This article covers 2026-07-06 through 2026-07-12 in Asia/Taipei time. GitHub attention moved from another chat UI toward portable skills, standardized tool interfaces, and observable coding-agent harnesses. Trending measures attention, not quality; the useful evidence is the reusable engineering pattern and visible repository activity.

stitch-skills makes procedures portable across runtimes

google-labs-code/stitch-skills appeared in GitHub weekly trending. Its skills follow the Agent Skills open standard and target Gemini CLI, Claude Code, Cursor, and other agents alongside Stitch MCP. The important idea is that procedural knowledge can be versioned, reviewed, and moved across runtimes.

Skills can also instruct agents to run commands and read context. Pin versions, review content, minimize permissions, and inspect changes in CI. Stars and trending placement are not supply-chain review.

DesktopCommanderMCP concentrates power in an MCP surface

wonderwhy-er/DesktopCommanderMCP packages terminal control, filesystem search, and diff editing as an MCP server. It shows MCP moving from data connectors into privileged execution, with a consistent schema across environments.

That expands the attack surface. Restrict paths and commands, isolate credentials, retain every tool call, and require approval for destructive actions. MCP convenience does not replace OS sandboxing.

claude-code-templates productizes harness configuration

davila7/claude-code-templates continued attracting weekly attention by packaging agents, commands, hooks, MCP, and monitoring into a CLI. Teams want reusable roles, policies, and dashboards instead of hand-written prompts in every repository.

Templates can silently add hooks or external servers. Install first in a test repo, inspect the generated diff, pin versions, and select only the settings appropriate for an organizational baseline.

The shared engineering pattern

Together, these projects form a stack: skills preserve procedure, MCP exposes capability, and harnesses manage configuration and observation. The next requirement is a capability manifest describing permissions, irreversible actions, and data destinations for every component.

Watchlist

• Versioning, signatures, and compatibility tests for Agent Skills.
• Fine-grained allowlists, dry-run, and audit logs in MCP servers.
• Maintainer activity, issue response, and release velocity after the trend spike.
• Lockfiles, provenance, and policy checks for agent templates.
• Prompt-injection and credential-leak tests for privileged MCP servers.