Trending AI Briefing: Wednesday, July 15, 2026 (afternoon ET)
Scroll today's Trendshift board and count the repos that are not software at all, but instructions for software. A design skill sitting at sixth. A knowledge-graph skill at fifth. A marketing skill, a Karpathy-pitfalls skill, a personal skills directory, a Fable-method skill. The second-hottest topic on the entire board is not a language or a framework, it is "AI skills." This morning's briefing was about fleets of agents; this afternoon is about what those fleets are actually made of. The unit people ship stopped being an app and became a skill: a portable SKILL.md file that runs unmodified across Claude Code, Codex, and Cursor. Anthropic put up a dedicated Skills product surface and shipped teaching skills on July 14. Codex spent its last release teaching its plugin browser to recommend and install skills in the middle of a conversation. The thing nobody shipped is a way to know a skill is safe before an agent reads it.
What's hottest in AI news right now
Nutlope/hallmark is the clearest tell of the week, an "anti-AI-slop design skill for Claude Code, Cursor, and Codex" that first hit GitHub Trending at number five on July 13 and sits sixth on Trendshift's daily board this afternoon. It is CSS and prompt rules, MIT licensed, roughly 6.2k stars, six contributors, with a companion site at usehallmark.com. The idea is small and revealing: a skill whose entire job is to make the output of other agents look less like it came from an agent. When the ecosystem starts writing skills to police the work of other skills, the skill has become the primitive, not the model (GitHub, Trendshift).
Anthropic launched Claude for Teachers on July 14, and read past the education framing to what it ships: teaching skills and curriculum connections aligned to standards in all 50 states, handed to verified US K-12 educators for free. Teacher data is not used for model training, student information sits under a K-12 Data Processing Addendum written to comply with FERPA, and anyone who signs up before June 30, 2027 gets a full year of access. The same week, Anthropic's own navigation now carries a top-level Skills product page next to Claude Code and Cowork. Packaged expertise, shipped as skills, is now a first-class product line rather than a developer curiosity (Anthropic, Chalkbeat).
OpenAI's Codex 0.142 reshaped how skills get found and installed, and the design choice matters more than any single feature. The /plugins browser now sorts remote plugins into OpenAI Curated, Workspace, and Shared with me, and, in the load-bearing sentence, "eligible turns can recommend and install relevant plugins." Discovery moved inside the conversation, and so did installation. The release also added an indexed web-search mode that restricts page access to server-approved URLs, configurable rollout token budgets that abort a turn when exhausted, and thread-level multi-agent delegation controls. The follow-up 0.144 on July 9 added a writes-only approval mode and, tellingly, a device-code login warning that explains how to spot phishing (Codex changelog, Releasebot).
Graphify-Labs/graphify is the fifth repo on the board, and it shipped as a skill instead of an app on purpose. It turns any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or video into a queryable knowledge graph, with application code, database schema, and infrastructure in one graph, and it runs across Claude Code, Codex, OpenCode, Cursor, and Gemini CLI. A year ago this would have been a startup with a login screen. Today it is a SKILL.md you drop into whichever agent you already use (Trendshift, GitHub).
mattpocock/skills keeps climbing as the individual-practitioner version of the same story, "Skills for Real Engineers, straight from my .claude directory," sitting at seventeenth. By Matt Pocock's own count on July 9 the repo had crossed 160K stars and 7.5m downloads, a figure worth treating as his claim rather than a verified total. The point stands either way: a single engineer's dotfiles are now a distribution channel, because the format is portable and the install cost is near zero (GitHub, firecrawl).
New tools and features worth actually trying
hallmark is worth installing if your agent-generated copy and layouts have that unmistakable sameness to them. It encodes a set of taste rules that strip the tells, and it runs in whichever of the three big agents you already have. Honest tradeoff: it enforces one house style, Nutlope's, and a skill that rewrites your output for taste is also a skill that can quietly shift your meaning, so read what it changed. It is also still design and CSS focused, not a general prose fixer.
graphify is a fast way to get a map of an unfamiliar codebase, point it at the repo and query the graph across code, schema, and infra together. Honest tradeoff: a knowledge graph goes stale the moment the code moves, and the graph is only as honest as the parser that built it, so treat it as a map you re-check, not ground truth you trust.
Codex indexed web-search mode lets the agent run live searches while restricting direct page access to server-approved URLs, which is a saner default than turning an agent loose on the open web. Honest tradeoff: allowlists are exactly the control that CVE-2026-22708 showed can be poisoned on Cursor, so an approved-URL list is a smaller attack surface, not a closed one.
Claude for Teachers is a real offer if you are a verified US K-12 educator: free premium Claude, teaching skills, and standards-aligned curriculum connections, with your data kept out of training. Honest tradeoff: it is US-only and gated behind verification, and "aligned to standards in all 50 states" is a scaffold to start from, not a substitute for your own read of your own classroom (Anthropic).
Trending AI repos on GitHub today
Rankings are Trendshift daily momentum scores, not verified star totals.
Nutlope/hallmark: an anti-AI-slop design skill for Claude Code, Cursor, and Codex. Sixth, and the purest sign that skills are now the unit of shipping (Trendshift).
Graphify-Labs/graphify: turns any folder of code, schemas, docs, or media into a queryable knowledge graph, shipped as a cross-vendor skill. Fifth (Trendshift).
coreyhaines31/marketingskills: marketing skills for Claude Code and AI agents, covering CRO, copywriting, SEO, analytics, and growth. Ninth, and a sign the skill wave has left engineering and reached go-to-market (Trendshift).
mattpocock/skills: one engineer's .claude directory, published as skills for real engineers. Seventeenth (Trendshift).
multica-ai/andrej-karpathy-skills: a single CLAUDE.md that tunes Claude Code behavior around Karpathy's observations on where LLMs trip up while coding. Twenty-second (Trendshift).
Sahir619/fable-method: the Claude Fable 5 workflow distilled into skills any model can run, with an eval that keeps it honest, think then act then prove. Twenty-third (Trendshift).
JustVugg/colibri: not a skill but the other big open-source story on the board, a pure-C engine that streams a GLM-5.2 744B MoE model from disk on a 25GB-RAM consumer machine. Second, and a reminder that local infrastructure is still moving fast underneath the skills noise (Trendshift).
Shubhamsaboo/awesome-llm-apps: a curated set of 100-plus agent and RAG apps you can clone and run. Fourth, the reference shelf people raid when they want a working example (Trendshift).
What actually matters from today's signal
The skill won because it is the smallest thing that ports. A SKILL.md is plain markdown, it runs across Claude Code, Codex, Cursor, Gemini CLI, and a couple dozen other agents without a rewrite, and it installs in seconds. That is why a design skill, a marketing skill, and a knowledge-graph skill are all trending in the same afternoon, and why Anthropic and OpenAI both spent this week building storefronts for them. If you build on agents, the four things to track are the portable skill format itself, the marketplaces forming around it, the practitioners turning dotfiles into distribution, and the auto-install flows the vendors are wiring into the conversation loop.
That last one is the counter-signal, and it is not small. A skill is unsigned markdown that an agent reads as instructions, and Codex now lets an "eligible turn" recommend and install one mid-conversation. That is prompt injection with a distribution channel and an auto-installer bolted on. The security backdrop is already ugly: Cursor patched CVE-2026-22708, where allowlisted commands could be poisoned to deliver arbitrary payloads; GitHub Copilot's CVE-2025-53773 let hidden injection in a pull request description reach remote code execution at a 9.6 CVSS; an enterprise survey this year put confirmed or suspected agent-security incidents at 88% of organizations, with prompt injection reported up sharply year over year. hallmark existing at all, a skill written to clean up after other agents, tells you the ecosystem is already recursive, and recursion is where the poison hides.
Concrete moves this week: read a skill's SKILL.md before you install it the same way you would read a shell script before piping it into bash, because that is exactly what it is. Pin the version, because a skill that updates itself is a supply chain you do not control. And be slow to accept the mid-turn "install this plugin" nudge, because the moment discovery and installation both live inside the agent's turn, the human review step is the thing that quietly disappeared. The piece nobody has written yet is the one that treats the skills marketplace as an app store with no review process and no code signing, and asks who gets owned first.
Source access notes: Trendshift daily board fetched directly for rankings and repo descriptions; Nutlope/hallmark repo detail page fetched directly for stars, license, and its July 13 GitHub Trending debut. Anthropic newsroom fetched directly for the July 14 Claude for Teachers date and the new Skills product surface. Codex plugin-browser and indexed-search details came from Releasebot's mirror of the Codex changelog plus the developers.openai.com changelog, dates as parsed there (0.142 on June 22, 0.144 on July 9). The mattpocock/skills 160K-star figure is Pocock's own July 9 count, flagged inline, not a verified total. Vendor blog index pages (OpenAI, Cloudflare, Google, LangChain) failed the WebFetch provenance check on the first pass and were reached via search-surfaced URLs instead. Hacker News, Product Hunt, and arXiv listing pages were not fetched this run; the vendor plus Trendshift plus security signal was dense enough to carry the issue.