Agency OS Radar

Daily open-source discoveries for a one-person AI software agency

Report date: Tuesday, October 20, 2026 · Agency OS Edition · Addis Ababa (EAT)

Start Here (plain English)

The problem: you use AI agents to build software for clients, and you make those agents more powerful every week — you install "skills" that teach them new abilities, you let multiple agents work together, you trust them to test and secure what they build. But every new ability you bolt onto an agent is also a new door for attackers: a skill downloaded from the internet can quietly read your environment variables, send your API keys to someone else's server, or inject instructions your agent will obey. And nobody is auditing those doors yet.

The solution in today's radar: the open-source ecosystem just shipped the missing security layer for exactly this. Today's five verified finds: NVIDIA's SkillSpector scans agent skills before you install them; Vercel's universal skills CLI gives you one safe, consistent way to install skills across 75+ agents; OMA is an orchestration runtime where approvals and audit records are built in; Strix is an AI pentester that attacks your app the way a real attacker would; and Callstack's agent-device lets your AI agent actually verify a mobile app on a real device. Together they cover the theme that matters to Agency OS: trust nothing the agent runs until it has been scanned, approved, and evidenced.

All five repos were verified today (Oct 20, 2026): links opened, licenses read from each repo's LICENSE file, and recent activity confirmed from commit/release dates (SkillSpector: commits Oct 19; vercel-labs/skills: v1.7.4 released Oct 19; OMA: core v1.21.3 released Oct 16, docs Oct 19; Strix: commits Oct 18; agent-device: commits Oct 20). Prior daily reports were not available to me in this session except yesterday's focus edition (bulletproof-react, react-starter-kit, px0, Lowdefy, Mercari checklist) — none of today's picks repeat those. Per your standing format, the Ethiopia business-opportunity section remains removed.

The Production-Readiness Gap

The criticism: "AI isn't production-ready" doesn't only apply to generated code — it applies even harder to the agent tooling itself. Installing third-party agent skills is effectively running untrusted code with your credentials in scope; AI vulnerability findings and AI test passes are claims, not proof, unless they produce auditable evidence.

Today's answer: the ecosystem is building the "trust but verify" layer — scanners that gate what agents ingest (SkillSpector), standardized install paths (skills CLI), runtimes that record what agents did (OMA), security testing that produces findings with evidence (Strix), and device-level verification of what agents ship (agent-device).

Why this maps to Agency OS: your governance rules already say agents must never invent facts or evidence and that info must be REAL/VERIFIED before advancing. Today's tools are exactly the kind of external, evidence-producing checkers your gate engine can consume — they don't replace your governance, they feed it.

Top 5 Discoveries

1. NVIDIA SkillSpector — security scanner for AI agent skills TEST NOW

Link: github.com/nvidia/skillspector
What it does (simple English): scans Claude Code, Codex, and MCP "skills" before you install them, looking for malicious patterns, prompt injection, secret/env harvesting, data exfiltration, and supply-chain risks — and gives a risk score and a DO-NOT-INSTALL-style recommendation.
What changed recently: very active — merge commits on Oct 19, 2026, plus security fixes through October (batch scanning, report-output race fix, provider-cost fixes). This is an evolving project, not a one-off release.
Why it matters to a vibe coder: you install community skills into the agents that hold your API keys. This is the antivirus layer for exactly that supply chain — it converts "this skill looks cool" into "this skill was scanned, here is the report."
License & costs: Apache-2.0 (VERIFIED from LICENSE file, © 2026 NVIDIA). Open source and free; optional LLM-provider API keys can be configured (.env) for provider-based scans — without them you still get pattern-based scanning (UNTESTED by me today).
Windows & install: Python project (uv/pip style toolchain); cross-platform including Windows. Requires Python — check the repo README for the exact install command before running anything.
Agency OS fit: SECURITY stage: a mandatory pre-install scan step for any skill/plugin your agents adopt; also supports REUSABLE_COMPONENT vetting. Compatibility: plausible — produces report files your gate engine could require; untested with your scripts.
Evidence/output: a structured scan report per skill (risk score, severity, findings with file/line locations, recommendation) — exactly the kind of artifact that can be attached to project-state.json.
Limitations/risks/human review: pattern detection can miss novel attacks and can false-positive; a clean scan is not a guarantee. Human review still required before installing anything into a production agent setup.
Verdict: TEST NOW — local, free, Windows-friendly, and it hardens the exact supply chain you depend on.

2. vercel-labs/skills — universal package manager for agent skills TEST NOW

Link: github.com/vercel-labs/skills
What it does (simple English): one CLI (npx skills) that installs, lists, and searches agent skills across Claude Code, Codex, Cursor, OpenCode, and 75+ other agents — so a skill becomes a portable, versioned package instead of hand-copied files in one tool's private folder.
What changed recently: v1.7.4 released Oct 19, 2026 (VERIFIED from the repo's release tag and latest commit); heavily trending this week; non-interactive CI-friendly install modes and experimental sync were recent focus areas.
Why it matters to a vibe coder: you switch agents constantly. With this, your curated Agency OS skill set installs identically into every agent in one command — less drift, fewer invented setups, reproducible environments.
License & costs: MIT (VERIFIED from LICENSE file, © 2026 Vercel, Inc.). Free; the CLI itself needs no subscription (the skills you install remain your responsibility — see SkillSpector).
Windows & install: Node.js CLI via npx skills — works on Windows with Node installed. No special hardware.
Agency OS fit: DEVELOPMENT stage + REUSABLE_COMPONENT: your internal skill library becomes installable packages for the dev/QA/security agents. Compatibility: plausible, untested.
Evidence/output: reproducible installs (declared skills per agent, CI-friendly non-interactive mode) — a skills manifest an auditor can re-run.
Limitations/risks/human review: it standardizes distribution, not safety — it will happily install a malicious skill unless you pair it with SkillSpector scanning. Skills come from third parties: review before install, never blanket-trust.
Verdict: TEST NOW — quick to try (one npx command), immediate practical value.

3. open-multi-agent (OMA) — orchestration runtime with durable approvals and verifiable run records INVESTIGATE

Link: github.com/open-multi-agent/open-multi-agent
What it does (simple English): a self-hosted TypeScript runtime for running agent teams where the interesting part is governance: human approvals are durable (work pauses until a person decides) and every run produces a verifiable, auditable record. Tagline: "Own it, approve it, audit it."
What changed recently: core v1.21.3 and create-oma-app v0.8.10 released Oct 16, 2026; docs and README updates on Oct 19 (VERIFIED from the repo's CHANGELOG and commit history). Requires Node.js 20+ (Node 20 support ends no earlier than Oct 31, 2026 — use a maintained LTS).
Why it matters to a vibe coder: Agency OS's core bet is exactly this — orchestrated specialist agents, human approval on decisions that matter, evidence over claims. OMA is the closest off-the-shelf open-source implementation of that philosophy found today.
License & costs: MIT (VERIFIED from LICENSE file, © Shenzhen YuanASI Technology Co., Ltd. and contributors). Free; running agents consumes whatever LLM API you point it at (external API dependency — model costs are yours).
Windows & install: TypeScript/Node.js; Windows-compatible in principle (UNTESTED by me); the repo documents known production uses.
Agency OS fit: ORCHESTRATOR support / multiple lifecycle stages (PROPOSAL approvals, QA evidence, CEO_REVIEW checkpoints). Compatibility: plausible — do not replace your gate engine; study its approval/run-record patterns instead; untested against your project-state.json.
Evidence/output: durable approval records + verifiable run records per agent execution — the audit trail your VERIFIED/UNVERIFIED rules need.
Limitations/risks/human review: younger ecosystem than the big frameworks; adopting a new orchestration runtime is an architecture decision — investigate first, don't migrate anything yet. LLM API dependency means ongoing model costs.
Verdict: INVESTIGATE — strong philosophy match; needs a hands-on evaluation before any Agency OS commitment.

4. Strix — open-source AI penetration testing tool INVESTIGATE

Link: github.com/usestrix/strix
What it does (simple English): an AI-driven pentest tool that attacks your app like a real intruder — against code, web apps, APIs, and the OWASP Top 10 — then helps fix the findings; ships as skills so Claude Code, Cursor, or Codex can run pentests, and can scope CI scans to changed files in pull requests.
What changed recently: commits on Oct 18, 2026 (agent pause/resume fixes) and LLM configuration features on Oct 15 (VERIFIED from the repo's commit history); 930+ commits total — an actively developed project, not a new release-day spike.
Why it matters to a vibe coder: your SECURITY stage covers auth, input validation, secrets, dependencies — Strix tests those against a live target the way an attacker would, complementing static scanners that only read code.
License & costs: Apache-2.0 (VERIFIED from LICENSE file, © 2025 OmniSecure Inc.). The tool is free, but it needs an LLM to drive it — external API dependency; model costs depend on the provider you configure (examples default to an OpenRouter-hosted model).
Windows & install: Python-based with a Go/Bubble Tea TUI; CI via GitHub Actions. Windows compatibility plausible but UNTESTED by me — check the README's supported platforms before relying on it.
Agency OS fit: SECURITY stage: the security agent's active-testing capability, before RELEASE. Compatibility: plausible, untested.
Evidence/output: findings with reproducible scope, CI scan results scoped to changed files — attachable as SECURITY-stage evidence artifacts.
Limitations/risks/human review: pentest tools can damage misconfigured targets and generate false findings; never point it at client production systems without written authorization; every finding needs human triage before it enters evidence. Running it means running AI-driven attack logic — restrict to your own test environments.
Verdict: INVESTIGATE — valuable capability, but authorize, scope, and supervise before any real use.

5. agent-device (Callstack) — mobile app automation & verification for AI agents INVESTIGATE

Link: github.com/callstack/agent-device
What it does (simple English): a CLI, MCP server, and typed Node.js API that lets an AI coding agent drive and verify a real mobile app on iOS, Android, HarmonyOS, TV, and desktop platforms — launch, interact, screenshot, check state — so "the app works" becomes a testable claim instead of an assumption.
What changed recently: commits on Oct 20, 2026 (VERIFIED via the repo's commit history): screenshot selector-crop support for physical iPhones with capture evidence required, plus other active feature work this month.
Why it matters to a vibe coder: if Agency OS ever ships Android apps for small businesses, QA currently has no way to verify on a device without you manually tapping through. This gives the QA agent hands on a real device — and it insists on capture evidence, which matches your evidence rules.
License & costs: MIT (VERIFIED from LICENSE file, © 2026 Callstack). Free; no subscription known. Needs the target device/emulator infrastructure (Android emulator on your PC; some iOS features require Apple hardware/tooling).
Windows & install: Node.js-based CLI/MCP server; Android testing via ADB works on Windows with an emulator or device. Physical-iOS workflows depend on Apple tooling — treat those as macOS-side. UNTESTED by me.
Agency OS fit: QA stage (UI verification for Android deliverables) and REUSABLE_COMPONENT (device-verification skill). Compatibility: plausible, untested.
Evidence/output: screenshots, interaction logs, and verification results from the device — screenshot evidence is required by the tool itself for physical-device claims.
Limitations/risks/human review: platform-dependent (device/emulator setup is fiddly); agent-driven device interaction should be scoped to test devices only; a passing device check doesn't cover performance or store-compliance review — humans still decide release.
Verdict: INVESTIGATE — file it now; test when your first Android project reaches QA.

Test Today: SkillSpector — scan an agent skill before you install it (~30–45 min)

Why this one: local, free, Windows-friendly (Python), no expensive subscription, and it hardens the supply chain you actually use daily — installing third-party skills into AI agents that hold your API keys.
Prerequisites: Windows PC with Python installed, git, and your AI coding IDE open. Read the SkillSpector README's official install instructions and follow them exactly — do not run install commands from anywhere other than the official repo.
Practical test: clone the official repo (or use its documented install method), then pick one skill you already use or are considering (e.g., from a popular skills repository) and run the scanner against it. Never execute the skill itself during the test — you are scanning files, not installing them.
Expected results: a structured report with a risk score, severity-tagged findings with file/line locations (env harvesting, exfiltration URLs, prompt injection patterns), and an install recommendation. Test on the repo's own sample "suspicious" skill if one is provided, so you can see a true-positive report safely.
Safety precautions: scan in a sandbox/throwaway directory; don't paste secrets; do not install any scanned skill into your real agent setup based on a "clean" report alone — a clean scan reduces risk, it doesn't eliminate it. Keep agent tool access scoped; never grant unrestricted computer access.

Agency OS Integration Proposal: a skill-intake gate fed by SkillSpector

Problem solved: today, adding a skill to an Agency OS agent is an ungoverned act — nothing stops a bad plugin from touching your credentials. The gap is between "agent needs a new ability" and "ability is proven safe."
Exact workflow it improves: the SECURITY stage check applied to agent tooling itself — plus the REUSABLE_COMPONENT stage, where adopted skills become shared assets across projects.
Where in the lifecycle: SECURITY (skill intake scan) and REUSABLE_COMPONENT (vetted skills enter the shared library only with a stored scan report).
Inputs: a candidate skill's source files (from npx skills or any source) + the SkillSpector CLI.
Outputs: a dated scan report artifact per skill, referenced from project-state.json with the skill's source URL and version.
How results are validated: the report is an external artifact, not an agent's word — an agent may attach it but never author the verdict; findings marked VERIFIED only when the report file exists and is dated.
What happens on failure: a HIGH-severity finding blocks the skill from entering the library; overriding that block is a waiver → human approval required, per your existing rules. This feeds the gate engine as a new evidence type — no replacement of the gate engine or governance is proposed.
Smallest safe experiment: scan one skill you already trust, store the report, and add one manual checklist step: "no new skill installs without a scan report." No code changes to gate_engine.py yet — first prove the report quality is worth wiring in.

Daily Learning: supply-chain risk in agent skills (skills are code with your credentials)

Concept (simple English): an agent "skill" is not documentation — it's instructions and often scripts that run in the same environment as your API keys. A malicious skill can read environment variables, phone home, or inject prompts that redirect the agent's later behavior. It's the npm-malware problem, but the package executes inside your most privileged tool.
How an AI agent might get it wrong: the agent recommends or auto-installs a skill because it's popular or "looks official," and reports the install as a success — popularity is not verification, and the agent has no way to know what the skill's scripts actually do at runtime.
How you recognize the failure: an install happened with no scan report attached; the evidence trail for "this skill is safe" is missing or was authored by the agent itself instead of an external scanner.
Which tool/test detects it: SkillSpector — its findings (env-variable harvesting, exfiltration endpoints, prompt-injection patterns) catch the common malicious patterns; pair it with your rule that no skill enters the environment without a stored scan artifact. Detects patterns, not everything — human review stays mandatory.

Final Summary

Best discovery today: NVIDIA SkillSpector — the security layer for the agent-skills supply chain, from a vendor you can hold accountable, Apache-2.0, actively maintained, and locally testable today.
Best security/reliability improvement: a skill-intake gate: every skill scanned (SkillSpector) before install, distributed reproducibly (vercel-labs/skills), with the report stored as evidence.
Best Agency OS integration: scan reports as a new SECURITY-stage evidence type in your existing gate engine — human approval required to override a HIGH finding; no governance changes.
One practical action today: run SkillSpector on one skill you already use, read its report, and start the habit: no unscanned skill ever enters your agent setup again.