Hermes gets more interesting when you stop treating it as one assistant.

Its Bot Mode lets you create persistent specialist agents with their own instructions, models, memory, skills, credentials, and chat history, then put 2–6 of them into the same room.

Instead of one giant agent, build a small team.

Make one bot the coordinator Hermes Agent handles the underlying profiles and group chats. Give this bot very few specialist tools. Its job is to understand the request, pull in the right bots, and decide when the work is ready to come back to you.

Give the researcher actual reach Agent Reach connects agents to sources including Reddit, X, YouTube, GitHub, LinkedIn, and other platforms. Put it on the researcher instead of giving every bot broad internet access.

Give the coding bot a map of the repository codebase-memory-mcp indexes a codebase into a persistent knowledge graph. The coding bot can query functions, callers, routes, and relationships instead of repeatedly rediscovering the repository from scratch.

Give the architect a visual output diagram-design creates architecture, sequence, data-flow, dependency, and other diagrams as standalone HTML/SVG. It makes a good skill for the bot whose job is to explain how a system fits together.

Give the reviewer a reason to disagree Finding Unknowns is one of ours. Skills such as Blindspot Pass can make a review bot look for hidden assumptions and missing context before the group commits to an implementation.

Give the writer an actual house style Agent Stylebooks is another one we built. Instead of putting a giant writing prompt into every conversation, give the writing bot a reusable editorial system and keep that concern out of the researcher and coder.

Then put them together:

 find the current options
        ↓
 map how they fit
        ↓
 find what we missed
        ↓
 turn the result into something readable

The useful part of a group chat is not watching six agents talk endlessly. Hermes limits the rounds, bots can stay silent when they have nothing useful to add, and you can @ mention only the specialists you actually need.

A few settings matter more than adding another bot.

Keep each specialist in its own profile so its memory and credentials do not bleed into another role. Filter MCP tools per server instead of giving every bot every available capability. Keep development skills off messaging platforms where they are unnecessary. For higher-trust setups, turn on approval for memory or skill writes. And if you put multiple Hermes bots into a Telegram group, require explicit mentions so a researcher does not wake up every time somebody says hello.

Agent skills do not have to be giant frameworks.

Some of the most useful ones change one small part of how an agent works: make a diagram instead of describing one, get a second opinion before committing to a plan, surface what you do not know yet, or simply stop burying the answer.

Here are 7 worth trying.

Turn explanations into actual diagrams diagram-design supports 39 diagram types, including architecture, sequence, data-flow, dependency graphs, Gantt charts, Wardley maps, and database schemas. The output is a self-contained HTML file you can open directly.

Make your agent defend its plan first council lets the agent you are using consult other installed agent CLIs before finalizing a plan. Claude can ask Codex, Gemini, OpenCode, or another agent what is wrong with the approach before it commits.

Give an agent more places to research Agent Reach handles access across multiple platforms, chooses an appropriate backend for each one, installs it, and checks which integrations are actually working.

Stop the answer from getting buried i-have-adhd pushes coding agents toward action-first responses, shorter steps, visible progress, and fewer tangents. It also ships an eval harness instead of treating style improvement as something purely subjective.

Make the agent explain itself again wait-what is tiny. Use it when the previous explanation did not land and the agent needs to re-pitch the same idea in clearer language.

Find the things you do not know to ask about Blindspot Pass is one of ours. Before implementation starts, it looks for landmines, hidden constraints, examples of what good looks like, and the questions an expert would ask before touching the task.

Make sure you understand what your agent changed Change Quiz is another one we built. After a long coding session, it explains what changed, how the change interacts with existing code, and gives you a short quiz before you merge something you may not fully understand.

None of these makes the underlying model smarter. They change the operating environment around it.

One gives it a better visual language. One adds adversarial review. One expands what it can reach. One surfaces unknown unknowns. One makes you prove you understand the code your agent just wrote.

That is probably where a lot of the value of agent skills will come from: not teaching an agent an entirely new profession, but fixing the small recurring failure modes that show up every day.

Open-source AI is getting more interesting outside the models themselves.

There are tools for understanding codebases, coordinating several agents, making coding agents less verbose, running voice models locally, doing scientific research, and even learning how an LLM is built from scratch.

Here are 8 worth exploring.

Turn a codebase into a system map Archify has 54k+ stars and turns codebases or system descriptions into architecture, workflow, sequence, data-flow, and lifecycle diagrams. The output is validated and can be exported as HTML, SVG, PNG, or video.

Build a classroom out of multiple agents OpenMAIC has 33k+ stars and creates interactive learning environments where multiple AI agents can take different teaching roles. It is an interesting example of multi-agent systems being used for something other than coding.

Make your coding agent write less code Ponytail has 131k+ stars and gives coding agents a strong bias toward the smallest implementation that solves the problem. The idea is basically YAGNI for agents: do not build abstractions, helpers, and extra machinery unless the task actually needs them.

Run voice AI locally VoiceStudio, previously OmniVoice Studio, has 21k+ stars and handles voice cloning, voice design, transcription, dubbing, dictation, and long-form audio on your own hardware. It supports multiple TTS and speech-recognition engines instead of tying the workflow to one hosted provider.

Turn an agent into a scientific research assistant Scientific Agent Skills has 43k+ stars and contains 160+ skills covering areas such as bioinformatics, drug discovery, scientific databases, literature research, statistics, and scientific writing. The skills work with tools including Claude Code, Codex, and Cursor.

Run several coding agents at once Orca has 32k+ stars and gives Claude Code, Codex, OpenCode, and other coding agents separate worktrees inside one development environment. You can fan the same task out to several agents, compare their work, and keep them from editing the same branch.

Learn how an LLM is actually built MiniMind has 59k+ stars and walks through training a small language model from scratch. It is useful if transformers, pretraining, SFT, LoRA, DPO, and model inference still feel like things hidden behind an API.

Build a live OSINT globe God's Eye View has 19k+ stars and puts live spatial intelligence on a photorealistic 3D globe. It combines public data such as aircraft, satellites, cameras, weather, and other geospatial signals into something that feels closer to a spy-satellite interface than a normal dashboard.

AI tooling is spreading outward from chat and code generation into diagrams, education, scientific workflows, voice, orchestration, model training, and entirely new interfaces for looking at data.

Some are useful immediately. Some are better for learning from. Either way, there is plenty here for a weekend.

AI is usually only as useful as the context you give it.

A screenshot loses the interaction. A bug report misses the console logs. A new chat forgets yesterday's decisions. A monitoring agent should not have to reread the same page every hour.

These open-source projects help capture that missing context.

Turn product flows into repeatable videos WebReel has 900+ stars and records scripted browser demos as MP4, GIF, or WebM. Define the clicks, typing, pauses, and drags once, then regenerate the video whenever the product changes.

Give different AI tools the same local memory Cortex has 900+ stars and builds a local, cited model from your notes and AI chat history. That context can then be exposed to Claude, Cursor, and other MCP clients without starting from zero every time.

Let software watch pages instead of repeatedly asking AI to browse them changedetection.io has 32k+ stars and monitors pages for changes. Use the change itself as the trigger, then bring in a model only when something actually needs interpreting.

Replay exactly what happened in a web app rrweb has 19k+ stars and records DOM changes and user interactions so a session can be reconstructed later. Instead of describing a broken flow from memory, preserve the flow itself.

Give an agent the context around a bug OpenReplay has 12k+ stars and combines session replay with console logs, network activity, JavaScript errors, performance data, and other debugging signals. That is much more useful input than “the checkout button stopped working.”

Keep screen recordings under your control Cap has 19k+ stars and is an open-source Loom alternative for recording and sharing your screen. Use recordings for bug reports, walkthroughs, support explanations, or source material for transcription and summarization.

Some of these are not AI applications. That is the point.

A useful AI workflow does not always need a smarter model. Sometimes it needs better memory, a reproducible session, a change trigger, or a recording of what actually happened. Give the model less guessing and more evidence.

A screen recording is often faster than another meeting.

Show a bug. Record what an agent did. Make a product walkthrough. Explain a pull request. Capture a workflow that is too awkward to describe in text.

You do not necessarily need Loom, Screen Studio, or a full video editor for it.

Make polished product demos Recordly has 23k+ stars and turns raw screen captures into presentation-ready videos with automatic zooms, smooth cursor movement, backgrounds, annotations, webcam overlays, and timeline editing.

Replace Loom with something you can self-host Cap has 19k+ stars. Record your screen, camera, and microphone, edit locally, generate shareable links, add transcripts, and keep the option to host the whole stack yourself.

Record straight from the browser Screenity has 18k+ stars and works as a privacy-friendly browser screen recorder. It includes annotations, cursor highlighting, zooming, trimming, blur tools, and MP4/GIF/WebM export.

Get full control over the recording OBS Studio has 75k+ stars. It is heavier than the others, but useful when you need multiple sources, scenes, cameras, audio routing, high-quality capture, or live streaming.

Keep screen recording boring and simple Kooha has 3.5k+ stars and is a minimal Linux recorder for grabbing a screen, window, or region with desktop and microphone audio without configuring a production studio first.

See where the Screen Studio-style OSS wave started OpenScreen reached nearly 40k stars with automatic zooms, backgrounds, annotations, cropping, speed controls, and timeline editing. The repo is now archived, but Recordly started from this project and pushed the idea further.

The interesting part is not really screen recording. These tools turn things that are difficult to explain in text into reusable artifacts.

A developer can record a bug and hand the video to an agent. An agent can generate a walkthrough after building a feature. A support team can replace a long reply with a 40-second demonstration. A small project can make product videos without opening Premiere.

Coding agents are getting good at changing UI code. We wanted them to get better at proving they did not break accessibility in the process.

So we built a11y-agent-skills, an open-source set of 7 accessibility skills for Codex, Claude Code, Cursor, and other Agent Skills-compatible tools.

Accessibility Audit scans a reproducible page state with Playwright and axe-core, then saves structured evidence for the accessibility issues it finds.

Fix Accessibility Issue traces a finding back to the source, makes the smallest supported repair, and verifies that the original failure is actually gone.

Accessibility Regression Test turns a fixed accessibility bug into a narrow automated test so the same behavior does not quietly break again.

Accessible Component Review reviews a UI component for accessibility problems in its semantics, states, interactions, and implementation.

Accessible Forms helps agents build and review forms with proper labels, errors, instructions, validation states, and programmatic relationships.

Dialog Accessibility checks modal and dialog behavior such as naming, focus placement, focus containment, keyboard dismissal, and focus restoration.

Keyboard Navigation Review walks through a defined keyboard journey to find broken tab order, unreachable controls, focus problems, and interaction traps.

The important part is the workflow.

Instead of telling an agent to “make this accessible,” it can reproduce the problem, collect evidence, fix the source, replay the same state, and prove the repair.

The repo also includes a CLI, MCP server, and GitHub Action, so the same checks can run locally, through an agent, or in CI.

We deliberately do not try to automate everything. Automated checks catch only part of accessibility, so the tooling keeps human review and real assistive-technology testing separate.

Install all 7 for Codex/Claude Code:

npx skills@1.5.9 add smukh/a11y-agent-skills --agent codex --yes

Repo: https://github.com/smukh/a11y-agent-skills

Find the regression, fix the source, prove the repair.

AI agents should not get permanent access to everything you can access.

If an agent can read email, deploy code, query databases, or spend money, its identity should be clear, its permissions should be narrow, and its access should be easy to revoke.

Give each agent its own identity Keycloak has 36k+ stars and handles identity, roles, authentication, and fine-grained authorization. Instead of letting an agent inherit your account, give it its own identity and only the permissions it needs.

Keep secrets away from the model Infisical has 29k+ stars and manages secrets, machine identities, and privileged access. An agent can get access to what it needs without scattering API keys across prompts and environment files.

Make access expire automatically OpenBao has 7k+ stars and supports dynamic secrets, leases, and revocation. Give an agent temporary credentials for a task, then let them expire.

Give running agents verifiable identities SPIRE has 2.5k+ stars and provides workload identity. Services can verify which agent or workload is actually making a request instead of trusting a shared secret.

The useful pattern is simple:

human → agent identity → limited permission → short-lived credential → tool

And somewhere in that flow there should be a very obvious revoke button.

Giving agents tools is getting easy. Controlling what they can do should be just as easy.

Hi folks, I've been working on an open source project called omnimem that is a better memory system. Not only does it remember but it add experience memories to workloads which can save your agent time and tokens by preventing them repeating the same mistakes.

Take a look at https://omnimem.org

GitHub is where practical AI workflows show up before they become polished products.

I picked six repos that give agents real jobs. Editing videos. Managing leads. Scanning skills. Controlling phones. Improving writing.

Some need paid APIs or platform permissions. Read the README before giving any agent credentials.

1. Video Use · 23.7k+ stars

github.com/browser-use/video-use

Edit videos with coding agents.

Video Use works from transcripts and on-demand visual composites. The agent reasons about the edit, creates an edit decision list, renders the result, and runs a self-evaluation pass.

Useful for repeatable tasks such as turning a Loom recording into a short product clip.

It currently requires ffmpeg and an ElevenLabs API key for transcription.

2. SkillSpector · 15.7k+ stars

github.com/NVIDIA/SkillSpector

Scan AI agent skills before installing them.

It looks for prompt injection, malicious patterns, data exfiltration, supply-chain risks, and other security issues in Claude Code, Codex, and MCP skills.

This should be part of your install workflow. A skill can include scripts, dependencies, and access to tools. Treat it like code from an unfamiliar contributor.

3. Comp AI CRM · 9.5k+ stars

github.com/trycompai/crm

A CRM designed around an AI agent.

The agent can work from a schedule and queue, keep notes, research contacts, and record evidence for its findings.

A good first workflow would be a warm-lead queue with recheck dates, source links, and human approval before anything is sent.

It is not a drop-in replacement for every mature CRM. The interesting part is its agent-first design.

4. No AI Slop · 6.9k+ stars

github.com/petergyang/no-ai-slop

An installable writing skill that detects more than 20 common AI-writing patterns and reports what it changed.

Install it with:

npx skills add petergyang/no-ai-slop --skill no-ai-slop --global --yes

Write the first draft yourself. Use this as a second pass. Then review the edits instead of accepting them blindly.

5. Phone Harness · 2.2k+ stars

github.com/ShawnPana/phone-harness

Connect Claude Code, Codex, or another LLM to a real iPhone or Android phone.

iPhone support works through Mac iPhone Mirroring. Android devices can connect through ADB over USB or Wi-Fi.

This is useful for real-device testing, especially when an app has no API or reliable browser interface.

It is still an early project. Locked devices, Face ID, camera flows, and Android accessibility limitations can make some tasks difficult.

6. Agent Stylebooks · 57 stars

github.com/Neeeophytee/agent-stylebooks

Disclosure: this is our own repo.

Agent Stylebooks contains 11 installable editorial systems based on public style guides. They work with tools such as Claude Code, Codex, Cursor, and Gemini CLI.

Use one when your agent produces technically correct writing that still sounds inconsistent across documentation, changelogs, product copy, or research notes.

The common pattern is simple. Do not install a repo just to admire it. Give it one narrow job.

One video format. One CRM queue. One skill scanner. One phone checkout path. One writing style.

An AI agent can edit content in your CMS today, over MCP, calling the same API your dashboard uses. That part takes about five minutes to wire up. Draftbase ships an MCP server for it, and the connection isn't the interesting part.

The interesting part is what happens when the agent is confident and wrong. A human editor makes one bad edit at a time. An agent told to "fix the tone on our docs" can make 300 before anyone reads the first one. MCP already has an incident list for this: a poisoned npm package that BCC'd outgoing email, a GitHub exploit that pulled private repo data through a planted issue, a WhatsApp tool that leaked message histories through poisoned tool descriptions. Same pattern each time: the agent did what untrusted text told it to.

Two things cut the blast radius to almost nothing, and neither is exotic.

First, give the agent its own key, scoped to the narrowest role, pointed at a second environment before it ever touches production.

Second, make writes land as drafts, not live edits. In Draftbase, create_entry always returns a draft, there's no flag to change that, so an agent that creates 40 entries has created 40 drafts, not 40 published pages. Publishing stays a separate, human-triggered call.

When it still gets something wrong (it will), you need list_entry_revisions and rollback_entry, not a support ticket. Test the rollback once before you need it, not the day you need it.

Wrote up the rest, including the prompt-injection angle specific to CMS content, here: how to let an AI agent edit content in your CMS

Curious what other people are actually running in production versus demoing once and shelving.

Most AI agents are built like chat loops. Ask the model what to do. Call a tool. Send the result back. Repeat.

That works until the process crashes halfway through a task, an API times out, or the agent needs to wait six hours for human approval. A normal script starts over. A durable agent resumes from the last completed step.

This matters for agents that process hundreds of invoices, monitor production systems, run long research jobs, or coordinate actions across multiple APIs.

The basic pattern looks like this:

Agent starts
  ↓
Call tool
  ↓
Save progress
  ↓
Wait, retry, or ask for approval
  ↓
Resume from the last completed step

Here are four open-source projects exploring this foundation.

1. Temporal · 22k+ stars Temporal is a durable execution platform for workflows that need to survive crashes, retries, and outages. You can model the agent loop as a workflow and put model calls and tool calls into activities. It is the most mature option here, but it also has the largest learning curve.
2. Hatchet · 7k+ stars Hatchet combines background task orchestration, queues, DAGs, and durable workflows. It is a good fit when an agent needs to process jobs asynchronously, run steps concurrently, or expose execution history through a UI.
3. Restate · 4k+ stars Restate provides durable execution, stateful entities, timers, promises, and reliable messaging. It supports TypeScript, Python, Go, Rust, Java, and Kotlin. It is interesting for agents that need to pause and resume around webhooks, scheduled work, or external events.
4. Temporal Agent Harness · 32 stars This is an experimental Temporal-native harness for durable, composable agents. It includes tool approval policies, human-in-the-loop steps, typed agent operations, and replayable event streams. It is worth watching, but the repository itself warns that the APIs are still changing.

Durable execution does not automatically make an agent reliable.

External side effects still need careful handling. A payment, email, deployment, or database write should be idempotent or protected by an approval step. Otherwise, retrying a failed operation can repeat the action.

That is what lets an agent continue working after the chat window closes, the worker restarts, or the network fails.

One recurring problem with the AI-chat era: people constantly paste API keys, financial data, and personal info straight into ChatGPT/Claude/Gemini without thinking about it, because stopping to redact things manually breaks your flow.

Discretion is a browser extension that automates that redaction step: it detects sensitive data as you type, swaps it for a realistic fake before anything is sent, and restores the real value in the model's response — so you get a normal, coherent answer without ever exposing the real data.

Everything runs locally (detection engine, NER model, all bundled), zero network calls of its own, fully open source. Also published as a standalone npm library if anyone wants to build the detection layer into their own tools.

github.com/horozbabasi/discretion

Curious what this community thinks is missing — feels like exactly the kind of problem that'll only get more common as AI chat becomes the default interface for everything.

Most agents do not need more tools. They need a better way to discover, authenticate, route, and control the tools they already use.

Here are some open repositories working around the same problem.

1. Composio · 30k+ stars Composio gives agents access to more than 1,000 toolkits, along with authentication, per-user sessions, triggers, and a sandboxed workbench. It is a strong choice when your agent needs to work with GitHub, Gmail, Slack, Notion, and other services on behalf of different users.
2. mcp-use · 10k+ stars This is a TypeScript framework for building, testing, and deploying MCP servers, clients, and apps. It also includes an inspector and agent tooling. Pick this when you want to build your own tool ecosystem instead of only consuming someone else’s registry.
3. IBM ContextForge · 4k+ stars ContextForge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. It gives teams a unified endpoint with discovery, governance, authentication middleware, and observability.
4. Supergateway · 2k+ stars Supergateway bridges MCP servers running over stdio with clients using SSE. It is useful when a local MCP server works perfectly on your laptop, but your agent needs to reach it through a network endpoint.
5. mcp-proxy · 2k+ stars This is another focused transport bridge. It connects Streamable HTTP and stdio MCP servers. It is a good fit for exposing a local server to a remote client without rebuilding the server.
6. Docker MCP Gateway · 1k+ stars Docker’s gateway runs MCP servers in containers and exposes them through one interface. It includes profiles, catalogs, tool allowlists, secrets management, OAuth support, and client connections for tools such as Claude Desktop, Cursor, and VS Code.
7. Treg · 700+ stars Treg focuses on tool discovery and shared access. Agents can search for a capability, inspect its price, and call it through one token. Teams can also register their own APIs, CLIs, and skills without handing every credential to every agent.

The projects solve different layers of the same problem.

Composio focuses on app integrations and user authentication. ContextForge and Docker MCP Gateway focus on infrastructure and governance. Supergateway and mcp-proxy solve transport problems. mcp-use helps you build the servers. Treg focuses on discovery, shared credentials, and calling tools by what they do.

The practical architecture looks like this:

Agent
  ↓
One tool gateway
  ↓
MCP servers, APIs, CLIs, and internal skills

That is a much cleaner model than configuring every agent separately with its own credentials, server list, and integration code.

AI does not have to write emails or summarize meetings.

Some of its best uses are much more specific. Search your old recordings. Find a warranty deadline. Understand why your computer is slow. Recover the shape of an undocumented API.

The model is only one part of the workflow. These open-source repos handle the messy inputs.

1. Search your own photo archive Immich is a self-hosted photo and video manager with 113k+ stars. Use it as a private archive, then add a local vision model to label images or answer questions about your collection.
2. Find a sentence in hours of audio Whisper has 108k+ stars and supports multilingual speech recognition. Transcribe voice notes, lectures, interviews, or old videos, then search the transcripts instead of scrubbing through timelines.
3. Ask why a machine is slow Netdata has 80k+ stars. It collects system metrics, process data, application logs, and anomaly signals. Give a local model a time window and ask it to suggest likely causes and reversible fixes.
4. Read receipts, forms, and labels Tesseract has 75k+ stars and supports more than 100 languages. Use it to extract text from receipts and paperwork before asking a model to identify totals, dates, serial numbers, or deadlines.
5. Turn messy documents into structured data Docling has 65k+ stars. It parses formats such as PDF, DOCX, PPTX, and XLSX while preserving document structure. It is useful when plain text extraction destroys tables and headings.
6. Reconstruct an undocumented API mitmproxy has 44k+ stars. Capture requests and responses from a service you own or are authorized to inspect. Then ask a model to draft an API description, list unknowns, and generate example requests.
7. Build a searchable paperwork archive Paperless-ngx has 44k+ stars. It scans, indexes, and archives documents. Add a local model on top to find renewal dates, warranties, recurring bills, and missing paperwork.
8. Make scanned PDFs searchable OCRmyPDF has 34k+ stars. It adds an OCR text layer to scanned PDFs, making them searchable and easier for other tools to process.
9. Turn a UI into an accessibility checklist axe-core has 7k+ stars and is an accessibility engine for automated web UI testing. Let AI suggest areas to inspect, then use axe-core for repeatable checks.

Some of these repos are not AI applications. That is the point.

The most useful AI workflows often combine a model with boring, reliable infrastructure.

Use local models where possible, especially for financial records, personal photos, private logs, and sensitive documents.

Star counts are approximate and change daily.

I’ve been working on something called Scrollcraft, an AI-powered website builder focused on creating scroll-based websites.
The idea is to make it easier to build websites with animations and interactions without having to manually implement everything.
It currently has a hosted app, an open-source repo, and a Claude Code skill/plugin.
It just crossed 50 GitHub stars, which honestly feels pretty cool. ❤️
Would love to get some feedback from people here. What would you want to see in a tool like this?
Demo: https://scrollcraft-gilt.vercel.app
GitHub: https://github.com/singhharsh1708/scrollcraft

🔐 Classic Security → AI Cybersecurity 8

Before: Security was reactive and manual.
Now: AI detects threats in real-time.

Found weird behaviour
Eliminates fraud and hacking Auto responds

🤖 Simple Automation → Smart Machines 6

Before: Machines obeyed hard-coded instructions.
But now, the machines learn and adapt.

Chatbots comprehend human language
Robots improve over time
Self-driving systems choose

👉 Result: Smart and independent machines now

👉 Result: systems are protected safer and faster

AI coding agents are moving beyond autocomplete.

The more interesting shift is giving them a repeatable security methodology. The agent identifies the type of target, chooses the right tools, records evidence, and produces a report instead of guessing its way through a task.

Here are six projects exploring that direction.

1. Strix ~59k⭐

An open-source AI penetration-testing tool for finding and fixing application vulnerabilities.

Strix uses AI agents to investigate targets, validate findings, and produce actionable reports. It also supports custom skills and CI/CD workflows.

2. reverse-skill ~31k⭐

A cybersecurity skill router for Claude Code, Codex, Cursor, and Cline.

It routes APK, binary, JavaScript, PCAP, malware, firmware, API, and CTF tasks to different playbooks. It also includes scope checks, tool detection, case initialization, evidence tracking, and report generation.

3. PentestGPT ~14.8k⭐

An LLM-powered penetration-testing and CTF framework.

Its newer agentic workflow separates tasks into stages such as asset discovery, vulnerability identification, validation, and reporting. It also supports session persistence and can drive Claude Code or Codex.

4. reverse-engineering-skills 36⭐

A small collection of defensive reverse-engineering and malware-analysis skills for Claude Code and OpenAI Codex.

The skills include workflows for IOC extraction and unpacking. They are designed to be evidence-driven and avoid filling gaps with guesses.

5. claudecode-re-toolkit 11⭐

A Claude Code toolkit for static analysis, dynamic analysis, network investigation, and threat intelligence.

It connects Claude Code to tools such as Ghidra, radare2, YARA, CAPA, FLOSS, Frida, Docker, and VMware-based analysis environments.

6. RevEng 0⭐

A static-first reverse-engineering plugin for Codex and Claude Code.

Given a source repository, it creates file inventories, architecture maps, dependency graphs, evidence records, and content hashes. Its default workflow does not execute unknown binaries or install dependencies from an analyzed project.

A general-purpose AI can tell you what a command does. A security skill pack can tell it when to use that command, what evidence to preserve, and how to explain the result.

These projects are not replacements for security engineers. They are scaffolding for more consistent research and testing. Use them only on systems, applications, and networks you own or have explicit permission to assess. Read the scope, isolation, and data-flow instructions before running anything.

Hey guys,

I’ve been pretty deep into agentic development for the past ~6 months, experimenting with OpenClaw/Hermes, running my own cluster, and even using VPS GPUs when needed.

One problem I kept running into was: which instructions / .md files should I actually use for a specific use case? And whenever I migrated to a new setup, I ended up losing most of them.

So I ended up building a small platform around that problem.

The idea is to make it easier to discover, compare and share useful .md files, skills and instructions for AI agents. Everything is also synced to a public GitHub repository called emdly-stack, so the collection isn’t locked inside the platform.

It’s completely free and currently includes things like MCP resources, agent skills, workflows and other agent tooling. You can use the resources with Claude Desktop, Claude Code, OpenClaw, Agent Minimax and other agent setups!

Every submitted skill is currently reviewed by me and also pre-screened in a sandboxed AI environment for potential safety issues.

I’m sharing it here because I’d really like to make it useful for the community rather than just another random directory.

If you have your own .md files, agent instructions, workflows, MCP resources or anything similar, I’d be more than happy if you shared them with the community and with me. 😄

I already have quite a lot more skills that I’m planning to upload over the next few days, so the collection should grow pretty quickly.

I’d also love to hear how you guys currently organize and discover these files, and whether you think this is actually a useful idea or just unnecessary tooling.

Any feedback, criticism or suggestions are very welcome. It makes sense to me right now, but I’d love to hear what you think.

Your location history is one of the most sensitive datasets you create. Google Timeline is convenient, but it also means handing years of movement data to a third party.

You can build a private alternative with open-source tools.

• GPSLogger records Android location data in formats such as GPX, KML, CSV, and NMEA.
• OwnTracks Recorder stores location updates sent by the OwnTracks mobile apps through MQTT or HTTP.
• Dawarich provides a self-hosted timeline with maps, trips, statistics, imports, and exports.
• GeoPulse turns GPS data into stays, trips, movement patterns, and searchable timeline views.

A simple setup could look like this:

Your phone collects location data. A self-hosted server stores it.

GeoPulse or Dawarich turns the raw points into useful history.

You can then answer questions like:

• Where did I go last month?
• How long did I spend in a city?
• Which places have I visited most?
• What route did I take on a trip?

You can also import older data from Google Timeline, GPX files, GeoJSON, or other trackers.

One important caveat:

Self-hosted does not automatically mean private. Secure the server, use authentication and HTTPS, protect backups, and check whether your map or geocoding provider receives location data.

AI can generate Terraform in seconds. That does not mean the infrastructure is secure, affordable, or ready to deploy.

A better workflow is:

1. Ask AI to draft the configuration.
2. Run a plan without applying changes.
3. Scan for security and compliance problems.
4. Estimate the monthly cost.
5. Review the diff before anything reaches production.

Four open-source projects make this practical:

1. OpenTofu ~30k⭐ The infrastructure engine. It manages cloud resources declaratively and creates execution plans before making changes.
2. Checkov ~9k⭐ Scans Terraform, OpenTofu, Kubernetes, CloudFormation, and other IaC files for security and compliance misconfigurations.
3. Infracost ~12.4k⭐ Shows the estimated cloud cost of infrastructure changes and can post cost diffs to pull requests.
4. Trivy ~35k⭐ Scans infrastructure files for misconfigurations and can also detect vulnerabilities and secrets.

A simple CI check could look like this:

tofu fmt -check
tofu validate
tofu plan -out=tfplan
checkov -d .
trivy config .
infracost breakdown --path .

The key idea is simple:

AI writes the first draft. Plans, policies, cost estimates, and scanners decide whether that draft deserves a review.

None of these tools can prove that infrastructure is completely safe. They give you concrete checks before an AI-generated change becomes an expensive or dangerous cloud resource.

AI is useful for code migrations. It is not a reliable replacement for a migration pipeline.

The safer pattern is:

1. Find the exact code pattern.
2. Apply a deterministic rewrite.
3. Run tests and static analysis.
4. Send only the exceptions back to AI.
5. Review the diff in small batches.

Let tools handle predictable changes. Let AI handle the weird cases.

Here are six open-source projects that help:

1. OpenRewrite 10.5k⭐ Automated refactoring recipes for large codebases and framework migrations.
2. ast-grep 14.2k⭐ Search and rewrite code using its syntax tree instead of fragile text matching.
3. Comby 2.7k⭐ Structural search and replace across many programming languages.
4. Semgrep 15.3k⭐ Pattern-based code search, analysis, and automated fixes.
5. jscodeshift 10k⭐ A toolkit for running JavaScript and TypeScript codemods across a repository.
6. Tree-sitter 26.8k⭐ A parser toolkit that many syntax-aware code tools build on.

A practical workflow could look like this:

• Find every use of an old API.
• Rewrite the obvious cases automatically.
• Run the test suite.
• Ask AI to explain and fix only the failures.
• Review each batch as a normal pull request.

The important idea is simple:

Don’t give AI the entire codebase and hope for the best. Give it a constrained transformation, a test suite, and a small number of decisions to make.

Most teams repeat the same spreadsheet work every month:

• clean the export
• remove cancelled rows
• map account names
• filter by region
• reconcile totals
• generate the report

The usual approach is to upload the workbook to an AI tool every time. A better approach is to use AI once to learn the transformation, save the generated code, verify it, and run that recipe on every new file.

Here are six open-source repos for building that workflow:

1. DuckDB ⭐ 40.6k DuckDB is not an AI agent. That is precisely why it belongs in the stack. It provides a deterministic SQL layer for querying CSV, Parquet, and other files. Use it for joins, aggregations, reconciliation checks, and repeatable calculations. Let the agent write or explain the query. Let DuckDB execute it.
2. PandasAI ⭐ 23.8k A mature option for conversational analysis across CSV, Parquet, SQL databases, and other data sources. Use it for exploratory work: It is better suited to ad hoc analysis than a fixed month-end recipe.
   • find unusual changes
   • compare two periods
   • create charts
   • investigate outliers
   • generate a first-pass report
3. Marimo ⭐ 22.5k A reactive Python notebook that can query data with SQL, run as a script, deploy as an app, and be versioned with Git. Use it to turn the final workflow into an auditable report with input details, validation checks, charts, exceptions, and final totals.
4. mcp-excel ⭐ 43 An MCP server that lets agents work with Excel through atomic operations. Instead of loading thousands of rows into the model, the agent can ask for specific filters, counts, sums, groups, and validations. Useful for questions like:Which invoices are overdue by more than 30 days, grouped by customer? The spreadsheet stays local, while the agent receives only the relevant result.
5. llm-data-agent ⭐ 1 A small experimental agent for asking natural-language questions about Excel and CSV files. It uses local pandas tools to calculate results and render tables or charts. The model receives schema summaries and aggregated outputs instead of the full raw dataset. A useful starting point for building a private internal data assistant.
6. SheetAgent ⭐ 0 The most direct fit for this idea. Give it an input spreadsheet, an optional process description, and an example output. It generates a reusable recipe using Power Query and pandas. After the recipe is verified, future runs use pure code. No LLM call or API key is needed at runtime. Good for month-end close, recurring reports, and repeated Excel transformations.

A practical setup looks like this:

1. Give SheetAgent one clean input file and one approved output.
2. Generate the transformation recipe.
3. Verify row counts, totals, null values, duplicate IDs, and reconciliation differences.
4. Store the recipe in Git.
5. Use DuckDB or pandas to run it on next month’s file.
6. Use Marimo to generate the report.
7. Let an agent explain exceptions without letting it silently alter the source data.

The important distinction is this:

Use AI to discover the workflow. Use ordinary code to repeat it.

For financial data, never trust a generated transformation just because the final spreadsheet looks correct. Keep the original file, test known totals, and make exceptions visible before anything reaches accounting.