Abstract
GitHub Trending's weekly ranking, read on November 2, 2026, lists 16 projects. Thirteen of them are Skills, plugins or companion tools built for coding agents such as Claude Code, Codex and Cursor. All three top entries are Skills. Impeccable gained about 12,000 stars this week as a design-vocabulary and "AI-flavor" detection rule set. Hallmark from Together AI added about 11,600 stars with a "pages should not look AI-generated" stance. Cloudflare's open-source security-audit-skill added about 10,000 stars, turning the seed of its internal vulnerability-hunting system into a six-stage security-audit Skill. The week's main line is clear: the community is no longer comparing only which model is stronger. It is comparing who can give agents better craftsmanship: aesthetics, security auditing, SEO, and cross-session memory.
1. The Weekly Signal: Skills over Raw Model Power
The GitHub weekly hotlist is the GitHub Trending ranking sorted by stars added in the current week. The edition read on November 2, 2026 contains 16 projects. Of those, 13 serve the coding-agent ecosystem.
The distribution itself is the story. Skill-based extensions now outnumber raw model releases in community attention. Most of these Skills install with a single npx skills add command, but at runtime they consume the model quota of the agent's own configuration. Some single runs can burn hundreds of thousands of tokens. The popularity of Skills is therefore also a statement about where the ecosystem believes the leverage sits: not in the model alone, but in the working method loaded on top of it.
2. The Top Twelve by Weekly Stars
Sorted by stars added this week, the top twelve are:
- pbakaus/impeccable: +12,017
- nutlope/hallmark: +11,566
- cloudflare/security-audit-skill: +10,069
- pingdotgg/3code: +6,926
- aftan-m/ECC: +6,299
- obra/superpowers: +5,896
- thedotstack/claude-mem: +5,852
- JetBrains/thinkrail: +5,760
- TauricResearch/TradingAgents: +5,432
- Leonxlnx/taste-skill: +5,336
- AndrejDaniel/claude-seo: +5,034
- multica-ai/andre-karpathy-skills: +4,459
The set spans five categories: design de-AI, security auditing, agent working methods, memory and IDE, and vertical domains. The design category dominates the top. Impeccable and Hallmark together account for the two largest weekly gains, and taste-skill adds a third design entry further down the list.
3. The Weekly List at a Glance
By weekly stars, the 16 projects fall into five categories. The leading entries show both weekly gains and total star counts:
- Design "de-AI": pbakaus/impeccable +12,017 (total 99,417); Nutlope/hallmark +11,566 (44,950); Leonxlnx/taste-skill +5,336 (107,848); jakubkrehel/skills +1,607 (10,106)
- Security auditing: cloudflare/security-audit-skill +10,069 (56,442)
4. The Three Head Projects Take Different Approaches
The top three design Skills each solve the same problem differently.
4.1 Impeccable: A Design Vocabulary
Impeccable (Apache-2.0) is a set of "design words". It provides 24 commands such as bolder, quieter, polish, critique and audit, letting the user direct one kind of change with a single word. It also ships 62 deterministic rules for detecting AI flavor. Those rules do not call a model and do not require an API key. Impeccable is better at modifying existing pages. The latest version, cli-v4.8.0, was released on October 26.
The model-free rules are the notable part. A design tool that detects "AI-ness" without invoking a model means the detection is reproducible and cheap to run at scale. There is no hidden prompt, no vendor dependency, and no per-check token cost. That design choice is what makes the 62 rules a reusable asset rather than a wrapper around another model.
4.2 Hallmark: A Generator with Hard Bottom Lines
Hallmark (MIT, from Together AI) is a generator with hard constraints. It bundles 50 theme material sets plus 755 openly licensed photos. After building, it runs a soplint check across 8 widths. Contrast, focus states, mobile layout and fabricated facts are treated as bottom lines. If a page does not meet them, it is not delivered.
4.3 taste-skill: Direction First, Then Build
taste-skill (MIT) is based on a study of 247 hand-picked websites. It establishes a direction first, then looks for "an idea that belongs only to this client", and finally screenshots itself and fixes the first three problems, with at most three iterations. The README is explicit that one build takes roughly 30 to 45 minutes and consumes hundreds of thousands of tokens.
4.4 The Shared Discipline
The common thread across all three is discipline rather than model capability. They all require real material and refuse to fabricate numbers. They all check the finished product in a real browser, rather than letting the model claim it "looks good".
5. Cloudflare's Security-Audit Skill: Six Stages of Vulnerability Hunting
cloudflare/security-audit-skill is the original seed of Cloudflare's vulnerability-hunting system. The README states that the system later expanded into a multi-stage system covering the whole company, described in the Cloudflare blog post "Build your own vulnerability harness". This Skill is the single-repository starting point of that system.
Its core design is that every stage is re-checked by a fresh, independent agent:
- Reconnaissance: map the architecture, trust boundaries and input surface, and write architecture.md and a coverage ledger.
- Coverage-guided hunting: dispatch mutually isolated hunter agents according to the ledger, and let a "coverage review" find places that were missed.
- Candidate validation: hand each suspected vulnerability to a new agent whose task is to disprove it.
- Structured output: split results into confirmed, pending and rejected, and validate against a JSON Schema.
- Record review: dispatch another new agent to verify the source code referenced by the final conclusion.
- Report: generate the report from the reviewed records.
Runs are cumulative. A second run works against the previous ledger to fill gaps. The Skill ships 11 hunting prompts classified by attack surface, covering web protocols, supply chains, cloud deployment and LLM prompt injection. It can be installed with one line: npx skills add ... --skill security-audit.
The "every stage gets a fresh agent" rule is the architectural point. The finder and the verifier are deliberately separated. A new agent that inherits none of the finder's context is less likely to confirm a plausible-looking hypothesis just because it was framed convincingly. Falsification is an explicit assignment, not an afterthought. This mirrors the separation of duties that security teams impose on human reviewers, and it is enforced by process rather than by trust.
6. Other Projects Worth Watching
Beyond the top three, several projects carry strong signals.
JetBrains ThinkRail is an incubation project, created only in July, that gained 5,760 stars this week. It wraps the open-source coding agent pi into a lightweight IDE. Each task gets a git worktree workspace, so multiple agents run in parallel without interfering. Project intent is written into a set of SPEC.md files and preserved across sessions.
claude-mem has crossed 109,000 total stars and stays on the list. It compresses each agent tool call into an observation record and injects those records by index into the next session.
claude-seo contains 26 sub-Skills and 19 dedicated agents. A full SEO audit takes about 10 to 15 minutes. One dedicated check evaluates how likely a page is to be cited by AI search products such as Google AI Overviews, ChatGPT and Perplexity.
andrej-karpathy-skills contains only a single CLAUDE.md file, yet holds 228,000 total stars. A well-written behavior specification is itself in high demand.
7. Hands-On: Install This Week's Skills with One Command
Most Skills on this week's list support Vercel's npx skills command-line tool, which works across Claude Code, Codex, Cursor and OpenCode. Node 18 or higher is required.
- Design Impeccable (run in the project root; after install, reload tools and run /impeccable init): npx impeccable install
- Design Hallmark (-g means global install): npx skills add npm:@hallmark -g
- Design taste-skill (requires Node 22+ and a local Chrome): npx skills add https://github.com/Leonxlnx/taste-skill --skill "design-taste-frontend"
- Security audit Cloudflare security-audit-skill: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global
Interactive commands after install:
- /impeccable critique the pricing cards
- /hallmark audit ./index.html
The security-audit Skill does not need a special command. In the repository to be audited, start the agent and say "run a security audit on this repository".
8. Where the Tokens Go: Runtime Cost Is Real
These Skills run on the model already configured for the agent. Security audits and multi-round design iterations spawn multiple sub-agents, so token consumption jumps sharply. A heavy run can reach tens of thousands of tokens.
The billing model matters here. Skills are not free computation; they are instruction sets that multiply the agent's model usage. A single design iteration reported at hundreds of thousands of tokens means the cost of "de-AI design" is dominated by model spend, not by the Skill file itself.
When such workloads need to point at different model backends, or when several Skills and agents share one budget, a consistent routing and metering layer becomes necessary. An API gateway such as 4sapi lets a team set a custom base URL with an OpenAI-compatible endpoint, so agents and Skills call the same interface regardless of which provider sits behind it, while usage and spend are tracked in one place.
9. Two Things to Check Before Installing
Skills execute scripts with your permissions. Impeccable's live mode runs the validation script specified in package.json; the README warns to inspect it before use in an unfamiliar repository. Hallmark's browser check needs puppeteer-core and Chrome. For a Skill of unknown origin, read SKILL.md and the scripts directory first.
Do not stack same-kind Skills. The three design Skills have conflicting rules, and enabling them together can leave the agent torn between contradictory guidance. Pick one, run it on a few pages, compare the effect, and then decide.
10. Frequently Asked Questions
Q: Where is the GitHub hotlist, and what is the difference between weekly and monthly rankings?
A: The weekly ranking sorts by stars added this week and better reflects sustained attention. This article uses the weekly ranking.
Q: What is the difference between a Skill and an Agent service?
A: A Skill is a small functional module that does not need its own process. Its core is a single SKILL.md, which provides tools to the agent through a protocol. For work like design and auditing that does not need extra capability, a Skill is lighter. An Agent service is used when the task must connect to an external system independently.
Q: Why do these Skills cost so many tokens?
A: The Skill itself is text. The cost comes from the model runs it triggers. Design iteration that screenshots and fixes three problems, or a security audit that dispatches fresh agents per stage, multiplies inference calls. A heavy workflow can reach hundreds of thousands of tokens in one build, so the practical budget is set by the model pricing, not by the Skill install.
11. Summary
In the first week of November 2026, the GitHub weekly ranking put coding-agent Skills in the top three spots, and 13 of the 16 listed projects serve the agent ecosystem. "De-AI" design is the hottest direction. Impeccable, Hallmark and taste-skill represent three different ideas: a design vocabulary, a hard-bottom-line generator, and a "decide direction before building" flow. Cloudflare turned the seed of its internal vulnerability-hunting system into a six-stage audit Skill, which is the project most worth attention from engineering teams this week.
The ranking has a deeper implication. The spread of Skills is a shift in where value is created in the agent stack. Model quality still matters, but the marginal leverage is moving to the working methods, checklists and safety flows that surround the model. A design Skill that refuses to fabricate numbers, an audit Skill that re-checks every claim with a fresh agent, and a memory Skill that compresses tool calls into indexed observations are all examples of the same idea: the product is not the model, it is the disciplined process around the model.
Star counts were read on November 2, 2026. The hotlist changes daily, and install commands should follow the latest instructions in each repository README.
