GitHub Trending Weekly Digest — November 9–14, 2026
Another busy week on GitHub's trending charts, and the throughline is hard to miss: the "agent skills" movement is maturing fast. What started as a handful of experimental folders has become a genuine ecosystem — vendors, framework authors, and browser teams are all racing to package expert knowledge into something coding agents can load on demand. Alongside that, AI-driven code review and security tooling had a strong showing, a decade-old design system finally went public, and self-hosted finance apps kept their loyal following.
I've pulled the daily Top 5 lists from November 9 through 14, deduplicated by repository URL, and ranked everything by how many days each project stuck around. Here's the week that was.
Staying Power: The Week's Persistent Champions
These are the repos that refused to leave the charts — three days or more of sustained momentum.
modern-web-guidance-src — GoogleChrome/modern-web-guidance-src
🔗 github.com/GoogleChrome/modern-web-guidance-src
What it does: This is the source repository behind Modern Web Guidance — a set of skills that inject web-platform knowledge, best practices, and browser-compatibility data directly into coding agents. It's a genuinely cross-vendor effort, maintained by the Google Chrome, Microsoft Edge, Mozilla Firefox, and MDN teams together with the broader web community.
Why it matters: Coding agents have a bad habit of reaching for legacy patterns, because their training data is saturated with old code. They'll happily generate bloated JavaScript for tasks that modern browsers solve natively, and even when a model knows an API exists, it often lacks enough real-world examples to use it confidently. Modern Web Guidance feeds targeted, expert-curated guidance into the agent's context window via a CLI, focused on modern browser APIs, performance, and accessibility — swapping heavy polyfills and legacy libraries for lightweight fallbacks. The guidance is deliberately token-efficient, with evals used to prune the lowest-common-denominator material models already know. Four straight days on trending made it the week's standout.
Tech: Primarily TypeScript. Install via the interactive wizard (npx modern-web-guidance@latest install), with search, retrieve, and legacy-scan commands for quick experimentation; guidance ships as Markdown files. Coverage spans View Transitions, entry/exit animations, CSS scrollbar-color, container queries, subgrid, modern color spaces like oklch, text-wrap tuning, line-height trimming, instant preloading, Interaction to Next Paint (INP) diagnostics, scheduler.yield, Anchor Positioning, the Popover API, dialog, :user-invalid validation, auto-sizing form fields, and on-device translation/summarization/language-detection APIs — 250 modern web features in all, 140 of them in CSS and Layout.
astryx — meta/astryx
🔗 github.com/meta/astryx
What it does: Astryx is an open-source design system, currently in Beta, that spent eight years maturing inside Meta before going public. It ships 150+ accessible components, brand-grade theming, dark mode, ready-to-use templates, and a CLI. You import prebuilt CSS and use typed React components — no build plugin required, and no extra styling library to pull in.
Why it matters: The pitch is explicitly about building "with humans and the agents that collaborate with them." Components compose at any level; when you need deeper customization, swizzle ejects a component's full source into your project. Themes are just a set of CSS custom-property overrides, so designers can customize without forking or wrapping component source. The API, docs, and CLI were designed together so that people and AI assistants work from the same reference in the same way — a design-system philosophy built for the agent era.
Tech: Primarily TypeScript, built on React 19+ and StyleX (React 19 or newer is required; react and react-dom are peer dependencies of @astryxdesign/core, alongside @stylexjs/stylex). The repo publishes @astryxdesign/core, @astryxdesign/cli, @astryxdesign/build, and seven @astryxdesign/theme-* packages; styles can be overridden via className using Tailwind, CSS modules, or plain CSS. The @astryxdesign/lab package holds experimental components and isn't published to npm, while @astryxdesign/vega and @astryxdesign/charts ship only under the @canary dist-tag. Contributors use Node 22+, pnpm 11, Corepack, and vitest.
sure — we-promise/sure
🔗 github.com/we-promise/sure
What it does: Sure is a personal finance app — a community fork of the now-archived Maybe Finance project. You can self-host it with Docker and access it through a browser, a macOS desktop app, mobile apps, API clients, and LLM agents. It's AGPLv3-licensed; the README is careful to note that "Maybe" is a trademark of Maybe Finance, Inc., while "Sure" is not and refers specifically to this community fork.
Why it matters: The stated goal is simply to keep the codebase alive and see where the community can take it next. The Maybe Finance team built this wealth-management app in 2021–2022, stopped development in mid-2023 after spending close to $1M, and open-sourced it so users could self-host for free. The fork also leans into transparency: it runs a public dashboard exposing failing requests and their stack traces on the demo site, and actively welcomes performance contributions — a refreshingly honest stance for a data-heavy app.
Tech: Primarily Ruby (version pinned in .ruby-version), depending on PostgreSQL >9.3 and Redis > 5.4. Local dev runs via bin/setup and bin/dev at http://localhost:3000, with demo data loaded through rake demo_data:default. Self-hosting uses Docker, with dev-container support. One-click deploy options are built on a Render Blueprint (render.yaml) — provisioning the Sure web service, a Sidekiq worker, Render Postgres, and Render Key Value — plus PikaPods and Hostim entry points. Performance data is surfaced via Skylight.
daily_stock_analysis — ZhuLinsen/daily_stock_analysis
🔗 github.com/ZhuLinsen/daily_stock_analysis
What it does: An LLM-powered, multi-market stock analysis system covering watchlists across China A-shares, Hong Kong, US, Japan, Korea, Taiwan, and ETFs. It outputs core conclusions, scores, trends, entry/exit levels, risk alerts, catalysts, and an action checklist, then pushes a daily "decision dashboard" to WeCom, Lark, Telegram, Discord, Slack, or email. There's also a web/desktop workbench (manual analysis, task progress, historical reports, backtesting, positions, config management, light/dark themes) and an agent-based strategy query, with 15 built-in strategies ranging from moving-average crossovers to Chan theory, wave theory, event-driven, and growth-quality approaches.
Why it matters: It's designed for zero-cost, serverless daily automation — fork the repo, configure Secrets, and GitHub Actions runs it on schedule (by default at 18:00 Beijing time on weekdays, skipping non-trading days including holidays). The project is explicit that it's for learning and research only and does not constitute investment advice. It's a neat demonstration of how far you can push a fully automated analysis pipeline using nothing but free infrastructure.
Tech: Primarily Python (3.10+). Run it via python main.py on the command line, as a FastAPI service, as a local scheduled task, via Docker, or via GitHub Actions; the web workbench launches with python main.py --webui at http://127.0.0.1:8000. Model support spans Modelflare, AIHubMix, Gemini, OpenAI-compatible endpoints, DeepSeek, Qwen, Claude, and local Ollama models. Market data comes from AkShare, Tushare, Pytdx, Baostock, YFinance, and Longbridge; news search integrates SerpAPI, Anspire, Tavily, Bocha, Brave, MiniMax, and SearXNG. Free sources (AkShare, Baostock, YFinance) work with zero config, though stability isn't guaranteed given upstream rate limits.
codex-security — openai/codex-security
🔗 github.com/openai/codex-security
What it does: Codex Security is OpenAI's vulnerability-hunting toolkit, comprising the Codex Security CLI and a TypeScript SDK, published on npm as @openai/codex-security. It scans entire repos, specific paths, or Git changes; validates candidate findings; generates patches; verifies existing fixes; drafts a SECURITY.md policy and saves threat models; and syncs findings to Linear, Jira, or GitHub, or exports to SARIF, JSON, and CSV. You can drive it from a Codex session with the plugin enabled, from the terminal, or via the SDK and a GitHub Action.
Why it matters: It's purpose-built to find, investigate, and fix vulnerabilities, and scales across CI and containers for batch scanning by repo or component. Some cybersecurity requests and protected findings require Trusted Access for Cyber; Codex Security Cloud is an optional connection, and local scans work without it. Notably, the local serve command and browser dashboard have been removed, though existing databases and scan artifacts remain accessible. The GitHub Action example uses a ~$5-per-scan budget cap and doesn't fail the job when findings are reported.
Tech: Primarily TypeScript, exposing a TypeScript SDK (via the CodexSecurity class) and a CLI installed globally or run with npx (cs and codex-security are the same command). Runtime needs Node.js 22.13.0+ within 22.x, or Node.js 24.x/26.x, plus Python 3.10+ (Python 3.10 also needs tomli). Automation uses GitHub Actions and Docker Compose for containerized batch scans; scanning supports OpenAI, Amazon Bedrock, OpenRouter, Fireworks AI, and Cheaper Inference, authenticating via OPENAI_API_KEY or CODEX_API_KEY.
Two-Day Risers
Solid momentum from projects that held the charts for a couple of days.
skills — anthropics/skills
🔗 github.com/anthropics/skills
What it does: The public repository of Agent Skills — Anthropic's own skill implementations for Claude. A skill is a folder of instructions, scripts, and resources that Claude loads dynamically, spanning creative work (art, music, design), technical tasks (testing web apps, MCP server generation), and enterprise workflows (communication, branding). It's organized into ./skills (example skills), ./spec (the Agent Skills specification), and ./template.
Why it matters: This is effectively the reference implementation that kicked off the week's recurring theme. Skills teach Claude to perform specific tasks reproducibly — creating documents to a company's brand guidelines, analyzing data with organization-specific workflows, or automating personal tasks. The repo is framed as demonstration and education: browse it for inspiration or to understand different patterns. The docx, pdf, pptx, and xlsx skills that power Claude's document capabilities are included as references to more complex, production-grade work.
Tech: Primarily Python. Each skill is a self-contained folder with a SKILL.md carrying YAML frontmatter that requires only name and description, followed by Markdown instructions. Register it in Claude Code with /plugin marketplace add anthropics/skills, then install document-skills@anthropic-agent-skills or example-skills@anthropic-agent-skills; it also works in Claude.ai and via the Claude API. Many skills are open source (Apache 2.0), while docx, pdf, pptx, and xlsx are source-available.
agent-skills — addyosmani/agent-skills
🔗 github.com/addyosmani/agent-skills
What it does: An engineering skill pack for AI coding agents — 25 skills in total (24 development-lifecycle skills plus a using-agent-skills meta-skill), 9 slash commands mapped to development phases (/spec, /plan, /build, /test, /review, /ship), expert personas, and reference checklists. Each skill is a structured workflow with steps, verification gates, and an anti-rationalization table — and they auto-trigger based on the task at hand.
Why it matters: It packages the workflows, quality gates, and best practices that senior engineers actually use into something an AI agent can follow consistently across defining, planning, building, verifying, reviewing, and shipping. The clever bit: each skill lists the excuses agents commonly use to skip steps, along with rebuttals, and demands evidence — passing tests, build output — to complete verification. It's an attempt to impose engineering discipline on agents that would otherwise cut corners.
Tech: Primarily JavaScript. Skills are written in plain Markdown (SKILL.md) and install via an npx-run skills CLI, with native integrations for Claude Code, Cursor, Gemini CLI, Codex, and GitHub Copilot. The browser-testing-with-devtools skill uses the Chrome DevTools MCP.
open-code-review — alibaba/open-code-review
🔗 github.com/alibaba/open-code-review
What it does: Open Code Review is an AI code-review CLI (command: ocr), derived from Alibaba Group's internal AI review assistant. It reads a Git diff and sends changed files to a configurable LLM via a tool-calling agent, producing structured, line-precise review comments. ocr scan can review whole files, and a delegation mode lets an AI coding agent run the review itself, with plugins for Claude Code, Codex, Cursor, and OpenCode.
Why it matters: The project argues that doing code review with general-purpose agents like Claude Code plus Skills leads to incomplete coverage, drifting issue locations, and inconsistent quality — because a purely language-driven architecture lacks hard constraints. Its answer is to hand file selection, file packing, rule matching, comment positioning, and reflection to deterministic engineering logic, while leaving dynamic decisions and context retrieval to the agent. On its benchmark of 50 open-source repos, 200 real PRs, and 10 languages, it claims higher precision and F1 than Claude Code using the same underlying model, at roughly 1/9 the token cost — though with lower recall.
Tech: Primarily Go. It depends on Git >= 2.41 to generate diffs, search code, and operate on repos, and installs via npm. It's compatible with OpenAI- and Anthropic-style model APIs, uses a template engine for rule matching, and can pull in external tools through an MCP Server.
claude-quickstarts — anthropics/claude-quickstarts
🔗 github.com/anthropics/claude-quickstarts
What it does: A collection of projects that help developers get started building with the Claude API, each offering a foundation to build on and customize. Examples include a customer-support agent, a financial data analyst, a Computer Use Demo and Best Practices, a Browser Use Demo, Browser and Computer Toolset examples, an autonomous coding agent, and a series of Managed Agents samples (Chat SDK, CopilotKit with AG-UI, Daily Brief, Knowledge Wiki, Linear, MCP Server, Road Trip Planner, Sentry, Sentry Autofix, Slack).
Why it matters: For developers who want a running start with the Claude API, these are usable starting points. The samples demonstrate AI-assisted customer support with a knowledge base, conversational financial analysis with interactive visualizations, letting Claude control a desktop, browser automation (navigating sites, inspecting and manipulating the DOM, extracting content, filling forms), a dual-agent pattern for building full apps across sessions, and various Managed Agents deployment shapes. You'll need a Claude API key.
Tech: Primarily Python. The Browser Use Demo uses a custom Playwright-driven browser tool; the Browser Toolset drives a Chromium tab via the Chrome DevTools Protocol, and the Computer Toolset drives a desktop via VNC (RFB protocol, no VNC library) — both in Python and TypeScript, as interface demos rather than production code. The autonomous coding agent is built on the Claude Agent SDK and persists progress through git. Managed Agents samples draw on Vercel's Chat SDK, the CopilotKit/AG-UI protocol, Next.js, MCP servers (TypeScript, over stdio or Streamable HTTP), the Linear Agent Platform with OAuth, the Sentry MCP server, and GitHub/Slack webhooks.
mujoco — google-deepmind/mujoco
🔗 github.com/google-deepmind/mujoco
What it does: MuJoCo (Multi-Joint dynamics with Contact) is a general-purpose physics engine maintained by Google DeepMind. Aimed at researchers and developers, its runtime simulation module is tuned for performance, operating on low-level data structures preallocated by a built-in XML compiler. The library includes interactive visualization in native desktop windows and web browsers, and exposes many utility functions for computing physics-related quantities.
Why it matters: The goal is to advance research and development in robotics, biomechanics, graphics and animation, and machine learning — anywhere fast, accurate simulation of articulated structures interacting with their environment is needed. It's a long-standing pillar of the robotics-simulation world that keeps drawing fresh attention.
Tech: Primarily C++, with a C API and a built-in XML compiler. Official bindings include Python (pip install mujoco, Python >= 3.11), JavaScript/WebAssembly, C#, and a Unity plugin; MJX (MuJoCo XLA) is a JAX-based branch. Precompiled binaries target Linux (x86-64 and AArch64), Windows (x86-64 only), and macOS (universal) and are the recommended path. MuJoCo Studio at live.mujoco.org is a WebAssembly build. Tutorials come as IPython notebooks on Google Colab. Apache 2.0 licensed; not an officially supported Google product.
One-Day Wonders
Brief but notable appearances.
sherlock — sherlock-project/sherlock
🔗 github.com/sherlock-project/sherlock
What it does: Sherlock is a command-line tool that hunts for social media accounts by username across 400+ social networks. You can query one or more usernames at once, and found accounts are written to a text file named after each username (e.g. user123.txt).
Why it matters: It's a staple OSINT utility for checking whether a given username exists across the social web and saving the results — simple, fast, and widely used in security and research workflows.
Tech: Primarily Python. Install via pipx install sherlock-project (pip or uv also work), Docker, dnf, or community-maintained packages for Debian, Ubuntu, Homebrew, Kali, and BlackArch (not directly supported by the project). It supports CSV, xlsx, json, and txt export, proxied requests (e.g. socks5://127.0.0.1:1080), site filtering, and timeouts.
HermesEnabler — pookjw/HermesEnabler
🔗 github.com/pookjw/HermesEnabler
What it does: HermesEnabler 2 is a tool for enabling Hermès watch faces on an Apple Watch. It's distributed as an IPA and runs as the HermesEnabler2 app on the watch, where you follow the in-app steps. The project notes support only on watchOS 27.0 through 27.3 beta 1, and use at your own risk.
Why it matters: It unlocks the Hermès watch faces on any Apple Watch — a niche but clearly popular tweak, given its one-day spike.
Tech: Primarily Objective-C. The project opens as HermesEnabler2.xcodeproj in Xcode and builds targeting an Apple Watch; alternatively, download the IPA from Releases and install it with Sideloadly, then via the iPhone Watch app under My Watch → Apps. It involves MobileGestalt backup and restore and references code from the Gester project.
improve — shadcn/improve
🔗 github.com/shadcn/improve
What it does: An agent skill that audits any codebase and writes implementation plans for other agents. The skill never implements anything itself — the plan is the deliverable. The idea: use a more capable model to understand the codebase, judge what's worth doing, and write the spec, then hand execution to a cheaper model. It offers /improve subcommands like quick, deep, security, branch, next, plan, review-plan, execute, and reconcile, plus an --issues option to publish plans as GitHub issues.
Why it matters: It cleanly separates where intelligence accumulates (understanding the codebase, prioritizing, writing specs) from execution. The audit phase fans out sub-agents across nine categories — correctness, security, performance, test coverage, tech debt, dependencies and migrations, DX, docs, and direction — each finding carrying file:line evidence, impact, effort, and confidence. Because sub-agents over-report, an advisor re-reads every cited location, drops false positives, corrects misattributions, and ranks findings by impact ÷ effort weighted by confidence. Plans are written for the weakest possible executor: full context inlined, each step gated by a command and expected output, with explicit out-of-scope lists and STOP conditions.
Tech: Install via npx skills add shadcn/improve; works in any agent supporting the Agent Skills format. Plans are plain Markdown landing in plans/ with an index, priority ordering, and a dependency graph. Recon reads the repo's stack, conventions, and exact build/test/lint commands as verification gates, and absorbs ADRs, PRDs, and design docs when present. execute dispatches cheaper executor sub-agents in isolated git worktrees, reruns each acceptance criterion, and reviews the diff. By rule, it never modifies source — the only writes are to plans/ — never runs commands that mutate the working tree, and never reproduces secret values.
nvm — nvm-sh/nvm
🔗 github.com/nvm-sh/nvm
What it does: nvm is a version manager for Node.js — a POSIX-compliant bash script, installed per-user and invoked per-shell, for installing and using multiple Node versions from the command line. It provides nvm install, use, run, exec, which, ls, ls-remote, and alias, supports .nvmrc files, LTS notations like lts/* and lts/argon, and aliases such as node, iojs, system, default, and current.
Why it matters: It's the go-to way to juggle Node versions quickly. When installing a new version you can migrate global npm packages from a prior one with --reinstall-packages-from, or use --offline to install purely from already-installed versions and cached downloads — handy on isolated networks, on a plane, or when avoiding network latency.
Tech: Primarily Shell. Runs on POSIX-compliant shells (sh, dash, ksh, zsh, bash) across unix, macOS, and Windows WSL (no Fish support; Git Bash/MSYS or Cygwin may work on Windows in some cases). The install script downloads via git, curl, or wget (git installs need git v1.7.10+); building Node from source requires a C++ compiler. Docker and Ansible examples are provided, with configuration via env vars like NVM_DIR, PROFILE, NODE_VERSION, NVM_NODEJS_ORG_MIRROR, and NVM_COLORS.
Themes of the Week
A few clear currents ran through the week's trending data:
-
Agent skills go mainstream. The single biggest story. Anthropic's
skills, Addy Osmani'sagent-skills, shadcn'simprove, Google Chrome'smodern-web-guidance, and even Alibaba'sopen-code-reviewall revolve around the same idea: package expert knowledge and workflows into structured, loadable skills that coding agents can invoke. The pattern is converging on plain-MarkdownSKILL.mdfiles, slash commands, and verification gates — and it's coming from vendors, individual developers, and browser teams alike. -
AI code review and security tooling.
open-code-reviewandcodex-securityboth push toward deterministic, agent-assisted review — the former explicitly arguing that hard engineering constraints beat purely language-driven architectures, the latter productizing vulnerability hunting end to end. Reliability and cost-efficiency, not raw model capability, were the selling points this week. -
Self-hosted and local-first apps hold their ground.
sure(personal finance) anddaily_stock_analysis(multi-market stock analysis) kept loyal audiences by leaning on Docker, GitHub Actions, and free data sources to run entirely on your own infrastructure — no SaaS subscription required.
Takeaway
If there's one thing to internalize from this week, it's that the industry has settled on how to teach agents, not just whether they can code. The skill — a folder of instructions, scripts, and verification gates that an agent loads on demand — has quietly become the unit of agent competence, and everyone from Anthropic to Google Chrome to Alibaba is shipping them. Meanwhile, the enduring appeal of self-hostable, honestly-run open-source apps like sure is a reminder that not every trend is about AI. Watch the agent-skills space closely; it's moving fast, and the conventions being set right now will likely stick.
Compiled by Tommy Zhang | November 15, 2026