GitHub Trends · Episode 18: Agent Skills, Graphs, and Clusters — Three Lines Moving in Parallel

It's Monday again — time for our weekly roundup. I scanned the GitHub charts this week, and I had this really strong feeling.

Go on — I bet it's the same thing I saw. The whole page is nothing but skills.

Exactly! Eight out of ten trending projects are adding skill packs to agents. That can't be a coincidence.

Definitely not. But that's not the point. The point is everyone's assuming one thing: model capability is good enough now — what we're competing on next is how you organize that capability.

So let's dig into that thread. First up, the one that surprised me — Cloudflare actually jumped in and wrote a skill.

security-audit-skill — gained over eleven thousand stars in a week, now at forty-two thousand plus. A security audit skill blowing up like that tells you enterprises are really starting to move.

So what does it actually do? Is it the kind that scans for vulnerabilities?

Deeper than that. It's a multi-stage audit workflow — every finding has to be independently verified, and the output is machine-readable. Think about it: that means audit reports can go straight into the CI pipeline.

Oh, that's a key point. Security reports used to be written by humans, in all sorts of formats — impossible to automate.

Right, and it's written in JavaScript — which shows the skill itself is language-agnostic. The logic layer is decoupled from the code being audited.

Who's it for? Small teams that can't afford a security team?

Actually the opposite. The first adopters will be companies that already have security processes. What they need is to plug audits into the dev pipeline — not replace people.

Got it. Second one — Anthropic's own knowledge-work-plugins, thirty-two thousand plus stars, up twenty-six hundred in a week.

This direction is really interesting — it's aimed at knowledge workers, used inside Claude Cowork. Not for programmers.

Wait — isn't this just pushing skills from the developer market into the white-collar market?

Exactly. Think about it — writing weekly reports, organizing meeting notes, doing competitor research — all of that can become plugins. The user scale is a whole different order of magnitude.

From a product angle, this is really going after the office suite's ecosystem position.

Yep, and it's open source — which means they get to set the rules for the plugin ecosystem first. Smart move.

OK, now for something wilder. ruvnet/ruflo — seventy-six thousand plus stars, calls itself the original agent framework.

ruflo's pitch is multi-player clusters, adaptive memory, and federation. Basically, it lets a bunch of agents work together instead of going solo.

But doesn't that overlap with orca? orca has a hundred thousand stars, up eight thousand plus in a week — also managing agent clusters.

Different positioning. orca is a work platform — runs on desktop, mobile, remote, uses your own subscription. ruflo is more of a low-level framework, focused on orchestration and memory.

So one's the operating system, the other's the kernel?

That's a pretty accurate analogy. But I have to say — neither has solved the core problem yet: how do agents hand off context to each other?

Which brings us to ai-memory — written in Rust, twelve thousand stars, up twenty-six hundred in a week, focused on cross-vendor long-term memory.

Right, this project tackles a real pain point. You use Claude Code today, switch to Codex tomorrow — your memory can't be lost. What it's trying to be is a neutral standard for the memory layer.

Writing it in Rust seems deliberate too — runs locally, fast, and secure.

Yes, and memory feels safer local than in the cloud. That's its biggest difference from cloud-based solutions.

Then there's a big one — opencode, two hundred nineteen thousand stars, up fifty-seven hundred in a week. The giant of open-source coding agents.

It's basically the face of the open-source camp against commercial tools like Cursor. Written in TypeScript, highly extensible, and the community ecosystem is already thriving.

What about graphify? A hundred thirty thousand stars, up sixty-eight hundred in a week. How does it relate to coding agents?

It feeds them. It turns codebases, docs, SQL, PDFs into a knowledge graph — no vector retrieval, and every edge is explained. That's huge for agents trying to understand large repos.

Not using a vector database is pretty counter-trend. Why?

Because vector retrieval isn't explainable. For something as strongly structured as code, deterministic parsing with ASTs is actually more accurate and traceable. That's an engineering judgment, not bandwagon-chasing.

Got it. What about android/skills and karpathy's CLAUDE.md? One has nine thousand stars, the other two hundred twenty thousand.

android/skills is the platform itself stepping in to define skill specs — the signal matters more than the star count. karpathy's is even more special — a single file hitting two hundred twenty thousand stars shows how badly people need consensus on behavior constraints.

Last one — TradingAgents, a hundred fifteen thousand stars, a multi-agent financial trading framework. Isn't that a bit dangerous?

The tool itself is neutral, but it shows agent clusters are moving into high-risk domains. In finance, multi-agent cross-validation is actually a necessity.

Alright, let me sum up the common thread this week. First, skills have become the new distribution unit — from code to interfaces to workflows, everything's getting skillified.

Second, agents are moving from solo to clusters — but clusters require memory and context to flow, so projects like ai-memory will only get more important.

Third, the way we organize knowledge is switching tracks. The structured approach graphify represents may coexist with vector retrieval long-term.

To sum it up: this week's charts tell us the agent race has shifted from comparing models to comparing engineering organization. Whoever nails the three layers — skills, memory, and graphs — wins the next stage.

If I had to recommend just one must-see, I'd pick graphify — because it changes how agents see code.

I'd go with ai-memory — small project, but it's sitting right at the choke point. OK, that's it for this week. See you next Monday.