Top 10 Trending AI Repositories on GitHub This Week:

1. security-audit-skill When integrated into tools that let AI write code, it automatically runs multi-stage security audits. Issues found are individually verified before being returned in a machine-readable format. https://github.com/cloudflare/security-audit-skill…

2. orca A workspace for running multiple coding agents in one place. It can be run on desktop, mobile, or remote setups using your own subscription plan. https://github.com/stablyai/orca

3. graphify Converts document or database definitions, PDFs, and code into searchable knowledge graphs. Parsing is fully handled locally for the code portions, and you can trace each connection’s basis one by one. https://github.com/Graphify-Labs/graphify…

4. hyperframes Write in the same way you’d build a web page, and it exports directly to video. It’s a video generation system designed with the assumption that AI will handle everything automatically. https://github.com/heygen-com/hyperframes…

5. TradingAgents A framework where multiple AIs divide roles to deliberate on financial trading decisions. You can split and combine roles like analysts and decision-makers. https://github.com/TauricResearch/TradingAgents…

6. opencode An open-source coding agent. Since it’s public, you can tweak and run it in your own environment. https://github.com/anomalyco/opencode…

7. andrej-karpathy-skills A single config file for tweaking Claude Code’s behavior. It’s built based on AI coding pitfalls pointed out by Andrej Karpathy. https://github.com/multica-ai/andrej-karpathy-skills…

8. claude-seo A skill set for handling SEO tasks with Claude Code. It consists of 26 small skills and 19 support roles for technical fixes related to search rankings and data organization. https://github.com/AgriciDaniel/claude-seo…

9. knowledge-work-plugins Anthropic’s official plugin collection for knowledge workers. It’s primarily designed for use on Claude Cowork. https://github.com/anthropics/knowledge-work-plugins…

10. ai-memory A system for giving long-term memory to AI development support tools. It makes it easier to hand off work between different tools. https://https://t.co/3pV6Z7kL8m

cloudflare/security-audit-skill

Source: https://github.com/cloudflare/security-audit-skill

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare’s vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

1. Reconnaissance – map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting – assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation – give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output – write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification – fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting – derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Files

Installation

Install the skill with the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

Use --global for a user-level installation:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

Run npx skills --help for agent-selection and non-interactive options.

Usage

Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit:

security audit this codebase

find security vulnerabilities in ./src

do a security review, output to ~/audits/my-project

The skill activates automatically when the request matches its trigger (security audit, find vulnerabilities, pen-test the code, etc.). A direct codebase audit or pen-test request uses full audit mode. Security questions and focused vulnerability work use guidance mode unless you request report artifacts. In full audit mode, an unspecified output directory defaults to ~/security-audit-skill/<repo-name>/run-<N>. The workflow writes inside the target repository only when you explicitly select a directory that version control ignores.

Requirements

• A coding agent with a model that supports tool use and parallel sub-agents
• Node.js for the zero-dependency findings and coverage-ledger validators
• An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. It must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths. Without these controls, the workflow keeps the lead as needs_validation instead of executing target code.

Design principles

• Only confirm established boundary failures. Keep a source-grounded blocked lead as needs_validation with its exact unresolved fact.
• Adversarial validation. The agent that checks a finding is never the agent that found it.
• Severity requires impact. Likelihood x impact, not deviation from a checklist.
• Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.
• Multiple runs improve coverage. In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.

Contact

Questions, feedback, or comparing notes on AI-driven security tooling: [email protected]

License

MIT – see LICENSE.