GitHub Weekly Wins: Claude Code Skills, Drizzle, Vercel

> **TL;DR:** This week's standout GitHub repos are mattpocock/skills (220K+ stars), Anthropic's Claude Code (141K+ stars), Drizzle ORM (35K+ stars), and the Vercel CLI (16K+ stars) — four tools that came together in a real agent-run security review, where a skills-equipped Claude Code audit flagged Drizzle as low risk and caught exposed credentials in Vercel's history. Together they show agentic coding maturing from autocomplete into real code auditing.

Key Takeaways

- mattpocock/skills packages composable, model-agnostic 'agent skills' (Code Review, Implement, To Spec, Teach) and has passed 220,000 GitHub stars - Anthropic's Claude Code is the terminal agent driving these skill-based workflows, with npm install now deprecated in favor of documented setup methods - Drizzle ORM's ~7.4kb, zero-dependency, tree-shakeable design got it flagged as low practical risk in a real agent-run security audit - Vercel's CLI was where that same audit found the highest-stakes issue: credentials exposed in public commit history - The pattern across all four: skills + a capable coding agent are turning code review into a task agents can meaningfully own

Why this week's roundup is about more than star counts

Four repositories anchor this edition of [GitHub Weekly Wins](https://speka.info/github-weekly-wins/), and they're connected by more than trending charts. A skills library, a coding agent, an ORM, and a deploy platform turned up together in a real workflow: an agent equipped with a packaged skills library ran a security review of a live codebase, judged one dependency low-risk, and caught exposed credentials sitting in a hosting platform's public history. That's the throughline for this week's picks — ranked strongest first by star count.


mattpocock/skills — a 220,000-star bet against heavyweight agent frameworks

**What it is:** A Shell-based, MIT-licensed collection of "agent skills" — named playbooks including Grill Me, To Spec, To Ticket, Implement, Code Review, Writing for Agents, and Teach — meant to be dropped straight into a coding agent's `.agents` directory. It comes from AI Hero's Matt Pocock, installs in about 30 seconds, and its README frames it as an alternative to full-process frameworks like GSD, BMAD, and Spec Kit.

**Why it matters:** The README's core argument is that those bigger frameworks "own the process" for you, which is convenient until something breaks — at which point their opacity makes bugs hard to resolve. Skills take the opposite bet: small, single-purpose, and easy to read, adapt, and recombine, with no lock-in to a specific model. That pitch has resonated at a scale most dev tooling never reaches — 220,165 stars at last count.

**Who it's for:** Teams already running Claude Code, Cursor, or a similar agent who want a lightweight, inspectable layer of process discipline instead of adopting an entire methodology wholesale.

**GitHub:** [mattpocock/skills](https://github.com/mattpocock/skills)

anthropics/claude-code — the agent running those skills, and running the audit

**What it is:** Anthropic's official agentic coding tool, built to live in a terminal, understand a codebase, execute routine tasks, explain complex code, and handle git workflows through natural language. It's also usable inside an IDE or by tagging @claude on GitHub. The project is Python-based and actively maintained; note that npm installation is now deprecated in favor of the methods listed in Anthropic's own setup documentation.

**Why it matters:** Claude Code is the piece that makes a skills library like mattpocock's actionable rather than theoretical. In the workflow tying this roundup together, Claude Code — running Opus on a Claude Max plan — was pointed at a real codebase with the skills library loaded, and used to execute a structured security review. That review is what surfaced the findings covered below: a dependency judged low-risk, and credentials exposed in a hosting platform's history. It's a concrete data point for agentic coding moving past code generation into code auditing. For more on the models powering this generation of agents, see our coverage in [LLM News: Grok Bots, GLM-5.3, Muse Glimmer & More](https://speka.info/blog/llm-news-grok-bots-glm-5-3-muse-glimmer-more), and on how access to top-tier models is broadening in [OmniRoute: Free AI Model Router Unlocks Claude Opus 4.6](https://speka.info/blog/omniroute-free-ai-model-router-unlocks-claude-opus-4-6).

**Who it's for:** Developers and teams wanting a terminal-first coding agent that plugs directly into existing skill libraries, git workflows, and CI.

**GitHub:** [anthropics/claude-code](https://github.com/anthropics/claude-code)

drizzle-team/drizzle-orm — the dependency that passed the audit

**What it is:** A headless, TypeScript-first ORM for Node.js and JavaScript, notable for shipping at roughly 7.4kb minified and gzipped with zero dependencies and full tree-shakeability. It supports Postgres, MySQL, and SQLite, including serverless targets like Turso, Neon, Xata, PlanetScale, and Cloudflare D1. It's Apache-2.0 licensed.

**Why it matters:** In the same skill-driven security review referenced above, Drizzle appeared in the audited codebase and was flagged as low practical risk on the deployed path. That distinction matters: it shows an agent-run audit capable of differentiating a lightweight, dependency-free ORM from riskier dependencies, rather than flagging everything indiscriminately. For teams evaluating ORMs partly on attack surface, that's a meaningful signal alongside Drizzle's already-strong adoption at 35,505 stars.

**Who it's for:** Teams building on serverless Postgres, MySQL, or SQLite who want type-safe queries without the dependency weight of a heavier ORM — and who care about what an agent-run security review would say about their data layer.

**GitHub:** [drizzle-team/drizzle-orm](https://github.com/drizzle-team/drizzle-orm)


vercel/vercel — where the audit found its most consequential result

**What it is:** The CLI and open-source core of Vercel's "Develop. Preview. Ship." platform — git push to deploy, with native CLI binaries now distributed separately from the standard npm package for teams that want to opt in. It's TypeScript, Apache-2.0 licensed, and sits at 16,098 stars.

**Why it matters:** This is where the audit's sharpest finding landed. The same review that judged Drizzle low-risk found credentials exposed in Vercel's public commit history — on the very platform the audited app was deployed through. It's a pointed illustration of a recurring risk: deploy platforms are convenient precisely because they're deeply wired into a project's secrets, which is exactly what makes any leak in their history so costly. That a skills-equipped coding agent caught it is the more encouraging half of the story.

**Who it's for:** Any team shipping on Vercel should treat this as a prompt to audit their own git history for leaked secrets, and any team evaluating whether an agent-run security pass belongs in their release checklist has a concrete example of what that catches.

**GitHub:** [vercel/vercel](https://github.com/vercel/vercel)

The pattern worth watching

Taken individually, these are four unrelated projects: a skills library, a coding agent, an ORM, and a deploy CLI. Taken together, they show what a skill-equipped coding agent can now do in a single pass — read a codebase, judge a dependency's real-world risk rather than its reputation, and catch a credentials leak that a human reviewer might have scrolled past. That's a meaningfully different capability than autocomplete or boilerplate generation, and it's likely to keep showing up across this week's [GitHub Weekly Wins](https://speka.info/github-weekly-wins/) roundups as more teams wire skills into their own agent workflows. For the broader model and tooling context behind this week's launches, see our coverage in [AI Launches: Gemini Robotics 2, Seedance 2.5, Grok Voice](https://speka.info/blog/ai-launches-gemini-robotics-2-seedance-2-5-grok-voice).

Frequently Asked Questions

What is mattpocock/skills used for?

It's a library of packaged 'agent skills' — playbooks like Code Review, Implement, and To Spec — designed to be dropped into a coding agent's directory to standardize workflows without locking into a heavier framework.

Can Claude Code use the mattpocock skills library directly?

Yes — the skills are built to work with any model and are installed into an agent's `.agents` directory; in the workflow referenced here they were run through Claude Code on a Claude Max plan.

Is Drizzle ORM considered a security risk?

In the agent-run audit referenced in this roundup, Drizzle was flagged as low practical risk on the deployed path, largely due to its zero-dependency, lightweight design.

What security issue did the audit find in Vercel?

The review found credentials exposed in Vercel's public commit history on the platform the audited app was deployed through — a reminder to check git history for leaked secrets on any deploy platform.

How many stars does the Claude Code repo have?

141,759 stars at the time of this roundup, making it one of the most-starred agentic coding tools on GitHub.

Sources

- https://github.com/mattpocock/skills - https://github.com/anthropics/claude-code - https://github.com/drizzle-team/drizzle-orm - https://github.com/vercel/vercel