Rea Slows Again, a Free-Model Plug-in Names Who Pays, and Five of the Top Ten Now Check What Agents Emit

Last issue closed on three things to check this week, and the first one failed. The September regulars that had just come back — Orca, Ponytail and DeepSeek Harness — are all off the main board again, so the idea that they had returned to stay lasted a single issue. What took their places is a cluster: skills and plug-ins that put a check between a coding agent and whatever it is about to emit, whether that is the look of a generated frontend, the safety of an agent's behaviour, or a spec written before any code exists. The other two checks come out mixed. Rea is still first and still slowing, and the keyless free-model plug-in now says, in its own README, whose models it hands out. The breakout board starts over completely, and it leans toward software that keeps everything on the user's own machine.

#1 morluto/rea — an extensible reverse-engineering bridge that lets AI agents inspect binaries and applications to explain and replicate features

+34,128 stars this week → 418,676 · rea star curve

2026-W41: +1,553 · 2026-W42: +101,495 · 2026-W43: +218,506 · 2026-W44: +62,579 · up and down across 5 issues · Earlier: 1,125 stars on 2026-10-04

Last issue we wrote that rea's acceleration had broken, and the week since has settled what kind of break it was: a deceleration, not a stall. The weekly gain has now fallen two weeks running, steeply the first time and less steeply the second, while the project stays first by a margin nothing else on the board comes close to. The daily readings on its star curve show no flat stretch and no spike, only a ramp whose slope keeps shrinking through the week — a different story from the one we told, and a less dramatic one. We also said that on the breakout board a single skill file was arguing rea's approach is heavier than it needs to be. That file, leanrea, did not return to the breakout board this week, so the argument either went quiet or moved somewhere we do not track; we cannot tell which. What rea is has not changed: an MCP server that gives an agent the means to look inside a binary, an application or a running process and explain how a feature works, so that someone can rebuild it without the source. The repository dates from April and is MIT-licensed, and third-party write-ups say it works with disassembler backends such as Ghidra, Hopper and IDA. We have not checked that against the repository, so treat it as a pointer rather than a finding.

#2 Ebony-Vinyl/dsh-our-free-model — Free LLMs in DSH – no API keys, no caps

+12,826 stars this week → 55,739 · dsh-our-free-model star curve

2026-W42: +7,140 · 2026-W43: +15,852 · 2026-W44: +18,186 · up and down across 4 issues · Earlier: 1,735 stars on 2026-10-06

Last issue ended by asking whether anyone would say who pays for dsh-our-free-model's free models, and the README now does, at some length. The plug-in runs no models of its own. It forwards requests to public gateways — the free lane of OpenCode's Zen gateway and Kilo AI's public pool of free models — and to the account pools and daily credit allowances of a string of vendor coding tools. So the answer is that the upstreams pay, with free tiers and credits they hand out to attract users, and the README itself warns that the Kilo pool may log prompts to improve its service and that sensitive content should not be sent through it. The detail that matters more for reading this board is one channel. It appears only inside two desktop hosts, and the README says it checks, on the server side, that the user has logged in with GitHub and starred the repository before it lets a conversation through. We cannot say how much of the growth comes from that gate, but it means some of this project's stars are a toll rather than an endorsement, and a ranking by stars added cannot tell the two apart. The plug-in is second on the board for the second week running, though its gain fell this week after rising the week before. That is the number to watch now that the upstreams are named.

#3 pbakaus/impeccable — a design-guidance framework that provides 24 commands and 62 automated rules to improve the quality of AI-generated frontend code

+11,631 stars this week → 99,300 · impeccable star curve

Earlier: 75,289 stars on 2026-10-04

A set of commands you install into a coding agent so you can talk about design precisely: bolder, quieter, polish, critique, audit and about two dozen more. It is for developers who let an agent build their interface and keep getting the same generic result: one typeface for everything, purple-to-blue gradients, cards inside cards. Each command loads a playbook for the move you name and points it at a single target, a reviewer scores the design and ranks what to fix first, and a rule-based detector flags the familiar tells with no model call and no API key. Setup is one install command plus an init step that writes a product file, which every later command reads. It works across a long list of coding tools, from Claude Code and Cursor to Codex and Gemini CLI.

#4 Nutlope/hallmark — a design skill that crafts human-looking web pages and lints out AI tells

+11,140 stars this week → 44,855 · hallmark star curve

Earlier: 29,481 stars on 2026-10-04

Hallmark is not new. It comes from Nutlope, the developer Hassan El Mghari, working with Together AI, it is MIT-licensed, and third-party sites were already writing it up in May, so this week's climb is a rediscovery rather than a launch. By its README it is a skill loaded into Claude Code, Cursor or Codex with four verbs: build a page, audit an existing one, redesign it, or study a screenshot or URL and extract its structure, palette and typography into a reusable description without copying pixels. Building picks a layout for the brief, applies one theme from a catalogue, and runs the result through a long list of checks for the habits that make generated pages look generated before anything is handed back. The output is plain HTML and CSS, deliberately without a framework. Set beside impeccable, which sits one place above it, the split is clear. Impeccable constrains what the agent knows: a product file written at setup, against which every later command is checked. Hallmark inspects what the agent produced, and it can do that to pages it did not make. Both bet that the cure for samey generated frontends is a rule set the model cannot talk its way past. Why they rose together now, rather than in the spring, neither README explains. What the board can say is that two projects with the same thesis were placed among the fastest in the same week.

#5 debpalash/VoiceStudio — a local-first desktop suite for voice cloning, dubbing, and transcription with support for 646 languages

+11,128 stars this week → 97,898 · VoiceStudio star curve

2026-W43: +16,589 · 2026-W44: +11,472 · up and down across 3 issues, after a week away · Earlier: 52,583 stars on 2026-10-04

The open-source answer to a paid cloud voice service: the repository describes it as a fully local alternative to ElevenLabs. From one desktop app you can clone a voice from a clean reference recording, design a new one from a written description, dub a video with the speech timed to the original, dictate, transcribe, and turn text into audiobooks, and a local API and MCP server let other tools call it. It is for creators, translators and anyone who produces voice work regularly and would rather not send recordings to a hosted service. The models are downloaded to your own machine, with OmniVoice from k2-fsa as the default engine and dozens of others to swap in, and the project is licensed under the AGPL.

#6 HKUDS/DeepTutor — a self-hosted agentic platform for personalized lifelong learning and knowledge management

+10,462 stars this week → 53,641 · DeepTutor star curve

Earlier: 40,788 stars on 2026-10-04

A self-hosted AI tutor that you run yourself and point at your own material. You load documents, books, folders or web sources into a knowledge base, and it teaches from them: reading a document beside the chat with answers cited page by page, generating quizzes and practice from a question bank, compiling books and narrated video lessons, and keeping a learning memory per account, with exports to Anki and a calendar. It is for students and self-taught learners who would rather study from their own sources than from a model's general knowledge, and it works with a long list of model providers instead of one. The project ships fast: its changelog shows a release every few days, the latest only days ago.

#7 cloudflare/security-audit-skill — a structured security auditing framework that turns coding agents into adversarial vulnerability hunters

+9,509 stars this week → 56,353 · security-audit-skill star curve

2026-W44: +15,691 · down from the last issue, after a week away · Earlier: 23,923 stars on 2026-10-04

Cloudflare's own process for hunting vulnerabilities with a coding agent, released as a skill; Cloudflare calls it the forerunner of the harness it now runs on its own code. It is for security engineers and maintainers who want an agent to audit a whole codebase rather than comment on one file. The reason to use it is the structure: the agent that reports a finding is never the one that confirms it, because a separate set of agents tries to disprove each candidate before it reaches the report. Cloudflare is open about the limits. By its own measurement a single run finds only about half of what several runs find together, so it is meant to be run more than once, and it needs an agent that can spawn parallel subagents and, if it builds or runs the target code, a sandbox.

#8 togg53192-cmd/jailbreaks — a curated library of system prompts and persona configurations for testing and controlling AI model behavior

+9,236 stars this week → 12,931 · jailbreaks star curve

Earlier: 3,506 stars on 2026-10-23

A paste-ready collection of system prompts, persona definitions, workspace policies and AGENTS.md files, written to change how specific models behave and organised by model, from free models served through OpenCode Zen to open-weight families and closed frontier ones. Its README frames it as research and educational material on how instruction hierarchies, persona framing and policy overrides shift a model's behaviour, and warns against using it to harm others or to break a provider's terms. Its users are red-teamers and defenders studying prompt weaknesses and, since that is what a jailbreak collection is for, people who want a model to ignore its restrictions; the star count cannot tell us which group dominates. It is the raw material the auditing tools elsewhere on this board exist to catch.

#9 ifixai-ai/iFixAi — an independent auditing framework that simulates business scenarios to stress-test AI agent safety and policy compliance

+8,085 stars this week → 42,494 · iFixAi star curve

Earlier: 20,022 stars on 2026-10-04

iFixAi sells two things under one name, and the number on this board belongs to the free one. The commercial side, described on its Product Hunt pages, is a hosted audit that runs a couple of hundred inspections across dozens of categories of misalignment and maps the findings onto frameworks such as the EU AI Act, the NIST risk management framework and OWASP's list for LLM applications. The open-source tool in the repository is described on its own methodology page as a diagnostic rather than a certification, and it runs roughly an eighth as many inspections as the marketing figure. The hosted product and the free repository are not the same instrument, and the stars here are for the smaller one. Its method is what puts it on this board. It places an agent in a simulated business, sends requests designed to push it past its authorised role, and has a panel of models the agent does not run on grade the responses for things like fabrication, manipulation and deception. A third-party review notes that when an adapter exposes little of the agent's internals, inspections come back with insufficient evidence rather than a pass, a limit worth knowing because an audit that cannot see inside is mostly auditing what the agent says. Where Cloudflare's skill audits a codebase, this one audits behaviour.

#10 google/elephant-goldfish-model — a spec-driven development plugin that stress-tests design specs with zero-context AI subagents

+7,957 stars this week → 8,941 · elephant-goldfish-model star curve

Earlier: 334 stars on 2026-10-24

Elephant-goldfish-model is the youngest entry in the top ten: a little over a week ago it had only a few hundred stars, and it is Google's own repository rather than a community take on someone else's idea. Its premise is that a coding agent should not write code straight from a thought. It should write a design spec first, and that spec should be attacked by readers who never saw the conversation that produced it. The agent with the full context, the Elephant, drafts the specification. Subagents with no context, the Goldfish, see only the draft and the live source, and review it in fixed roles, among them a design critic, a naive reader and a tech lead. The person keeps the architecture decisions throughout. Everything we know about how it installs comes from a single third-party write-up, which lists marketplace commands for Claude Code, Codex and Antigravity that all point at the same repository. That suggests it was built to run on other companies' agents as well as Google's own, though we did not confirm it against the repository. If it holds, it matters more than the stars do: the company with the most to gain from steering developers toward its own tools published a workflow that works inside other people's. It is the same bet as the design skills above it, made on prose rather than pixels.

Breaking out

Ranked by growth relative to their own size, not by stars added. These are small enough that a week can multiply them — and small enough to have escaped you.

AienTech/dossier · +624.2% this week → 3,766 stars · dossier star curve

Earlier: 482 stars on 2026-10-25

A self-hosted job-search workspace for one person on a small server. You keep your career history in a single profile; for each posting it reads the requirements, shows where you match and where you do not, and drafts a resume and cover letter that may only use facts from that profile, so a missing skill shows up as a gap instead of being invented. It runs against a model of your choice, including a local one through Ollama or LM Studio, so the profile never has to leave your hardware, and it can be driven from Claude over MCP. It never sends or applies for you. The repository is under a copyleft licence and was started in early October.

rddmwmddr/android-ad-cleaner · +462.2% this week → 5,628 stars · android-ad-cleaner star curve

Earlier: 1,001 stars on 2026-10-26

Turns off the built-in ads, hot-search feeds, recommendation feeds and marketing notifications on Chinese Android phones, using the switches the system and its apps already expose; it needs no root, does not touch system updates, and suspending the ad packages is the one step that asks the phone's owner and can be undone with a single command. Orders, deliveries and update notices are left alone. The project is under two weeks old and is the one entry on either board with nothing to do with AI, apart from a mode that lets an agent run the steps. Its latest release added signed desktop installers for Mac and Windows, so using it no longer takes Python or an AI tool; that is one plausible reason it spread past developers, though we have no way to test it.

anomalyco/hex · +449.2% this week → 3,246 stars · hex star curve

Earlier: 303 stars on 2026-10-10

Local voice dictation for Mac, Windows and Linux: hold a key, speak, let go, and the transcript is pasted into whatever app has focus. The first run downloads a speech model and after that nothing leaves the machine. It comes from Anomaly, the group behind the OpenCode coding agent, and the README says the project takes no pull requests: you open an issue, and their agents usually turn it around fast. It is VoiceStudio's instinct, keeping the audio local, reduced to a single keystroke.

nightly-labs/openbot · +364.8% this week → 4,518 stars · openbot star curve

Earlier: 347 stars on 2026-10-04

A desktop workspace where each AI teammate is a long-lived agent with its own workspace, message queue and conversation, plus an embedded browser they can open and drive. It does not bring a model of its own; it wraps the coding agents you already have, among them Codex, Claude Code, Grok, OpenCode, Gemini and Cursor, and lets them message one another and hand files across. The README is candid about the cost: this is a development preview, agents run with full access and no per-action approval after a first-launch consent, and it describes itself as local-first rather than offline-only, since every agent still talks to its own provider. The licence is non-commercial.

SoMarkAI/OXR · +313.7% this week → 2,830 stars · OXR star curve

Earlier: 361 stars on 2026-10-24

A small document-parsing model that turns PDFs and scanned pages into Markdown or JSON with layout coordinates, from a company called SoMark. Its README claims first place on three document-parsing benchmarks at roughly one and a third billion parameters; those are the authors' own numbers and we have not reproduced them. The design choice that stands out is a layout stage that can be swapped for your own detector while the model keeps handling recognition and reading order. A free hosted API is offered without registration, with the stated condition that it stays up until the authors can no longer afford it. Everything else on the breakout list is an application you install; this is a component you call.

Three things to check next issue. Whether rea's weekly gain keeps bending or finally flattens. Whether dsh-our-free-model holds second place now that its upstreams are named. And whether Impeccable and Hallmark stay on the board together, or one of them fades the way the September regulars did.