Open Source Radar · 2026-10-27: Projects start marking their own limits

By Renchao Wu. Originally published on widechaos.cn.

Each day I pick five projects that are rising on GitHub this week, mostly AI agents and developer tools. I read each project's README, release notes, recent commits and licence file; I did not install them unless an entry says so. Stars and other numbers are from GitHub as of 2026-10-27.

These five have one thing in common: each one marks the edge of what it can promise. One puts an unfinished scan behind a failing gate you have to open yourself, one leaves the blind tests it lost in the README, one admits the agent never called its own tools, one says full local access is a product decision rather than a security boundary, and one prints patch duty in its self-hosting table.

1. NVIDIA/SkillSpector ⭐ 22,467 · Python

GitHub: https://github.com/NVIDIA/SkillSpector

In one line: A scanner that reports findings on agent skills before installation, with 71 rules in 17 categories and an exit code that works as a gate.

What it is: A Python CLI that takes a Git repo, URL, zip, directory or a single SKILL.md and writes a terminal report, JSON, Markdown or SARIF 2.1.0. Analysis runs in two stages: 11 static analyzers (regex, Python AST behaviour, YARA signatures, dependency lookups against OSV.dev), then an optional LLM pass over file contents. It is also part of NVIDIA's Verified Skills pipeline: scan, evaluate, sign, and the skills that pass go into NVIDIA's skills catalogue. Created 2026-03-21, latest v2.13.1 (2026-10-23).

What stands out:

• The model can add findings, never remove them. The second stage cannot drop a deterministic finding. Findings the model reviewed but did not confirm are tagged llm-unconfirmed; failed reviews keep the finding and set llm_review_outcome=failed. Five values — confirmed, disagreed, low-confidence, missing, failed — land in the JSON and SARIF, so a reader can tell what a rule caught from what a model agreed with.
• An incomplete scan can fail the gate, if you turn it on. Exit 0 means the scan finished, the score is at most 50 and no strict gate fired. Exit 1 means the score crossed 50, or --fail-on-findings hit, or --fail-on-incomplete found partial analysis, or --min-coverage fell under its floor. Exit 2 is an error. By default SAFE and CAUTION both collapse into 0; tightening that is your policy call.
• It expects false positives and provides a suppression channel. Known noise goes into a baseline by glob rule or fingerprint, so a re-scan reports only what is new. The mechanism cuts both ways: a loose baseline hides new problems too.
• The trust boundary is written down. It never executes the skill it scans, and says plainly that it is not a sandbox. With LLM analysis on — the default — file contents go to the configured provider; --no-llm turns only that stage off, keeping file contents in. The supply-chain check is a separate scope: it sends dependency names and versions to api.osv.dev, falls back to a bundled list when OSV is unreachable, so --no-llm is not the same as staying off the network.
• The vendor hit its own edge. v2.13.0 disabled the Codex CLI analysis provider because its read-only sandbox still allowed access to host secrets, and restricted the MCP HTTP listeners to loopback, requiring an authenticating proxy for remote deployments.

Compared with: the dimensions worth comparing are detection and false positives on the same set of skills, the upkeep cost of a baseline as versions drift, and how tight the gate is in CI; I have no side-by-side data for those three. What is readable directly is this project's gate design: three codes, with 0 only when the score is at most 50 and no strict gate fired. An unfinished scan is not a failure by default — --fail-on-incomplete has to be turned on for that.

Recent updates: v2.13.1 (10-23) corrected four kinds of false incomplete-analysis reports — ordinary Python report strings, quoted script text, regular expressions, possessives in Markdown prose — and a hidden-instruction false positive that spanned visible text between HTML comments. Report files are now written atomically, and symlinked destinations are refused. v2.13.0 (10-16) backported 55 selected pull requests onto the maintenance branch, including three security fixes and executable Python support. v2.12.0 (09-23) added OpenCode integration and optional CI controls.

Who it's for: anyone about to install a third-party skill, and maintainers who want it as an install gate in CI (SARIF 2.1.0 feeds straight in). Note that the default exit 0 lets SAFE and CAUTION both through; it does not execute or isolate anything, so passing the scan is not the same as running safely; and turning on the LLM stage sends skill file contents out.

My take: ⭐⭐⭐. Making "is this check trustworthy" part of the report is a separate layer from how many rules a scanner carries.

Checked: README (exit codes, trust model, limitations), three full release notes, the last five commits and the LICENSE. Not installed.

2. nightly-labs/openbot ⭐ 1,699 · TypeScript

GitHub: https://github.com/nightly-labs/openbot

In one line: A desktop workspace for agents — a working directory, a FIFO queue and an embedded browser per agent, plus messaging between agents.

What it is: An Electron shell with a SolidJS interface. Local provider processes connect three ways: the Codex App Server over stdio JSONL, the Claude Agent SDK over stream JSON, and Grok, OpenCode, Gemini, Cursor and Cline over ACP. State lives in a SQLite command log and read projections. Accounts are optional and run on Cloudflare Workers with D1, using one-time email codes that expire in ten minutes and are stored only as hashes. Created 2026-08-12, v0.51.1 (2026-10-26).

What stands out:

• One directory per agent, with a separate shared area. ~/OpenBot/Agents/<id>, ~/OpenBot/Shared, ~/OpenBot/Shared/Transfers; every file handover carries an .openbot-transfer.json manifest with ownership, recipients, size and a SHA-256. Passing a file between agents is treated as a delivery you can check.
• Queue state is persisted for recovery. FIFO, with pause, resume and cancel; the state sits in the database rather than in memory, The project describes recovering queued work after restart; persistence alone does not guarantee exactly-once downstream effects.
• Messages between agents have semantics. Not just forwarded text: replies, reactions, images and managed file transfers. Channel chats have a single task owner, with explicit delegation and Stop, Resume, Reassign, Archive and Restore.
• One agent can hold several conversation threads. The commit Give an agent more than one conversation thread (#3329) on 10-26 landed this; before that it was one thread per agent. That matters more than it sounds: long jobs and side questions no longer share a single context.
• Skills are a local library with a version guard. Agents create skills with create_skill; revise_skill must carry the version the agent read, and previous versions are kept. An installed copy does not follow library updates, modified installed files are protected, and registering a skill does not run its scripts.
• Full local access is a product decision, not a security boundary. The README warns that agents run with danger-full-access and approvalPolicy: never, able to read and write files, run commands, use the network and drive the embedded browser, with no per-action confirmation after the first-launch consent. SECURITY.md is blunter: full local access is an explicit current product decision, not a security boundary.

Compared with: what this adds is the collaboration layer: a workspace per agent, transfers with checksums, task ownership and delegation inside a channel. The licence is PolyForm Noncommercial 1.0.0 (matching the badge and the LICENSE), whose name defines noncommercial purposes; the LICENSE also ends with a Required Notice naming a commercial-licensing contact, [e-mail], and the repo added a commercial licence agreement page on 10-26. Whether that path fits a given use is a question for that agreement.

Recent updates: v0.51.1 (10-26) fixed the AppImage crash handler before unmount, mobile builds inside worktrees, added a CPU limit for Claude agents, fixed a Gemini crash on LXCFS, and added a commit telling an agent which computer it controls. v0.51.0 (10-26) moved Claude Code to its prompt-cache default and let agent routines open in the web app. v0.50.0 (10-25) let a channel request continue once a lead is set, naming that lead. Three releases in two days — still a development preview.

Who it's for: individuals running two or three coding agents at once and tired of one terminal window each; teams studying what multi-agent collaboration looks like. Keep in mind it does not isolate by default, the default licence is noncommercial (commercial terms go through the Required Notice contact), and preview-stage changes can be disruptive.

My take: ⭐⭐. The architecture is worth reading, especially queues and file handover; the product is still a preview, and any commercial use needs its own confirmation through the licence path above.

Checked: README (architecture, local data and network boundaries, security, licence), three release notes, the last five commits and the LICENSE. Not installed.

3. Graphicle-AI/graphicle ⭐ 364 · Rust

GitHub: https://github.com/Graphicle-AI/graphicle

In one line: One Rust program turns a repository into a code graph and stores project docs, decisions and past agent sessions in the same SQLite file, handing coding agents evidence with file and line references.

What it is: graphicle setup indexes the repository, builds the graph, connects the coding agents it finds, turns on session capture, adds two lines to AGENTS.md and installs post-commit, post-merge and post-checkout hooks; every file it changes is backed up first, and the project documents disconnect as its reversal path. I have not tested restoration after intervening user edits. The code-graph engine is a Rust port of Graphify (following 0.9.95, ported release by release); the memory, memory tools, app and session capture are its own. Created 2026-10-14, three releases in three days, latest 0.1.8 (10-26).

What stands out:

• The benchmarks say "not significant". On 100 held-out SWE-bench Verified issues, it put a file the fix changed in the top five for 75 of them, against 61 for BM25-style retrieval (McNemar exact p = 0.013). For the top one (43 vs 35) and the top ten (81 vs 77), the README labels the difference as not significant. Wins and non-wins sit in the same table.
• It admits the agent never called its tools. Across 100 tasks, plain Claude Code, its own default setup and Graphify 0.9.91 found every changed file in 95, 95 and 94 cases; it spent 16% more tokens than plain Claude Code and Graphify 29% more, and the README states that the agent never called Graphicle's tools. That line places the project better than one more improvement number would.
• The large-repo speed-up comes with its method. On a shallow clone of kubernetes (ca8a2a9e4, 30,315 files), over the 22 questions in issue #8, a single context call had a median of 1.34 s on 16 cores against 2.99 s for the previous version; peak memory 0.6 GB against 3.5 GB; the packet both versions returned was byte-for-byte identical.
• Deletion comes with a receipt. Per the project docs, deleting a memory or a captured session also removes what was derived from it and returns a hash-chained deletion receipt. The receipt is not independent proof that backups, logs or external providers have deleted all copies. Sync respects .gitignore and skips .env files and keys; session capture is documented to drop <private>…</private> spans and redact credentials. These filters do not guarantee complete secret removal.
• It listens on loopback by default. The app plus its HTTP and MCP endpoints bind 127.0.0.1. The network cases the docs list: a model or connector you configure, a full graphicle graph extract, GitHub CLI commands, a feed you name, a daily release check that is on by default (GRAPHICLE_NO_UPDATE_NOTIFIER=1 turns it off), and a one-time download of parser sources when building from source.

Compared with: on the code-graph side the engine is a port of Graphify and follows it release by release; on the memory side the README's own comparison table names Hindsight, Mem0 OSS, MemMachine, Honcho, Cognee, Graphiti and Mastra. The difference is putting both in one process with one citation format. The memory comparison numbers — 87.7 on LoCoMo-10 against 87.3 for Hindsight and 81.9 for Mem0 OSS, with about 12 model calls per conversation ingested against 160 and 332 — come from development sets, a single open model acting as both reader and judge, and a pre-release build. Those are exploratory project-reported results; they do not establish a general ranking or production benefit.

Recent updates: 0.1.8 (10-26) stopped decoding the whole saved graph on every question and now writes a query file beside the store after a build; projects that have not run sync since upgrading take a median of 22.5 s per question on the kubernetes shallow clone. 0.1.7 (10-25) moved the engine to Graphify 0.9.95, porting all four intervening releases, and started reading YAML files structurally as code nodes. 0.1.6 (10-24) allowed the SDKs to use plain http:// on every loopback address.

Who it's for: people willing to run an MCP service inside a repository and unwilling to stand up a vector store as well. The default limits are 100,000 text files and 1 GiB of text, so a large repository should check how far it sits from those. It is still 0.1.x and ships almost daily, the Windows build is an unsigned preview, and release builds are not yet signed with a trusted certificate.

My take: ⭐⭐⭐. Not because it is fast, but because it treats negative results as part of the delivery.

Checked: README (benchmark method, privacy, FAQ), three release notes, the last five commits and the LICENSE, plus the NOTICE credit to Graphify. Not installed; every benchmark number comes from the project.

4. alchaincyf/huashu-design ⭐ 27,290 · HTML

GitHub: https://github.com/alchaincyf/huashu-design

In one line: A design skill you install into any agent that supports skills: the project documents HTML prototypes, editable PPTX, motion and infographic exports, with 84 styles and a specimen for each.

What it is: A SKILL.md plus scripts and assets: ref_board.py screenshots reference work onto a reference board, learn.py stores the taste notes you actually said, design_lint.py measures only checkable facts, and other scripts handle export and review. Deliverables and timings are in its own table: interactive prototype 10–15 minutes, HTML deck plus editable PPTX 15–25 minutes, motion 8–12 minutes, infographic 10 minutes. Created 2026-04-19, v3.0.0 (2026-10-17). MIT, after a switch on 2026-05-14 from "free for personal use, commercial licence required".

What stands out:

• The brand workflow requires checking source assets. For a real brand it runs five mandatory steps: ask whether brand guidelines exist, search the official brand pages, download assets (SVG, site HTML, colour picked from screenshots — three fallbacks, next one immediately if the previous fails), grep every #xxxxxx out of those assets and sort by frequency while filtering out black, white and grey, then freeze the result into brand-spec.md and CSS variables. The stored specification gives later revisions a reference. Frequency in scraped assets alone does not establish the official brand palette.
• Six thumbnails first, three finished designs after. Three logics produce two candidates each: a best-designer pass, a real-world reference in the same medium (an App looks at award-winning Apps, a deck looks at publications, screenshotting before reading grid, type scale and colour ratio), and a seconds-wheel draw (date +%S picks a style). The chosen three must each be good alone, different from each other, and not repeat a recent project; the other three come along as backups.
• An appearance ledger records past styling choices. Every delivery records base colour, palette, type and layout skeleton, and the next project avoids them. Individually fine, collectively same-looking is the failure this manages — with a ledger rather than a ban list.
• The check-up only measures facts. Broken images, text too small to read, insufficient contrast and console errors are red; all-caps micro-labels and the "A · B · C" habit are yellow. Whether it looks good stays your call; it does not score taste.
• The author reports three rounds of blind tests, including losses. Round one forced a big metaphor into every version: one win out of four prompts. Round two answered AI-looking output with a pile of bans and made all three versions too tidy: zero out of two. Round three replaced bans with more options and is reported to have won both previously lost prompts. These small author-run comparisons do not establish a general quality advantage.

Compared with: the README lays out its own difference from Claude Design — a web product versus a skill, subscription quota versus API spend, canvas plus Figma export versus HTML / MP4 / editable PPTX / PDF, GUI editing versus conversation. It also credits the philosophy behind the brand-asset protocol to prompts that circulated from Claude Design: good high-fidelity design grows from existing design context rather than a blank page.

Recent updates: 3.0 (10-17) reworked the "three directions" step and grew the style library from 60 to 84 (12 new App styles, 12 Chinese and East Asian styles), each with a 1200×750 specimen and its source, and added the design check-up and the appearance ledger. On 10-23 the README got the 3.0 launch film as its header image and seven new cases (a Hokusai online exhibition, a birding app, a recipe app, a lecture deck on a Song-dynasty scroll, a black-hole deck), with the note that the agent chose the directions.

Who it's for: people who would rather not open a graphics application but still have to hand over something presentable; it is especially suited to Chinese-language design, since Song-print layouts, Republican-era book covers and Hong Kong street posters are in the library. Limits: no layer-editable PPTX export to Figma; Framer Motion-level animation, 3D and particles are out of scope; for a completely blank brand, the author gives a quality estimate of 60–65, without a comparable evaluation protocol established here.

My take: ⭐⭐⭐. It breaks "taste" into a note library, an appearance ledger and a check-up that only measures facts, and those three are what I most want to carry into my own workflow.

Checked: README (core mechanics, the Claude Design comparison, security and limitations), the v3.0.0 and v2.0 release notes, the last five commits and the LICENSE. Not installed.

5. gitroomhq/postiz-app ⭐ 38,683 · TypeScript

GitHub: https://github.com/gitroomhq/postiz-app

In one line: A self-hostable social scheduling platform: one dashboard for timed posts, calendars, repeated posts and analytics across a dozen channels, with MCP, a CLI and connectors for several agents.

What it is: A monorepo — NextJS front end, NestJS back end, Prisma on PostgreSQL, Temporal for scheduled work; apps/ holds backend, commands, extension, frontend, orchestrator and sdk, plus a @postiz/node SDK, an n8n node and a Make integration. One codebase, two ways to run it: hosted, or your own deployment. Created 2023-07-08, v2.25.3 (10-24), AGPL-3.0.

What stands out:

• The cost of self-hosting is a table. Cost, setup time, hosting and data, platform apps, channels, posts per month, team members, scheduling features, analytics, AI quota, agent surfaces, custom integrations, updates, uptime and backups, security patches, support, source access, compliance — each row says who owns it. Two matter most: updates mean pulling images and running migrations yourself, and uptime, backups and security patches are your responsibility.
• You register the platform apps yourself. The README describes registering developer apps and obtaining platform approval for self-hosted channel integrations; the README says Meta, YouTube and TikTok can take weeks.
• The patch cadence is itself data. Three patch releases on 10-11, 10-23 and 10-24 cite four security advisories between them (PSA-2026-4QX1WG, PSA-2026-JNXM56, PSA-2026-E9AHFV, PSA-2026-YT2HMH) and tell every user to upgrade immediately. In the same window the main branch carries commits titled fix: jwt bypass, fix: access to local files, and a change that only runs allowed provider methods from the integrations endpoint.
• Agent surfaces are a feature, not a bolt-on. The README lists MCP, a CLI and connectors for Claude, ChatGPT, Codex, Cursor, OpenClaw and others under "agentic surfaces"; the self-hosted build points MCP and the CLI at your own instance.

Compared with: the difference is not the channel list but the bill for self-hosting, written on the same page: updates, backups and security patches each marked as the user's, plus a suggestion to let your LLM do the deployment. The README also says it does not gate features or limit the licence in the self-hosted edition. The price is plain: you track the patches, and you go through platform review.

Recent updates: v2.25.3 (10-24) fixes the issues behind two advisories; v2.25.2 (10-23) fixes one and also points Instagram's error 2207053 at the platform's video limits and cancels subscriptions and removes team members when an account is deleted; v2.25.1 (10-11) fixes one and moves security reports to a role address instead of a personal mailbox.

Who it's for: people who want to own their content and data and can carry the operations; aimed at teams with several accounts across several platforms that need calendar views and repeated posts. Not for anyone expecting to install and forget — "patches are your responsibility" has a price in that column.

My take: ⭐⭐. The self-hosting bill matters more to my decision than the channel list does.

Checked: README (self-hosting comparison table), three release notes, the last five commits and the LICENSE. Not installed; I did not match each commit to a specific advisory.

At a glance

Project	What it is	Most distinctive	Who it's for	Worth digging
SkillSpector	Pre-install scan for agent skills	An unfinished scan can fail the gate (opt-in flag)	Anyone installing third-party skills; CI gates	⭐⭐⭐
openbot	Desktop workspace for several agents	A workspace per agent plus SHA-256 transfer manifests	Individuals running several coding agents	⭐⭐
graphicle	Code graph plus agent memory	Publishes "not significant" and "the agent never called Graphicle's tools"	Anyone adding a code graph to a coding agent	⭐⭐⭐
huashu-design	Design delivery skill	Keeps the two blind rounds it lost in the README	People who need deliverables without a graphics app	⭐⭐⭐
postiz-app	Social scheduling and distribution	Puts patch duty for self-hosting in the comparison table	Content teams that can carry operations	⭐⭐

This week's notes

• Uncertainty is moving into interfaces. SkillSpector can turn incomplete analysis into exit 1 — with --fail-on-incomplete switched on; by default the exit code follows the score band, and completeness stays a separate dimension outside the gate. Graphicle prints non-significant rows next to the significant one. The scanner provides machine-readable gating controls; the benchmark and design-test disclosures are evidence for readers to assess, rather than equivalent enforcement mechanisms.
• Negative results are becoming part of credibility. A project willing to write "the agent never called Graphicle's tools", "the top one is not significant" or "it lost both prompts in round two" lets a reader place it honestly. Publishing only wins means the reader has to discount everything.
• The bill for self-hosting is being written into READMEs. Postiz lists updates, backups and patches as your responsibility, and two patch releases citing security advisories on 10-23 and 10-24 (v2.25.2, v2.25.3) let you price that.
• Skills start carrying state. huashu's note library, appearance ledger and fact-only check-up keep taste notes and past deliveries as local records a program can read; the difference between skills is not just how many rules they state.

Of the five, the one I want to run first is SkillSpector as a gate over my own skill library — not because it has many rules, but because it will tell me which files it did not really understand.