GitHub Trending Top 10: a Cloudflare security skill leads on 15,072 stars with no commit since September, ruflo ships 28 versions, and OpenCode 2 arrives with empty release notes (Oct. 18–Oct. 25, 2026)

Rank 1 this week went to a repository that has taken no commit since September 14. Cloudflare's security-audit-skill gained 15,072 stars in seven days, and its counter closed at 46,917. 1 When this chart placed it fourth five weeks ago, it held 22,338.

Rank 2 tells the opposite story. ruvnet/ruflo published 28 versions between October 19 and October 24, took 232 commits, and gained 2,987 stars — a fifth of the leader's — for all that work.

Eight of the ten do their work through somebody else's agent: a skill file, a plugin bundle, a memory server, an orchestrator, a renderer an agent drives. The two that stand alone are OpenCode, which is an agent itself, and ComfyUI, which is an image engine.

The ranking below is GitHub's own weekly Trending view, captured October 25, 2026 at 8:00 p.m. ET. "Stars this week" is the gain GitHub attributes to the trailing seven days; "stars captured" is the running total at that moment. Both measure attention, so readiness stays a separate question, and each entry closes on the boundary that decides the star. 1

Current signal: Rank 1 with 15,072 stars this week and 46,917 captured. Zero commits inside the window, and the last push to main was September 14. The repository has published no release at any point in its life. MIT, created June 18, 2026, with 2,908 forks. 2 It was rank 4 here for September 20–27, at 4,805 that week and 22,338 then, so it has more than doubled its total while standing still.

Problem solved: A team wants its own codebase audited and cannot staff an audit. One agent asked to "find vulnerabilities" returns a list of claims that nobody can check or repeat.

Implementation: A directory of prompt files plus two zero-dependency Node validators, run by a coding agent in six phases. Reconnaissance writes architecture.md and coverage-ledger.json; hunters work one ledger unit at a time; a fresh verifier tries to disprove each candidate; survivors become records in findings.json, checked against report-schema.json. 3

Verdicts are kept distinct: confirmed carries a complete source trace, needs_validation an unresolved fact and no severity, rejected a disproved candidate. Repeat runs against one repository are additive, and use earlier ledgers to aim at gaps.

Differentiation: A scanner matches patterns and reports hits. This skill orchestrates isolated agents against a coverage ledger, and writes down what it did not cover alongside what it found.

Verdict: Star it to read the phase design and the ledger-verdict-validator triple, which transfer to any review you run with an agent. Read the Cloudflare post it credits as its origin before you trust the numbers it produces. 4

Boundaries: the repository is a snapshot from mid-September with 96 open issues and pull requests. The skill's own value depends on the model behind it, and a confirmed finding is evidence a reader still has to reproduce.

Current signal: Rank 2 with 2,987 stars this week and 79,283 captured. 232 commits and 28 releases inside the window, from v3.57.1 on October 19 to v3.63.0 on October 24. 5 MIT, created June 2, 2025. The repository used to be called claude-flow, and github.com/ruvnet/claude-flow still redirects here while several published packages keep the old name. It was rank 5 for May 8–15, at 5,106 that week and 51,202 then.

Problem solved: A developer runs Claude Code in one window and Codex in another, and wants shared memory, repeatable workflows and a console across both.

Implementation: An npm CLI, a Claude Code plugin marketplace and an MCP server. /plugin install ruflo-core@ruflo inside Claude Code 2.1.287 or later, or npx ruflo init, which writes .claude/, .claude-flow/ and CLAUDE.md into the project. Federation joins agents across machines over mTLS and ed25519, and strips personal data before a message leaves the node. 6

Two additions carried this week's weight. v3.63.0 added four MCP tools for Anthropic's Claude Managed Agents: bounded dynamic workflows with a mandatory budgetCents, and provider completion reported as verification: "unverified". 7 v3.60.0 and v3.61.0 added ruRE, seven read-only reverse-engineering tools covering .asar archives, JavaScript apps, ELF, PE and Mach-O binaries, .NET metadata, EVM bytecode and CUDA fatbins. 8

Differentiation: Orca, at rank 5, gives a person several agents side by side. ruflo supplies the layer underneath: memory, workflow definitions and a console the agents report into.

Verdict: Star it for ruRE's rule — parse the file, never execute it, screen every string it yields. Boundaries: 28 releases in seven days means you pin exactly one. The release notes list their own gaps: EVM and P/Invoke handling were validated on built fixtures, the .asar scratch folder is left behind, and the ruRE tools will read any path the process can.

Current signal: Rank 3 with 2,790 stars this week and 32,982 captured. Seven commits and no release ever, because the repository is a catalogue and versions nothing. Apache-2.0, created January 23, 2026. 9 It was rank 6 for September 13–20, at 1,298 that week and 25,283 then.

Problem solved: Someone doing sales, legal or finance work in Claude Cowork wants the assistant to know their tools, their terminology and the way their team handles a contract review.

Implementation: Eleven plugins, each a folder of skills, connectors and slash commands: productivity, sales, customer-support, product-management, marketing, legal, finance, data, enterprise-search, bio-research, and one that builds others. Installation is claude plugin marketplace add anthropics/knowledge-work-plugins, then claude plugin install sales@knowledge-work-plugins. 10

The connectors are the substance. Sales reaches HubSpot, ZoomInfo and Fireflies; finance reaches Snowflake, Databricks and BigQuery; bio-research reaches PubMed, ClinicalTrials.gov and Benchling.

This week's seven commits are three version bumps of the security-guidance plugin and one sales change, "show the source of every line with a link to check it". 11

Differentiation: A prompt pack hands the model instructions, and the model still asks which database you mean. A plugin wires one job function to named connectors, then expects the organisation to rewrite the parts that are theirs.

Verdict: Star it as a worked template for structuring role bundles, particularly the way skills and connectors are split. Boundaries: the value depends on which of those connectors you already pay for. Nothing here is versioned, so a pin means a commit hash, and curation moves without a changelog.

Current signal: Rank 4 with 5,921 stars this week and 221,522 captured, the largest total on the board. 373 commits and six versioned releases: v2.1.0 through v2.1.4 between October 20 and October 23, plus v1.19.4 on October 22. 12 MIT, created April 30, 2025, default branch dev. This is its first appearance on this chart as an entry.

Problem solved: A developer wants a coding agent in the terminal, running against the model account they already pay for, with the source available to read and patch.

Implementation: A TypeScript CLI installed by script, npm, Homebrew, pacman, mise or Nix, plus a desktop app in beta. Two built-in agents switch with Tab: build has full access, and plan denies edits and asks before running shell commands. A general subagent handles long searches. 13

The v2 line is the week's news and the week's hole. Every v2 tag carries a one-line body of the form release: v2.1.4. 14 The one real changelog this week sits on the old line: v1.19.4 upgraded the bundled Bun runtime to 1.4.4, which brought security fixes for Brotli, TLS, HTTP/2, HTTP/3, WebSocket and fetch. 15

Differentiation: Claude Code and Codex ship a closed harness with their own plugin format. OpenCode is the MIT one, installable eight ways, pointed at whichever provider you configure, with 29,617 forks behind it.

Verdict: Star it. Adopt v2 only if you are willing to read the diff between tags, because the release pages tell you nothing. Boundaries: 3,805 open issues and pull requests, a desktop client still labelled beta, and a v2 line five patch tags old.

Current signal: Rank 5 with 9,622 stars this week, the second-largest gain on the board, and 105,830 captured. 1,461 commits, the busiest repository this week. Eleven releases from v1.4.230 to v1.4.240 between October 19 and October 25, plus a mobile build. MIT, created March 17, 2026. 16 It was rank 7 for September 20–27, at 6,227 that week and 79,609 then.

Problem solved: A developer running three agents at once loses track of which one is working, in which branch, and which of them has finished while they were in a meeting.

Implementation: A desktop application for macOS, Windows and Linux with an iOS and Android companion. One prompt fans out across five agents, each in its own git worktree, and you merge the winner. Terminal splits, SSH worktrees, a browser per project, GitHub and Linear panels, and an orca ports command for finding dev servers. It drives Codex, Claude Code, OpenCode and Pi.

v1.4.240 gave the built-in browser searchable history and added recovery for chats and remote terminals; v1.4.239 added one-click skill install and separate browser sessions per project. 1718

Differentiation: A tmux grid shows you panes and forgets them. Orca keeps a record per project of each worktree, chat and browser session, and pushes the moment an agent finishes to your phone.

Verdict: Star it if you already run two agents and lose time to them. Boundaries: GitHub's counter reads 8,498 open issues and pull requests, the largest backlog on this chart. Eleven releases in a week means pinning, and a desktop app with a phone client is a lot of surface to trust.

Current signal: Rank 6 with 5,612 stars this week and 72,167 captured. 428 commits and 26 releases from v0.8.174 to v0.8.200, roughly four a day. Apache-2.0, created March 10, 2026. 19 Fifth appearance here: October 11–18 at rank 8 with 5,883 and 66,744, after October 4–11 at 4,223, September 27–October 4 at 56,774 captured, and September 6–13 at 49,597.

Problem solved: An agent will write an HTML page without complaint. Producing the same MP4 from that page twice, frame for frame, is where the pipeline usually breaks.

Implementation: A composition is an HTML file with data attributes, and its animations become seekable through adapters for GSAP, CSS, Lottie, Three.js, Anime.js and WAAPI, so frame 412 is a lookup. Headless Chrome renders, FFmpeg encodes, and npx hyperframes skills update installs the skills an agent needs to author one.

This week's 26 versions went into speed. v0.8.200 mounts and draws only the scenes near the playhead, so a long project scrubs faster. 20 v0.8.198 splits cloud renders by what each stretch costs to capture, which made a heavy 4K test about a third faster at the same price. 21

Differentiation: Remotion bets on React components and a bundler. HyperFrames bets on plain HTML that any agent can write, under Apache-2.0 and with no per-render fee.

Verdict: Star it if agents make video for you. Boundaries: 26 releases in seven days means pinned adoption. Some bodies describe themselves as repeats of the previous version, so the compare link is the reliable record. The numbering skips as well, since no v0.8.182 or v0.8.187 exists.

Current signal: Rank 7 with 1,070 stars this week, the smallest gain on the board, and 9,718 captured. Seven commits, and two releases: v1.0.16 on October 21 and v1.0.17 on October 23. Apache-2.0, created March 16, 2026, and the repository carries no description on GitHub at all. 22

Problem solved: A coding agent writes Compose code that compiles, then fails on the parts Android developers actually struggle with: ANRs, intent permissions, adaptive layouts, running a model on the device.

Implementation: SKILL.md files following the open agent-skills standard. android skills add r8-analyzer --project=. installs one into the current directory; --all installs the set for every agent it detects, and with none detected it writes to ~/.gemini/antigravity/skills. Claude Code and Codex can also take it as a plugin. 23

v1.0.16 added three skills: litert-lm for running an open text model on the device through the LiteRT-LM Kotlin API, anr-audit-and-fix for auditing ANR risk and reading stack dumps, and projected-hardware for XR audio and display glasses. 24 v1.0.17 updated eleven existing skills. 25

Differentiation: Community skill packs collect prompts and let anyone submit. Google scopes these to workflows where its own evaluations show models underperforming, and keeps public contributions closed.

Verdict: Star it if you ship Android with an agent in the loop. Boundaries: the README says public contributions are closed, so feedback arrives as issues. With no agent detected, the install path defaults to Gemini and Antigravity, so check where the files land before running --all.

Current signal: Rank 8 with 6,903 stars this week and 135,261 captured. 112 commits and three releases: v0.9.93 on October 20, v0.9.94 on October 22, v0.9.95 on October 23. Apache-2.0, created April 3, 2026, default branch v8. 26 It was rank 5 here for June 8–15, as safishamsi/graphify, at 5,478 that week and about 67,200 then, so the total has doubled since and the repository has changed owner.

Problem solved: An agent answering "how does a request reach the database" reads files one at a time until it finds the chain. A graph answers the same question by traversal.

Implementation: uv tool install graphifyy, then graphify install registers a /graphify skill for Claude Code, Cursor, Codex, Gemini CLI and twenty more harnesses. Code is parsed with tree-sitter AST across roughly forty languages, with no model involved and nothing leaving the machine; documents, PDFs and images take a semantic pass. Output is graph.html, GRAPH_REPORT.md and graph.json.

Its published LOCOMO table claims 0.497 recall@10 against 0.048 for mem0 and 0.149 for supermemory, with zero LLM credits spent building the graph. The same table gives supermemory the higher answer accuracy, 49.7 percent against 45.3.

This week's three releases took 62 community pull requests. v0.9.95 closed a hole where a pre-planted symlink could redirect the skill install's file writes. 27 v0.9.93 made references to Kotlin type aliases, C# delegates and Swift macros resolve to their real declarations. 28

Differentiation: Vector search embeds chunks and hopes the nearest neighbours hold the answer. graphify keeps an explicit graph with a reason on every edge, so graphify path "FastAPI" "ModelField" prints the hops between them.

Verdict: Star it for deterministic parsing with explained edges. Boundaries: the AST cache schema changes between releases, so the first build after an upgrade re-extracts everything. The semantic pass over documents and PDFs costs model calls, which the code path does not.

Current signal: Rank 9 with 3,254 stars this week and 13,526 captured. 675 commits, the second-busiest repository on the board, and seven releases from v3.1.2 to v3.2.5 between October 20 and October 25. MIT, created May 21, 2026, written in Rust. 29 Each release body is a list of SHA256 checksums for the RPMs, tarballs and plugin zips. 30

Problem solved: Every agent keeps its own notes on one machine. Change harness, change laptop, or hand the work to a colleague, and the context explaining why the last approach failed is gone.

Implementation: A server you run on a laptop, a homelab box or a remote host, plus hooks for more than twenty harnesses. Handoffs are a typed protocol with an owner, claimed exactly once. ai-memory run codex hands Codex the shared workstream plus a private local projection of Claude's visible history, while the server sees only the harness and session identity. 31

A profile of how you work — package manager, test layout, architecture habits — reaches every new repository at session start. It is on by default for a single user and opt-in per person on a shared server.

Differentiation: The memory built into Claude Code or Cursor keeps notes for one tool on one host, which is the limit ai-memory's README opens by naming. ai-memory makes the store the shared thing and each agent a client of it.

Verdict: Star it for the handoff protocol and the local projection of native history. Boundaries: you host a server and install hooks on every machine. Seven releases carrying checksums and no notes means the commit history is your changelog, and the newest commits are narrow fixes to profile and restore scopes.

Current signal: Rank 10 with 4,790 stars this week and 142,942 captured, the third-largest total on the board. 47 commits and five releases from v0.42.1 on October 18 to v0.42.5 on October 22. GPL-3.0, created January 17, 2023, default branch master. 32 This is its first appearance here as an entry.

Problem solved: A visual professional needs a model, a sampler, a conditioning chain and a control image combined in one order, and needs that same combination again next month without rebuilding it by hand.

Implementation: A visual node graph with reusable subgraphs, workflow templates, App Mode and a local API for putting a workflow inside an application. Every pipeline is a graph of typed nodes saved as JSON, and models, checkpoints and custom nodes plug in beside the shipped ones. 32

The change that matters landed just before this window. v0.42.0, published October 18 at 6:10 p.m. ET, added a Krea 3 image node, MOSS-image support, a second round of Qwen 3.x performance work and workflow-template updates. 33 v0.42.1 fixed crashes in the MOSS template, and the tags after it carry one-line notes. 34

Differentiation: A closed image app gives you sliders over its own pipeline. ComfyUI gives you the graph, which is why other products embed it rather than reimplement it.

Verdict: Star it for the graph, with the licence read first, because GPL-3.0 shapes what you can put in a commercial product. Boundaries: 5,347 open issues and pull requests, and a shared workflow JSON can break when a node is renamed. The README also warns that commits outside a stable tag can break many custom nodes, so a pinned release matters here more than usual.

Attention and work came apart again, in a different shape from last week. Rank 1 has not moved since September 14 and still took 15,072 stars, a third of everything it has ever collected. Rank 2 shipped 28 releases in seven days and took 2,987, under four percent of its total. The two largest repositories on the chart, OpenCode and ComfyUI, grew by under four percent each; the two smallest, ai-memory and android/skills, by a quarter and by a ninth.

Release notes and release cadence came apart as well. ruflo shipped 28 versions with detailed entries, and hyperframes 26 with entries that sometimes say they repeat the version before. ai-memory's seven bodies are checksum lists. OpenCode's five v2 tags say nothing beyond the version number. Two projects shipped no version at all: knowledge-work-plugins made seven commits, and security-audit-skill made none.

What the ten have in common is where they sit. Eight of them need another vendor's agent to do anything: Cloudflare's skill and Google's skills for a coding agent, Anthropic's plugins for Cowork, graphify for Claude Code, Cursor, Codex or Gemini CLI, ai-memory as a server between harnesses, hyperframes as the renderer an agent calls, ruflo as the harness layer, Orca as the room several agents share.

Three of the eight come from large companies: Cloudflare's audit skill, Google's Android skills and Anthropic's Cowork plugins. A company that wants its expertise inside an agent can now publish it as a skill directory, which arrives with no version number, no support contract, and sometimes no installer at all.

For a first experiment, take the entry whose blocker you can already clear: a licence you can live with, a service you are willing to host, a version you can pin. A star records that a project moved. Whether it belongs in your toolchain depends on the boundary, and no star count measures that.