GitHub AI Weekly · Issue 14 (Nov 14, 2026) · AI Beyond
AI Beyond Editor2026 week 461 views
Ten AI projects from the week 46 GitHub Trending weekly list, ranked by weekly star gains as of 02:56 Beijing time on November 14. This issue covers coding, agents and retrieval context, with closer looks at metric definitions in NVIDIA Auto Ontology and independent specification review in Google’s EGM.
A coding-agent skill for multi-stage security audits with independently checked, machine-readable findings.
Stars
71,766
Forks
4,779
Open issues
126
Last commit
2026-09-14
Cloudflare’s audit skill returns with its latest main-branch commit still in September. The coverage ledger gives a new group of agents a place to find gaps and revalidate changed source.
Start with one input path and ask another engineer to reproduce a finding from the record before expanding to nearby modules.
Unresolved candidates stay in a validation queue. Check that the input is reachable and the reported outcome actually occurs before assigning severity.
An open-source alternative to Grok Bot that gives bots access to a virtual machine.
Stars
22,117
Forks
3,066
Open issues
1,054
Last commit
2026-11-13
Last issue covered phone connection status. Version 0.1.155 now clears the ready state when a cloud computer stops responding, tries one restart when safe and offers restart and replacement controls.
For remote jobs, try a disposable file and watch what happens across a disconnect before handing over lengthy work.
A write might already have finished when the machine returns to ready. Inspect execution records before repeating actions such as email delivery or a metered call.
Software engineering skills collected from the author’s own .agents directory.
Stars
323,692
Forks
27,164
Open issues
244
Last commit
2026-11-13
On November 12 the project merged wording changes for software-factory tasks. An adjacent commit distinguishes engineering tasks from CI jobs and calls for exploration to leave findings for the implementer.
Teams handing work between discovery and implementation sessions can check whether a real handoff explains where to change the code and why.
These are main-branch changes. The latest listed release, v1.3.2, is from October. Check the installed files before relying on the updated instructions.
A command-line interface that lets AI agents operate desktop applications.
Stars
23,211
Forks
1,720
Open issues
239
Last commit
2026-11-13
Version 1.3.0 fixes native-menu resolution on macOS and checks UI state transitions. The CLI reads accessibility trees and returns references to actionable controls, making it possible to trace which control received a click.
Use a test account and rehearse opening a menu, choosing an entry and reading the resulting state before automating work across applications.
Visibility depends on what the application exposes to accessibility tools. Snapshots, clipboard data and debug output can contain private material, so set permissions and log retention for the actual environment.
The examples gained 6,055 stars this week. The most recent verified main-branch change was on November 6, moving the Office skills to Apache 2.0. Readers encountering the repository this week are seeing an earlier licensing change.
Pick a document task and examine how instructions, scripts and examples fit together before reusing files under their applicable terms.
The licensing change has a specific scope. Read the license in the selected revision and test layout, formulas and exports on representative documents.
The authors describe a Python framework that represents data semantics as a graph, supports deterministic query generation and supplies context and provenance for LLM and agent workflows.
Stars
12,508
Forks
1,024
Open issues
121
Last commit
2026-11-13
NVIDIA merged semantic-layer enhancements on November 13. Auto Ontology catalogs metadata, metric definitions and lineage so a querying agent can look up what a field measures.
Data teams with two reports that disagree on a metric can record both definitions and inspect which one a generated query uses.
Docker Compose and Helm deployment paths involve Postgres, inference endpoints and data connections. Ambiguous definitions still need a person responsible for resolving them.
Deep dives
Suppose sales recognizes revenue on order creation while finance uses the date payment clears. Giving a model more historical reports may supply still more numbers labeled monthly revenue. Map the date fields, entities and sources behind each definition, then inspect which definition travels with the query. A reconciled internal example is a good trial.
Keep a small set of manually checked questions and deliberately switch the date definition. Inspect the table, rule and lineage behind each answer as well as the number. An accidentally correct result with no traceable explanation is a poor foundation for a metric shared across departments.
An open-source plugin for designing and reviewing software with agents.
Stars
18,526
Forks
1,378
Open issues
102
Last commit
2026-11-13
Google’s Elephant-Goldfish Model added an experimental Windsurf adapter on November 13. A drafter retains project context while reviewers work from the draft and its references, exposing missing assumptions before implementation.
Try a pending API design and ask a reviewer who missed the discussion to reconstruct the important decisions from the document.
The experimental adapter is a main-branch change. Plugin and context support vary by host, and the project owner still approves architectural tradeoffs and implementation.
Deep dives
A meeting may settle on retrying failures without recording a retry count, timeout or procedure for a partial write. A reviewer reading the specification and its references in isolation can expose details everyone in the conversation silently assumed. The plugin gives drafting and review different access to context, which makes it a way to test whether a specification can travel to another engineer.
Take one real change request and ask a reviewer to describe a normal path, a retryable failure and a failure that must stop, citing the document for each. Return gaps to the drafter and write down any risk the team accepts. The owner still decides what the tradeoff costs. The review earns its place when it leaves an implementable agreement.
Version 0.43.0 adds snapshot hints for controls with empty or shared accessible names. Icons, test identifiers or nearby row text can help distinguish identical buttons attached to different records.
Exercise two similar rows in a test list, then verify from the result which record the agent actually changed.
Hints depend on page content that can change. Confirm the target of destructive or financial actions and fix missing accessible names in pages you control.
An LLM-powered system combining market data and news with a dashboard and scheduled notifications. The author describes a cost-free scheduling option.
Stars
71,472
Forks
57,261
Open issues
54
Last commit
2026-11-13
Version 3.34.0 fixes a data interpretation issue: the Market Light score excludes VIX changes so rising volatility no longer counts as a rising market. The release also records where and why report generation times out.
Developers producing market summaries can replay known samples and inspect the input, scoring rule and generated text separately to locate a changed conclusion.
Data feeds, notifications and model calls have their own configuration and cost conditions. This scoring fix provides no evidence about predictive performance or investment returns.
The author describes these engineering skills for AI coding agents as suitable for production workflows.
Stars
117,080
Forks
12,243
Open issues
140
Last commit
2026-11-01
Version 0.6.15 was released October 31. It fixes a staged-secret scan that printed matching credentials. A November 1 commit also asks reviewers to check findings against code and baseline. The project continues to attract attention this week.
Try a dummy credential in a test repository and inspect the terminal, CI logs and agent context as well as the commit result.
Check whether CI respects the failure exit code. Detecting one test secret and protecting every credential in a repository require separate evidence.
This week’s signals
Several tools last week dealt with recovering state after interruption. Two handoffs stand out this time. Desktop and browser tools need to convey which object a button acts on, while metric catalogs and specification reviews need to convey the assumptions behind a conclusion. A final number or success message gives the next person little basis for proceeding.
The list includes both recent updates and repositories whose releases predate this week. Stars measure attention over the collection window. No standalone multimodal or model-inference project appears in this top ten. For a trial, bring a commonly confused control, a frequently miscalculated metric or a specification that was difficult to hand off, and compare the result with a known answer.
