Agent Skills Took Over GitHub Trending. Read One Before You Install It.
Nine of the 16 repos on GitHub’s weekly trending list this week are skills or harness add-ons for coding agents. What the big ones do, and the five-minute check I run before adding any of them.Image generated with ChatGPTGitHub’s weekly trending page on November 2 had 16 repositories on it. Nine of…
Annons
Annons
Nine of the 16 repos on GitHub’s weekly trending list this week are skills or harness add-ons for coding agents. What the big ones do, and the five-minute check I run before adding any of them.Image generated with ChatGPTGitHub’s weekly trending page on November 2 had 16 repositories on it. Nine of them were skills, or harness add-ons built from skills, for coding agents like Claude Code, Codex, Cursor, and OpenCode.A note on how this was made: I wrote it with help from Claude, Anthropic’s AI model, and checked each claim against the linked READMEs. The images were generated with ChatGPT.The top two repos this week teach agents to design web pages. The fifth is Cloudflare’s skill for running a security audit with sub-agents.I read the READMEs of the ones getting the most stars. Below is what each does, and the check I now run before installing any of them.What a skill actually isA skill is a folder with a SKILL.md file in it. The file starts with YAML frontmatter, a name and a description, followed by Markdown instructions. It can also ship scripts and other files.---name: my-skill-namedescription: A clear description of what this skill does and when to use it---# My Skill Name[Instructions Claude will follow when this skill is active]That’s the format from Anthropic’s skills repo, which also holds the spec. The agent reads the descriptions of everything installed, and when a task matches one, it loads the full instructions and follows them.Image generated with ChatGPTTwo install paths cover most agents. Claude Code has plugin marketplaces (/plugin marketplace add owner/repo, then /plugin install). Vercel Labs' skills CLI works across agents, about 79 by its own count, and installs from GitHub:npx skills add owner/repoIt installs into the current project by default, or for every project with -g.What’s trending this weekStar counts below are totals and weekly gains from GitHub’s trending page on November 2, 2026.Superpowers: a development process, not a single trick310,794 stars, +5,896 this week. Jesse Vincent’s Superpowers is a set of skills that trigger on their own and walk the agent through a full workflow. It brainstorms with you and writes a design document before any code, then creates a git worktree and checks for a clean test baseline.Then it writes a plan of 2 to 5-minute tasks with exact file paths and verification steps. It either hands each task to a fresh sub-agent with a review after each, or runs them inline with one review at the end. Test-driven development is enforced: failing test first, then the code./plugin install superpowers@claude-plugins-officialIt supports Claude Code, Codex, Cursor, Gemini CLI, OpenCode and about a dozen more, with a separate install per harness. If you install only one thing from this list, this is the one that changes how the agent works on every task.Hallmark and Impeccable: making agents worse at generic designHallmark has 45,201 stars and gained 11,566 this week. Impeccable has 99,684 and gained 12,017. Both exist because agent-built web pages tend to look the same: the same gradient, the same card grid, the same hero.Hallmark, from Together AI, reads your project’s existing fonts, palette and framework first. It asks for real photos and numbers instead of inventing them, and builds and reviews the hero section before the rest of the page. A linter called sloplint checks the rendered page at eight screen widths, and a fresh-context sub-agent reviews it.npx skills add nutlope/hallmark -gImpeccable takes the vocabulary route, giving the agent design terms and commands to critique, audit and polish a UI. It’s one of the skills installed in my own setup.Cloudflare’s security-audit skill: the agent that checks isn’t the agent that found it56,642 stars, +10,069 this week. This is the starting point of the vulnerability-discovery harness Cloudflare uses internally, published as a single-repo skill. It runs six phases: reconnaissance, coverage-led hunting, validation, structured output, independent verification and reporting.The rule I’d copy into my own setups: a finding is never verified by the agent that found it. A fresh verifier tries to disprove each candidate, and findings land in findings.json as confirmed, needs-validation or rejected, checked against a schema.npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditIt needs an agent with parallel sub-agents, and target code must run in an OS-level sandbox with no network. Without one, the skill doesn’t execute target code and leaves those leads as needs-validation. Cloudflare’s own test runs say one run finds about half of what repeated runs find, so plan on more than one.claude-mem: memory across sessions, with strings attached109,811 stars, +5,852 this week. claude-mem hooks six points in a Claude Code session, compresses what the agent did into summaries with a model, and stores them in local SQLite with full-text and vector search. Later sessions get the relevant parts back through MCP search tools.Two details worth knowing before you install it. The installer asks you to sign in by email for a hosted “observer” with a 30-day trial, and in that mode your session content is processed off your machine. You can skip sign-in with --provider or CLAUDE_MEM_ONLINE_OPTIN=false.The README also has a section about a third-party crypto token that the author has “officially embraced.” That has nothing to do with the software, so I’d weigh it separately.The Karpathy CLAUDE.md: four rules in one file228,157 stars, +4,459 this week. This is a single CLAUDE.md built from Andrej Karpathy's posts about how LLMs go wrong when they code.It’s a community project, not written by Karpathy. The four rules: think before coding and state assumptions, write the minimum code, make surgical changes only, and turn tasks into checks you can verify.There’s one oddity. The repo on the trending page is multica-ai/andrej-karpathy-skills, but its install commands point at forrestchang/andrej-karpathy-skills.That may be an innocent rename or fork. It’s also exactly the thing to check before you run an install command.Also on the listclaude-seo (25,685 stars) bundles 26 SEO sub-skills and 19 agents for Claude Code. taste-skill (108,062) does art direction for web pages.Anthropic’s own skills repo (186,472) has the spec and examples. ECC (294,975) is a whole harness of skills, memory and research workflows.One trending repo this week describes itself as a jailbreak harness that swaps prompts per model. Popularity on that page isn’t an endorsement.Read a skill before you install itImage generated with ChatGPTA skill is a set of instructions your agent will follow, sometimes with scripts it will run, using your permissions on your machine. Installing one is closer to adding a dependency with a postinstall script than to installing a theme. This is the check I run, and it takes about five minutes.Read the SKILL.md and every script. The description decides when the skill fires. Look for anything that reaches outside the task: network calls, reading files outside the project, editing your agent’s settings or other skills.Check that the install command points at the repo you’re reading. The Karpathy repo above is the example. Run the command against the owner and name you actually reviewed.Install into the project, not globally. A project install only affects that repo. Use -g once you trust a skill enough to have it active everywhere.Look at what leaves your machine. claude-mem’s hosted observer is opt-out. The skills CLI collects anonymous telemetry unless you set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1. Neither is hidden, but neither is the default you'd pick.Pin a version. Skills update quietly. Install from a tag or commit when the tool allows it, and re-read the diff before you update.The better skills on this list make this easy. claude-seo’s README tells you to download its install script, cat it and only then run it. Cloudflare's skill refuses to execute target code without a sandbox.What I’d installFor a general coding setup: Superpowers for the workflow, plus the four-rule CLAUDE.md copied into your own file (it's short enough to read in a minute). If you build front ends, add Hallmark or Impeccable. If you maintain anything with users, run Cloudflare's security audit on it once, in a sandbox, and read what it finds.I’d skip anything whose README asks for an account before it explains what it sends.Next in my Rust for AI series: a Rust embedding service and a Python one side by side, measuring what the Rust version saves. Which skill are you running that isn’t on this list?SourcesGitHub trending, weeklyanthropics/skillsvercel-labs/skillsobra/superpowersNutlope/hallmarkcloudflare/security-audit-skillthedotmack/claude-memmultica-ai/andrej-karpathy-skillsAgriciDaniel/claude-seoThis story is published under the Generative AI publication. Connect with us on LinkedIn and follow Zeniteq to stay in the loop with the latest AI stories. Let’s shape the future of AI together!Agent Skills Took Over GitHub Trending. Read One Before You Install It. was originally published in Generative AI on Medium, where people are continuing the conversation by highlighting and responding to this story.