24 October 2026

Coding agent skill for multi-phase security audits

A coding agent skill that runs a security audit in six phases, from reconnaissance to the final report. Findings are written to findings.json and verified by other agents.

• Each candidate finding is handed to a fresh verifier that tries to refute it. Final results fall into three groups: confirmed, needs_validation, and rejected.
• Repeated runs on the same repo are additive. The earlier ledger and findings are used to target gaps not yet covered.
• This skill is the starting point of the Cloudflare vulnerability discovery harness described on their blog.

Source code of the PHP interpreter

The PHP source repo, a general-purpose scripting language well suited to web development. Licensed under the Modified BSD License (BSD-3-Clause).

• Building from Git requires autoconf, bison, and re2c. The default build also needs libxml2 and libsqlite3.
• The sequence is ./buildconf, then ./configure (--enable-debug is recommended for development), then make -j4.
• Prebuilt binaries for Windows are available at windows.php.net. For other systems, see the installation chapter on php.net.

Claude Cowork plugins for each work function

A collection of 11 open source plugins for knowledge workers in Claude Cowork, also compatible with Claude Code. Each plugin contains skills, connectors, slash commands, and sub-agents.

• The plugins cover productivity, sales, customer-support, product-management, marketing, legal, finance, data, enterprise-search, bio-research, and cowork-plugin-management.
• The structure is file-based: .claude-plugin/plugin.json, .mcp.json, and the commands/ and skills/ folders.
• Plugins can be customized to a company's own tools, terminology, and processes.

Secure runtime for autonomous AI agents

A runtime that runs AI agents in isolated sandboxes. File, syscall, and network access is governed by policies written by the user.

• Every network connection is checked against policy before it leaves the sandbox. The agent never sees the real credentials; OpenShell adds them only to requests going to approved endpoints.
• Policy changes are checked with formal verification. New risky access waits for human review.
• SDKs are available for Python, TypeScript, Go, and Rust.

Open source Zi Wei Dou Shu chart engine

An open source engine for building Zi Wei Dou Shu charts, a traditional Chinese fortune-reading practice, based on the Ni Haixia system. It includes the algorithm, the Si Hua system, and data from classical texts.

• The v4.0 interpretation dataset (15 October 2026) contains 674,976 charts x 13 dimensions, which is 8,774,688 text segments, 56.6 GB after extraction.
• The code is MIT licensed and the data is CC BY 4.0. Quotes of Ni Haixia's statements are under a non-commercial license.
• The README notes limitations in the analysis of relatives (parents, siblings, children), so the results are for reference only.

Offensive security skill library for Claude

A collection of SKILL.md files on offensive security for Claude, from SQL injection to exploit development. Intended for authorized red teams, bug bounty, research, and CTFs.

• Skills are grouped by category, for example Web Application (16 skills), Wireless (14), and Infrastructure & Red Team (7).
• Skills are loaded based on conversation triggers, so context is not spent on skills that are not invoked.

Tokenizer-free TTS for 30 languages

A tokenizer-free text-to-speech system with an autoregressive diffusion architecture. VoxCPM2 has 2B parameters and was trained on more than 2 million hours of speech data.

• Supports 30 languages, including Indonesian, plus voice design from text descriptions and voice cloning from short reference clips.
• Audio output is 48kHz. RTF is about 0.3 on an RTX 4090, and about 0.13 with Nano-vLLM.
• Weights and code are licensed under Apache-2.0.

Open source cross-platform JavaScript runtime

An open source, cross-platform JavaScript runtime, with an open governance model and the support of the OpenJS Foundation.

• Releases follow semantic versioning. Every October, a new release line (for example Node.js 27) branches from main and receives Alpha releases for 6 months.
• Alpha is promoted to Current every April. Alpha releases are meant for library authors and CI pipelines, not for production.