A selected shortlist, not a ranking of all GitHub projects. Weekly gains are reported by Star History for the dates shown; total stars are a separate GitHub snapshot.
Reviewed 2026-10-21. Source ranking: 2026-10-12 to 2026-10-18.
Small engineering skills for turning vague requests into specs, tests and reviewable changes. Worth borrowing one workflow from before installing the whole toolbox.
Total stars: 298923. Source-week gain: 10122. Star History reports this gain for 2026-10-12 to 2026-10-18; not independently measured. GitHub total checked separately.
Live chart from Star History. Attention is not a safety verdict.Open Star History
Check before you run
Try one reviewed skill in a disposable project. Keep issue-tracker writes and plugin auto-updates off for that first experiment.
Source review: 2026-10-21. Code not executed; not a security audit.
Adapt the interview-and-spec workflow into a founder intake that exposes unknown users, constraints and failure cases before anyone starts coding.
First move: Give one reviewed interview skill a fictional delivery-booking brief. Ask it to stop at a local spec with open questions.
You need: An agent that can read skill files; One reviewed skill at the pinned revision; A disposable folder with no tracker credentials
Worth keeping if: The spec names the user, acceptance checks and unresolved decisions. It invents no customer research and posts nothing externally.
A repair ticket with a real exit
Turn a reproducible product bug into a narrow ticket and a failing test, then use the same test to judge the fix.
First move: Choose one toy app bug and record the failing input before trying the TDD or diagnosis workflow.
You need: A runnable toy project; A test runner; A reviewed TDD or diagnosis skill
Worth keeping if: The test fails before the change, passes after it, and still fails when the fix is removed. The diff stays within the ticket.
Evidence and unknowns
Licence: observed. GitHub identifies MIT. Read the licence and check model, media and dependency terms separately. Evidence
Install surface: unknown. No root package lifecycle hook found. Only README and root files inspected; nested packages, binaries and dependencies are not audited. Evidence
Public advisories: observed. 0 published repository advisories returned. This does not check transitive dependencies or prove safety. Evidence
OpenSSF coverage: unknown. No usable OpenSSF report returned; coverage is unknown. Evidence
Execution: unknown. Not installed or executed. Read-only metadata and source inspection; not a security audit or personal endorsement. Evidence
Repository age: observed. Created 2026-02-03 (259 days before this check). Repository age is not a safety rating. Evidence
Contributor coverage: attention. 4 identified contributors returned by GitHub; anonymous contributors excluded and this request is capped at 100. This is not a complete ownership or bus-factor audit. Evidence
Owner account: observed. GitHub owner account created 2017-05-02. Account age does not verify identity, current control or a matching project name. Evidence
Star history: observed. GitHub returned a completed weekly history bucket (2026-10-11 to 2026-10-17). A sharp rise alone is not evidence of purchased stars or malicious code. Evidence
Before you try it: attention. The README offers plugins that update automatically and skills that work with issue trackers. The pinned review does not cover future updates or grant permission to post issues. Read the selected skill before giving it write access. Evidence
An agent skill for editable HTML and SVG diagrams. A useful candidate when your onboarding process currently lives in somebody's head.
Total stars: 59139. Source-week gain: 7047. Star History reports this gain for 2026-10-12 to 2026-10-18; not independently measured. GitHub total checked separately.
Live chart from Star History. Attention is not a safety verdict.Open Star History
Check before you run
Try a synthetic process map first. Inspect the skill, export scripts and privacy notes before using internal architecture or customer data.
Source review: 2026-10-21. Code not executed; not a security audit.
Map who owns each step from signup to first useful outcome, including the points where the customer waits for a human.
First move: Write a fictional six-step onboarding process with owners and two known delays. Ask for one swimlane-style HTML diagram.
You need: An agent with the reviewed skill; A plain-text process description; A browser for inspecting the output
Worth keeping if: Every supplied step and owner appears once. Both delays are visible and no extra team or automation is invented.
Explain an agent's permissions
Make a readable map of what an agent can read, change and send externally. Use it as an onboarding aid, not an access-control system.
First move: Start with a synthetic agent, three tools and two approval boundaries. Ask for a diagram that distinguishes data movement from write permission.
You need: A reviewed tool-permission list; Synthetic system names; Someone who can check the diagram against the actual configuration
Worth keeping if: A reader can identify every write action and external destination. The diagram does not imply that drawing a boundary enforces it.
Evidence and unknowns
Licence: observed. GitHub identifies MIT. Read the licence and check model, media and dependency terms separately. Evidence
Install surface: unknown. Root package manifest unavailable or absent. Only README and root files inspected; nested packages, binaries and dependencies are not audited. Evidence
Public advisories: observed. 0 published repository advisories returned. This does not check transitive dependencies or prove safety. Evidence
OpenSSF coverage: unknown. No usable OpenSSF report returned; coverage is unknown. Evidence
Execution: unknown. Not installed or executed. Read-only metadata and source inspection; not a security audit or personal endorsement. Evidence
Repository age: observed. Created 2026-04-16 (187 days before this check). Repository age is not a safety rating. Evidence
Contributor coverage: observed. 57 identified contributors returned by GitHub; anonymous contributors excluded and this request is capped at 100. This is not a complete ownership or bus-factor audit. Evidence
Owner account: observed. GitHub owner account created 2019-05-10. Account age does not verify identity, current control or a matching project name. Evidence
Star history: observed. GitHub returned a completed weekly history bucket (2026-10-11 to 2026-10-17). A sharp rise alone is not evidence of purchased stars or malicious code. Evidence
Before you try it: attention. The README describes installable scripts, website-based brand matching and marketplace updates. Review PRIVACY.md and the selected scripts before allowing network access; a generated HTML file can contain active content. Evidence
Turn HTML, CSS and timed media into video. Interesting for repeatable launch clips and explainers where the data changes more often than the layout.
Total stars: 68655. Source-week gain: 5895. Star History reports this gain for 2026-10-12 to 2026-10-18; not independently measured. GitHub total checked separately.
Live chart from Star History. Attention is not a safety verdict.Open Star History
Check before you run
Test a tiny local render with your own assets. Review lifecycle hooks and the chosen rendering package before installing dependencies.
Source review: 2026-10-21. Code not executed; not a security audit.
Feed three approved release notes into a fixed 15-second title-and-screenshot template. Keep dates and links in a matching text transcript.
First move: Use three invented release notes and owned screenshots to author one HTML composition before automating any input feed.
You need: Node.js 22 or newer, per the README; A reviewed rendering setup; Rights-cleared screenshots and audio, if used
Worth keeping if: The exported clip contains all three correct updates, readable titles and the intended duration. Re-rendering does not move elements unexpectedly.
An onchain explainer, without the price call
Animate how a swap fee or liquidation threshold works using fixed fictional numbers. Export a short learning clip rather than a trading recommendation.
First move: Write a five-line calculation with a checked answer. Turn only those steps into a timed composition.
You need: A verified educational calculation; A small HTML/CSS composition; No wallet connection or live account data
Worth keeping if: Every displayed number matches the worksheet; fictional inputs are labelled and the final frame explains the mechanism without a buy/sell claim.
Evidence and unknowns
Licence: observed. GitHub identifies Apache-2.0. Read the licence and check model, media and dependency terms separately. Evidence
Install surface: attention. Root package lifecycle hooks: prepare. Only README and root files inspected; nested packages, binaries and dependencies are not audited. Evidence
Public advisories: observed. 0 published repository advisories returned. This does not check transitive dependencies or prove safety. Evidence
OpenSSF coverage: unknown. No usable OpenSSF report returned; coverage is unknown. Evidence
Execution: unknown. Not installed or executed. Read-only metadata and source inspection; not a security audit or personal endorsement. Evidence
Repository age: observed. Created 2026-03-10 (225 days before this check). Repository age is not a safety rating. Evidence
Contributor coverage: observed. 100+ identified contributors returned by GitHub; anonymous contributors excluded and this request is capped at 100. This is not a complete ownership or bus-factor audit. Evidence
Owner account: observed. GitHub owner account created 2020-05-15. Account age does not verify identity, current control or a matching project name. Evidence
Star history: observed. GitHub returned a completed weekly history bucket (2026-10-11 to 2026-10-17). A sharp rise alone is not evidence of purchased stars or malicious code. Evidence
Before you try it: attention. The root package has a prepare lifecycle hook and the repo contains nested packages. The README also offers skills that install other workflows on demand. Neither the nested install graph nor those downloaded workflows was audited here. Evidence
A plugin-based agent harness in developer preview. A place to test a narrow agent workflow, with more setup and permission decisions than a drop-in chatbot.
Total stars: 256169. Source-week gain: 6193. Star History reports this gain for 2026-10-12 to 2026-10-18; not independently measured. GitHub total checked separately.
Live chart from Star History. Attention is not a safety verdict.Open Star History
Check before you run
Read SAFETY.md and the plugin permissions before running it. The README warns of breaking changes and the root package contains a postinstall hook.
Source review: 2026-10-21. Code not executed; not a security audit.
Give an agent a small fixture of public release notes and ask for a source-linked change digest. Keep publishing outside the experiment.
First move: Review the safety notice, then design a plugin contract that returns three local fixture records and exposes no shell or write action.
You need: Node.js and a reviewed harness setup; A model connection with an explicit test budget; A disposable environment with read-only fixtures
Worth keeping if: Each output claim points to a fixture record, missing details stay unknown and no tool can post or modify files outside the sandbox.
A permission regression playground
Test whether a proposed business agent asks for approval before a write, using fake email and CRM tools that only log attempted actions.
First move: Specify one allowed lookup and one forbidden update. Build fake tool responses before connecting any real integration.
You need: Reviewed plugin and permission behavior; Synthetic records only; A test log and explicit expected outcomes
Worth keeping if: The lookup completes; the update remains blocked until the test supplies authorization. Tool logs, not the agent's narration, establish the result.
Evidence and unknowns
Licence: observed. GitHub identifies MIT. Read the licence and check model, media and dependency terms separately. Evidence
Install surface: attention. Root package lifecycle hooks: postinstall. Only README and root files inspected; nested packages, binaries and dependencies are not audited. Evidence
Public advisories: observed. 0 published repository advisories returned. This does not check transitive dependencies or prove safety. Evidence
OpenSSF coverage: unknown. No usable OpenSSF report returned; coverage is unknown. Evidence
Execution: unknown. Not installed or executed. Read-only metadata and source inspection; not a security audit or personal endorsement. Evidence
Repository age: observed. Created 2026-08-13 (68 days before this check). Repository age is not a safety rating. Evidence
Contributor coverage: observed. 44 identified contributors returned by GitHub; anonymous contributors excluded and this request is capped at 100. This is not a complete ownership or bus-factor audit. Evidence
Owner account: observed. GitHub owner account created 2023-10-18. Account age does not verify identity, current control or a matching project name. Evidence
Star history: observed. GitHub returned a completed weekly history bucket (2026-10-11 to 2026-10-17). A sharp rise alone is not evidence of purchased stars or malicious code. Evidence
Before you try it: attention. The maintainers call this a developer preview and explicitly warn about compatibility changes. The README points to SAFETY.md; that notice and the actual plugin implementation need review before a test. Do not attach a real wallet, production key or customer folder. Evidence
A Rust PDF workbench with page operations, a CLI and optional agent control. The README calls it alpha, so start with copies of boring documents.
Total stars: 16727. Source-week gain: 6045. Star History reports this gain for 2026-10-12 to 2026-10-18; not independently measured. GitHub total checked separately.
Live chart from Star History. Attention is not a safety verdict.Open Star History
Check before you run
Try duplicate, non-sensitive PDFs. Check exported files in a second reader; keep agent control and confidential documents out of the initial test.
Source review: 2026-10-21. Code not executed; not a security audit.
Combine a short guide and appendix into one PDF, then split a sample packet by section for different readers.
First move: Use two public-domain sample documents and compare the merged page count and order with a written manifest.
You need: A reviewed official build, or Rust 1.95+ for source builds per the README; Copies of sample PDFs; A second PDF reader
Worth keeping if: Page count, order, links and form fields match the manifest in both readers. Original files remain byte-for-byte unchanged.
A document preflight receipt
Explore a local assistant that inspects a PDF's pages, forms and metadata before handing it to a human. Keep this as a report, with no automatic edits.
First move: Use a synthetic form PDF with known page count and fields. Review the CLI or automation tool contract, then request inspection only.
You need: A sandboxed reviewed CLI; A synthetic PDF with expected metadata; No enabled write or UI-control tools
Worth keeping if: The report matches the fixture and clearly separates supported checks from unknowns. No document is modified or sent to a cloud service.
Evidence and unknowns
Licence: observed. GitHub identifies Apache-2.0. Read the licence and check model, media and dependency terms separately. Evidence
Install surface: unknown. Root package manifest unavailable or absent. Only README and root files inspected; nested packages, binaries and dependencies are not audited. Evidence
Public advisories: observed. 0 published repository advisories returned. This does not check transitive dependencies or prove safety. Evidence
OpenSSF coverage: unknown. No usable OpenSSF report returned; coverage is unknown. Evidence
Execution: unknown. Not installed or executed. Read-only metadata and source inspection; not a security audit or personal endorsement. Evidence
Repository age: attention. Created 2026-09-30 (20 days before this check). Repository age is not a safety rating. Evidence
Contributor coverage: observed. 100+ identified contributors returned by GitHub; anonymous contributors excluded and this request is capped at 100. This is not a complete ownership or bus-factor audit. Evidence
Owner account: observed. GitHub owner account created 2021-01-03. Account age does not verify identity, current control or a matching project name. Evidence
Star history: observed. GitHub returned a completed weekly history bucket (2026-10-11 to 2026-10-17). A sharp rise alone is not evidence of purchased stars or malicious code. Evidence
Young repo, fast attention: attention. This repository is less than 30 days old and the weekly source reports over 1,000 new stars. Review maintainer identity and code before a small isolated test; this does not establish manipulation. Evidence
Before you try it: attention. The README calls the app alpha and describes an opt-in MCP/control surface. This review did not test its isolation or PDF handling. Copy originals before edits and verify any redaction separately; a black rectangle is not proof of removal. Evidence
Before you try it: attention. The README separates the ArtCraft name and logo rights from the software licence. A fork cannot assume the brand assets are covered by the code licence. Evidence