New AI Tools Weekly — Issue #4: Six Themes from June 9–15, 2026

Note on sources: Product Hunt's weekly leaderboard remained inaccessible this week (Cloudflare block, consistent with prior issues). This issue is based on GitHub Trending (all languages + Python, weekly filter) and supplementary search signals. Per channel policy, PH is skipped when the source returns empty.

This week GitHub Trending didn't just surface AI tools — it surfaced a whole new category. Six of the top twenty repositories are skill packages for AI coding agents: instruction files that tell agents how to do specific jobs. That's not a coincidence. A structural shift is happening underneath the models, and this week's data makes it hard to miss.

Theme 1: The agent skill economy

The #1 and #2 spots on both GitHub Trending Python and All Languages are skill repos. Not models, not infra — plain Markdown instruction packages.

mvanhorn/last30days-skill gained +12,053 stars this week (42.4k total 1). It's a Claude Code / Codex CLI skill that fans out across Reddit, X, YouTube, Hacker News, Polymarket, and GitHub simultaneously and synthesizes what people are actually engaging with on any topic — then writes you the prompts from what the community figured out. The v3 engine added cross-source cluster merging, single-pass competitor comparisons, and shareable HTML briefs. The install is a one-liner (npx skills add mvanhorn/last30days-skill). Zero config; Reddit, HN, and Polymarket work immediately.

addyosmani/agent-skills gained +10,445 stars this week (59.8k total 2). Addy Osmani — Google Chrome engineering lead — packaged 24 production-grade software engineering skills across the full dev lifecycle: spec, plan, build, test, review, ship. Each skill has a structured workflow with steps, checkpoints, and anti-rationalization tables ("I'll add tests later" → documented counter-argument). Works in Claude Code, Gemini CLI, Antigravity, Cursor, Copilot, Windsurf.

Leonxlnx/taste-skill (44k stars, +7,591 this week 3) is an anti-slop frontend framework. It stops AI agents from generating generic, boilerplate-looking UIs by tuning three dials: design variance, motion intensity, and visual density. The v2 rewrite added brief inference, canonical GSAP skeletons, and a redesign-audit protocol. Compatible with React, Vue, Svelte.

phuryn/pm-skills gained +5,713 stars (18.3k total 4) — 68 PM skills and 42 chained workflows organized across 9 plugins. Covers the full product management lifecycle from discovery through GTM. Based on frameworks from Teresa Torres, Marty Cagan, and Alberto Savoia. Installs natively in Claude Code and Codex CLI.

The pattern: people aren't just using AI coding agents — they're building instruction packages that make those agents more specialized. A mini-marketplace is forming. The question for next week is whether quality control mechanisms keep up.

Theme 2: Code to knowledge graph

github.com · Repositorio de GitHub

safishamsi/graphify

https://github.com/safishamsi/graphify

Cargando tarjeta de contenido…

safishamsi/graphify gained +5,478 stars this week (67.4k total, YC S26 5). Type /graphify . in your coding agent and it maps the entire project — code, docs, PDFs, images, videos — into a queryable knowledge graph. Three output files: graph.html (interactive browser visualization), GRAPH_REPORT.md (key concepts, surprising cross-file connections, suggested questions), and graph.json (full graph, queryable anytime).

Code files are parsed locally via tree-sitter with no API calls. Everything else goes through your IDE's model. The v8 release added a shared HTTP server mode so an entire team can point their IDE at one graph instance, a graphify prs dashboard showing CI state and review status, and Kiro IDE support. Framework integrations include LangChain, LlamaIndex, Haystack, and Agno — all as drop-in replacements for their respective default in-memory vector stores.

The pitch: "stop grep-ing through files, query the graph instead." Whether the graph stays accurate as codebases change is the practical friction point; Graphify addresses it with a git hook that triggers a selective re-extract after each commit.

vs. closest alternative: codebase-mcp and similar tools also expose codebase search to agents, but Graphify's graph representation surfaces cross-file relationship inference that keyword search misses.

Theme 3: Agent skill security

NVIDIA/SkillSpector gained +3,669 stars this week (5.7k total 6). It's a security scanner specifically for AI agent skills — the same category that just dominated the top of GitHub Trending.

The project is backed by an actual research paper: "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale" (Liu et al., 2026), which analyzed 42,447 skills from major marketplaces and found 26.1% contain at least one vulnerability, and 5.2% show likely malicious intent. Skills with executable scripts are 2.12× more likely to be vulnerable. 6

SkillSpector runs 64 vulnerability patterns across 16 categories: prompt injection (5 patterns including hidden instructions and exfiltration commands), data exfiltration, privilege escalation, supply chain (including live CVE lookups via OSV.dev), excessive agency, memory poisoning, MCP tool poisoning, and more. Two-stage pipeline: fast static analysis, then optional LLM semantic evaluation. Outputs: terminal, JSON, Markdown, SARIF for CI/CD integration.

Basic usage: skillspector scan ./my-skill/ or skillspector scan https://github.com/user/my-skill. The --no-llm flag runs static-only for speed. Apache-2.0 licensed; supports OpenAI, Anthropic, and NVIDIA build.nvidia.com as LLM backends.

The timing — shipping in the same week that skill repos dominated GitHub Trending — is either the best coincidence or the most well-timed release of the year.

Cargando gráfico…

Theme 4: Lean RAG — a vector index that beats FAISS

RyanCodrai/turbovec gained +4,895 stars on Python Trending this week (11.6k total 7). It's a Rust vector index with Python bindings, built on Google Research's TurboQuant algorithm (ICLR 2026 paper: arxiv.org/abs/2504.19874 8).

The core claim: a 10 million document corpus that takes 31 GB of RAM as float32 fits in 4 GB under turbovec — and searches faster than FAISS IndexPQFastScan on ARM. On Apple M3 Max, turbovec's NEON kernels beat FAISS by 10–19% across every configuration. On x86 Sapphire Rapids, it wins the 4-bit configs and trails on 2-bit by a few percent.

Compression works through random rotation + Lloyd-Max quantization. A 1536-dim vector goes from 6,144 bytes (float32) to 384 bytes (2-bit), 16× compression. A per-vector length-renormalization step removes the inner-product bias that Lloyd-Max introduces, so scores aren't systematically underestimated. No training phase, no rebuilds as the corpus grows — vectors are indexed at ingest.

pip install turbovec. LangChain, LlamaIndex, Haystack, and Agno integrations are drop-in. The IdMapIndex variant supports stable external IDs and O(1) deletes. Hybrid filtered search passes an allowlist into the SIMD kernel directly — no over-fetching.

vs. FAISS: turbovec is faster on ARM and competitive on x86, with less RAM. FAISS has far more production deployment history, more index types, and better documentation. For CPU-bound or Apple Silicon RAG stacks where memory footprint matters, turbovec is now worth a look.

Theme 5: Local-first medical AI

maziyarpanahi/openmed gained +2,106 stars on Python Trending this week (3.5k total 9). It's a local-first healthcare AI framework: 1,000+ curated biomedical and clinical NER models, all running entirely on-device. No cloud calls. No patient data leaving the network. Supports Python (PyTorch, CUDA, Apple MLX) and native Swift apps via OpenMedKit.

Core capabilities: clinical entity extraction (disease, drug, anatomy, gene detection), PII de-identification covering all 18 HIPAA Safe Harbor identifiers, and batch processing. The Privacy Filter family ships three model variants — OpenAI's privacy-filter base, a Nemotron fine-tune, and an OpenMed multilingual version — all behind the same extract_pii() / deidentify() API.

On Apple Silicon, the MLX backend runs 24–33× faster than CPU PyTorch for the Privacy Filter. Batch processing adds up to 3.3× throughput on CPU over single-document mode. 9

The one-liner is analyze_text("Patient started on imatinib for chronic myeloid leukemia.", model_name="disease_detection_superclinical") — returns labeled entities with confidence scores, no API key, no network call.

Differentiation: cloud medical APIs like AWS Comprehend Medical charge per call and send data to their servers. OpenMed is Apache-2.0, your infrastructure, your data. The trade-off is that you manage model downloads and hardware. For HIPAA-covered entities that cannot route clinical text through a vendor, that trade-off is mandatory, not optional.

Theme 6: Context compression, continued

github.com · Repositorio de GitHub

chopratejas/headroom

https://github.com/chopratejas/headroom

Cargando tarjeta de contenido…

chopratejas/headroom added another +10,653 stars this week — bringing its total to ~28k in roughly two weeks of trending 10. It compresses tool outputs, logs, files, and RAG chunks before they hit the LLM context window. The claimed range: 60–95% token reduction with "same answers."

microsoft/markitdown gained +6,280 stars (153.6k total 11). It converts files and Office documents to Markdown — the de facto pre-processing step before feeding documents into any LLM pipeline. The sustained weekly gains (this is the third consecutive week on trending) suggest teams are building it into standard document ingestion workflows rather than just experimenting.

Both repos continue a pattern from Issue #3. Token efficiency tooling isn't a one-week spike — it's becoming infrastructure. The two repos together have accumulated roughly 180k total stars, which puts them in the same tier as production-grade ML frameworks.

The week's signal

Six skill repos in the GitHub top 20 is not noise. It's the leading indicator of a market: people are building instruction packages the way people used to build npm packages. The difference is there's no package quality standard yet — which is exactly why SkillSpector shipped this week. The infrastructure layer is always a few weeks behind the adoption curve.

Turbovec and OpenMed point at a separate trend: the performance and privacy arguments for local-first AI tooling are getting concrete. Not "local AI is cool" but "local AI is faster on ARM, fits in 4 GB, and is the only option for HIPAA-covered data."

Try-it picks this week: headroom if you're hitting context limits in agent pipelines; SkillSpector before installing any skill from a marketplace you don't control; turbovec if you're running RAG on Apple Silicon or care about memory footprint.