Summary

Andrew Warner and Adam run through ten trending GitHub repositories for the week of 18 September 2026, plus viewer submissions. The format is conversational commentary over screenshots rather than hands-on testing — they say explicitly that they cut the demonstration clips they had prepared because playing them was tedious, so almost nothing here is verified by the presenters. Two sponsors are read out during the episode, one of them a product in the same category being discussed, and star counts are quoted loosely and inconsistently. Treat every figure as repeated rather than checked. The value is as a sweep of what the developer-tooling layer was paying attention to that week, and for two genuinely useful distinctions drawn in the discussion.

• The sharpest observation in the episode, credited to a commenter named as Black Logic: skill packs matter far more for weaker models than strong ones. A capable model already knows how to do test-driven development, so the skill adds little; a smaller local or open-weight model needs to be told the practice exists and walked through it. This reframes skills as a capability-levelling mechanism rather than a universal improvement.
• A clear security distinction between skills and plugins, made by Adam. A skill has limited control because the model remains in charge, but installing a plugin 'is like installing software on your computer' — plugins can carry scripts and executable code and are granted access to data, code and secret keys. His conclusion is to install plugins only direct from a first-party source, and it is the more considered security point in the episode.
• Both presenters treat automated security review of AI-written code as settled practice rather than an option. Adam's framing: if you are not reading every line, you do not know whether the model made mistakes or whether your own changes opened doors you did not know were open, so running a checker — ideally automatically via a pre-commit or pre-push hook — is 'table stakes'.
• Alibaba's Open Code Review is the week's top repository. They relay a third-party demonstration in which someone deliberately planted problems including a plain-text password and reports the tool found them, and generated an HTML report from a single command. Neither presenter ran it; this is a description of somebody else's video.
• A reported claim about model verbosity, offered as personal experience: Adam says he is moving work away from Astra back to an earlier model because Astra 'is so verbose', takes longer to run and generates more to read through — and that the verbosity shows up not just in chat replies but in the copy it writes for pages and emails. He argues verbosity-reducing skills are becoming more useful because models are getting more verbose. One practitioner's impression, no measurement.
• The 'I have ADHD' repository — a single file instructing a coding agent to keep responses short and scannable — is reported at 47,000 stars and repeatedly trending. It is the demand side of the same verbosity observation.
• A significant industry claim appears inside a paid sponsor read and should be treated with corresponding caution: that Stripe 'just bought' OpenRouter for $7 billion. It is stated in passing as an analogy for the sponsor's product, with no source, no date and no corroboration anywhere else in the episode. Worth verifying independently before it is relied on.
• The sponsor itself describes a real structural problem: an agent that touches many APIs accumulates a separate subscription for each. Its pitch is one key into a claimed 1,800 tools billed per call with no subscriptions. Presented as advertising, not assessment.
• The 'context mode' repository, reported at 23,000 stars, is explained via a pattern worth keeping independent of the tool: run exploratory work in a disposable side session, so the main conversation receives only the vetted answer rather than the fifteen files opened, the tool calls that failed, and the two wrong turns taken to reach it. The main context then holds the work rather than the searching.
• Git worktrees are explained as the mechanism for running several agents in parallel, and the failure they solve is described concretely: agents pointed at a single checkout edit the same files, collide over who changed what, and break features. Giving each agent its own working copy of the same project avoids it, with branches merged back afterwards. The tool discussed, Work Trunk, is reported at 7,900 stars.
• A skills pack reported at 95,000 stars is presented as one ordered workflow rather than a collection: spec, then plan, then code, then test, then review, then ship. Adam's point is that most people start at 'code' and skip both ends, and that test and review are the most commonly skipped. He extends 'ship' to production validation, noting people report work that functioned on their own machine and failed once deployed, discovered only when users complained.
• A workflow collection referred to as ECC is quoted at 261,000 stars early in the episode and as 'a quarter million' later. Its argument is that decades of accumulated software-engineering practice can be injected into the sessions of people building today without that experience.
• Tencent's Nora is described as an automatic knowledge graph over a personal machine — characterised by Adam as an Obsidian, RAG, AI and graph-database combination — that infers relationships between documents, people, meetings and projects and produces a browsable wiki. The presenters note the demonstration material is in Chinese and neither has used it.
• The tenth entry is a repository for Claude Code itself, and the presenters correct their own initial excitement on air: it is not open source. Adam's explanation is that it is a normal repository minus the code — readme, install instructions, issues, pull requests and documentation — existing so bug reports have an obvious home and can be tracked by the team. Warner says plainly it is less exciting than he hoped.
• God's Eye View — the 3D globe aggregating public flight, ship, satellite and CCTV data — appears on the list again, the second independent source in this batch to feature it. They add that a packaged one-click install exists for anyone not wanting to set it up from the repository.
• Viewer submissions cluster around a single theme: managing several agents at once. A project-centred workspace that opens a project first and picks the agent second rather than the reverse, a dashboard showing which of the running sessions is stuck, and a spend tracker across several model providers for people who 'don't find out until you run out of cash'.

Why it matters

Two ideas here are worth carrying into the Handbook and both cut against the way tooling is usually sold. First, skills level models rather than improving them — the weaker the model, the more a workflow pack is worth, and a strong model gains little from being told a practice it already follows. That is a useful test to apply to any 'this makes your AI better' claim. Second, the skill-versus-plugin security line is a real distinction with a real consequence: one constrains a model that remains in charge, the other installs executable code with access to keys and data. Alongside the agent-skill scanning tool in the Jack Roberts entry from the same week, it says the supply chain for agent extensions is becoming a security surface in its own right. The parallel-agent material — worktrees, dashboards to find the stuck session, cross-provider spend tracking — is the quieter signal: the practical problems people are solving have moved from getting one agent to work to keeping five of them from colliding. Everything factual here is second-hand. The presenters explicitly did not demonstrate the tools, star counts are quoted inconsistently within the same episode, and the largest business claim in it — a $7 billion acquisition — arrives inside a paid advertisement with no source. It should be checked before it is repeated.