyprwm/Hyprland)
🔗 github.com/hyprwm/Hyprland — +508
What it does: A dynamic tiling Wayland compositor that claims to be 100% independent without sacrificing looks. Gradient borders, multiple blur modes, animations, glow and shadows, custom bezier and spring curves, a plugin system with a built-in manager, tearing support, socket-based IPC, instant config reload, and fully dynamic workspaces.
Why it matters: It leans into bleeding-edge Wayland features without depending on wlroots, libweston, kwin, or mutter, with a codebase it claims is easy to read and extend. Layouts include Dwindle, Scrolling, Master, and Monocle, plus custom layouts in Lua or via plugins, settable per workspace.
Tech: C++, targeting Wayland. Custom layouts in Lua or plugins; socket-based IPC.
google/skills
🔗 github.com/google/skills — +449
What it does: Google's repo of Agent Skills for its products and technologies — Google Cloud and well beyond. It lists skills by topic (getting started, AI/ML, infrastructure, databases and analytics, developer tools, security and identity, web and app hosting, ads) and bundles agent-framework plugins (Skills plus MCP servers) for Google products.
Why it matters: It's the official on-ramp for pointing a coding agent at Google's stack, installable with npx skills add google/skills and selectable down to specific skills. The README also maps out where the other Google skill repos live (ADK, Android, Dart, Firestore, Flutter, Maps Platform) and invites bug reports and new-skill proposals.
Tech: Python; skills as Markdown files. Plugins install into Claude Code, Codex, and the Antigravity CLI as Skills plus MCP servers. Covers GKE, TPU/GPU, BigQuery, AlloyDB, Spanner, Cloud Run, Firebase, Genkit, the Gemini API, and much more. Apache 2.0.
anthropics/skills
🔗 github.com/anthropics/skills — +386
What it does: Anthropic's public repo of Agent Skills for Claude. Skills are folders of instructions, scripts, and resources that Claude loads dynamically; the collection ranges from creative apps (art, music, design) to technical tasks (testing web apps, MCP server generation) to enterprise workflows. It's organized into ./skills, ./spec (the Agent Skills spec), and ./template.
Why it matters: These teach Claude to do specific tasks repeatably — create docs to a company's brand standards, analyze data with org-specific workflows, automate personal tasks. They're meant as demonstrations and inspiration for writing your own. Notably, the docx, pdf, pptx, and xlsx skills that power Claude's document abilities are included as references for production-grade skills.
Tech: Python. Each skill is a folder with a SKILL.md whose frontmatter requires only name and description. Register via /plugin marketplace add anthropics/skills, use on Claude.ai, or go through the Claude API. Many skills are Apache 2.0; the four document skills are source-available rather than open source.
zed-industries/zed
🔗 github.com/zed-industries/zed — +292
What it does: A code editor from the creators of Atom and Tree-sitter, billed as a high-performance, multiplayer-capable editor. Download it directly on macOS, Linux, and Windows, or grab it from your package manager.
Why it matters: Its own tagline says it best — "Code at the speed of thought." A web version is still in tracking-discussion territory.
Tech: Rust, with crates configured via Cargo.toml and license compliance handled by cargo-about. Mostly GPL-3.0-or-later, with some Apache-2.0 parts.
Usagi-org/ai-goofish-monitor
🔗 github.com/Usagi-org/ai-goofish-monitor — +242
What it does: A Playwright-plus-AI system for real-time and scheduled monitoring of Xianyu (China's secondhand marketplace), with a web admin UI for task, account, and AI-criteria management. Each task picks an account and proxy, searches listings, scrapes item and seller details, downloads images, runs a multimodal model, and notifies you when the AI recommends something — saving records to SQLite. The repo stresses it's for learning and research only.
Why it matters: It helps you surface the listing you actually want from a flood of them: concurrent tasks each with their own keywords, price, filters, and AI prompt, cron scheduling, and instant notifications via ntfy.sh, WeCom, Bark, Telegram, or webhooks. Multi-account management, proxy-pool rotation, and retries help ride out rate-limiting and anomalies.
Tech: Python; Playwright-driven Chromium, FastAPI backend, SQLite storage. Frontend built with Vite. Needs an OpenAI-compatible endpoint and an image-capable model. Ships with Docker Compose and a published image.
rust-lang/rust
🔗 github.com/rust-lang/rust — +186
What it does: The main Rust source repo — compiler, standard library, and docs. Its motto: "Empowering everyone to build reliable and efficient software."
Why it matters: The "Why Rust?" case is three-part — performance (fast and memory-efficient, great for critical and embedded services), reliability (a rich type system and ownership model guaranteeing memory and thread safety at compile time), and productivity (solid docs, a compiler that sweats its diagnostics, and a mature toolchain).
Tech: Rust. Cargo, rustfmt, Clippy, and rust-analyzer round out the toolchain; installing from source isn't recommended. Dual-licensed MIT and Apache 2.0.
vercel-labs/agent-browser
🔗 github.com/vercel-labs/agent-browser — +180
What it does: Browser automation for AI agents — a native Rust CLI that opens pages, reads them as an accessibility tree, and runs actions on elements from the shell. snapshot returns the page as compact text where each element carries a ref like @e1; the agent acts, re-reads to confirm, and loops. The browser stays open between commands, so each step is a quick shell call.
Why it matters: It's the browser sibling to agent-desktop — same snapshot-act-verify loop, this time for the web. It ships skills matching the CLI (agent-browser skills get core), installed as a thin stub so instructions always track the installed CLI version. When a target is hidden, disabled, off-screen, or covered by a consent banner, a click fails loudly instead of reporting false success.
Tech: Native Rust CLI via npm, Homebrew, or npx. A background daemon drives the browser over the Chrome DevTools Protocol (Chrome for Testing by default), with support for cloud browser providers and an MCP server via agent-browser mcp. Native binaries for macOS, Linux, and Windows. Apache-2.0.
rails/rails
🔗 github.com/rails/rails — +44
What it does: The Ruby web application framework, splitting apps into Model, View, and Controller layers, each with its own job — and shipping with Action Mailer, Active Job, Action Cable, Active Storage, Action Text, and Active Support alongside.
Why it matters: It's everything you need to build a database-backed web app the MVC way: models encapsulate domain logic, views render representations from templates, and controllers handle incoming HTTP requests and responses. Still showing up on trending after all these years.
Tech: Ruby. Models derive from ActiveRecord::Base, views are usually ERB, and requests route through Action Dispatch to controllers deriving from ActionController::Base. Install with gem install rails, scaffold with rails new, serve at http://localhost:3000.
mpv-player/mpv
🔗 github.com/mpv-player/mpv — +36
What it does: A command-line media player — free software supporting a wide range of formats, codecs, and subtitle types. It descends from MPlayer (by way of a short stint under mplayer2).
Why it matters: It plays media from the terminal, and it's deliberately modern about it — requiring a recent-ish Linux, Windows 10 1607+, or macOS 10.15+, plus a halfway-capable GPU. Low-power and integrated GPUs aren't its focus; those should reach for --profile=fast.
Tech: C, built with meson. Rendering and scaling run on shaders rather than fixed-function hardware; hardware decoding is opt-in via --hwdec. Core deps include FFmpeg libraries, libplacebo, and libass. GPLv2-or-later by default, LGPLv2.1 with -Dgpl=false.
This Week's Themes
A few patterns jump out once everything's on one page:
- Agent Skills went fully mainstream. Six of the twenty repos are skill collections — mattpocock, google, anthropics, Cloudflare's security-audit, gstack, and Claude Code Game Studios. The
npx skills add ...install pattern and theSKILL.mdformat are quietly becoming a de facto standard, with the same marketplaces (Claude Code, Codex, Antigravity CLI) showing up again and again. - Agents are getting real computers. agent-desktop, agent-browser, and Scrapling all hand agents a way to drive desktops, browsers, and the web — and the first two share an identical design: snapshot the accessibility tree, act on stable refs, re-snapshot to verify, no pixel guessing. That convergence feels like a pattern settling in.
- AI-native developer infrastructure is maturing. claude-mem gives agents memory, auto-ontology gives them a trustworthy context layer over enterprise data, and worktrunk gives them parallel workspaces. These aren't chatbots — they're the plumbing for running many capable agents at once, reliably.
- The classics never leave. Rust, Rails, mpv, Zed, and Hyprland all held their spots. Trending isn't only about the new hotness; the foundational tools keep drawing steady attention.
Takeaway
This was a week about scaffolding. Not flashy new models, but the connective tissue that makes agents dependable: reusable skills, a shared install format, snapshot-based computer use, persistent memory, and trustworthy data context. If you're building with coding agents right now, the highest-leverage move is probably to stop hand-rolling prompts and start adopting these shared primitives — a SKILL.md here, a memory layer there, an ontology in front of your database. The ecosystem is converging fast, and the repos above are where it's converging.
Compiled by Tommy Zhang | November 08, 2026