
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
A full AI engineering team as plain Markdown files. 14 specialized agents for code quality, commits, reviews, security, and more — works with any agent runtime.
A full AI engineering team as plain Markdown files.
Specialized AI agents — architect, reviewer, security expert, DevOps engineer, strategist, operator, and more — each a single Markdown skill file any agent runtime can load into any project. No lock-in. No configuration. Just drop them in.
They have opinions about your PR descriptions. They will not merge your branch if your commit says fix stuff. They are not polite about it.
I commit with intention. I branch with purpose. I review with honesty. I ship with confidence. I never push to main.
Each agent is a single .md file that describes a role, its responsibilities, standards, and how it communicates. Load one or all of them into Claude Code, Copilot, or any runtime that supports skill files. Or run them autonomously via the TypeScript CLI.
npm install --save-dev agenthood && npx agenthood init (or npx skills add fworks-tech/agenthood via skills.sh)Every role a real software team needs — available as a skill file with impeccable standards.
| Agent | Role | |
|---|---|---|
| ✍️ | The Scribe | Commits, PRs, changelogs |
| 🏗️ | The Architect | System design, ADRs, tech decisions |
| 🔍 | The Reviewer | Code review, standards enforcement |
| 🧪 | The Tester | TDD, coverage, edge cases |
| 🐛 | The Debugger | Error triage, root cause analysis |
| 🔒 | The Auditor | Security, vulnerability scanning, dependency audit |
| 📦 | The Herald | Releases, versioning, changelogs |
| 📝 | The Librarian | Documentation, API references |
| 🚪 | The Doorman | Validation, branch protection, health checks |
| 🔮 | The Oracle | Institutional knowledge, authoring templates |
| 🌐 | The Envoy | Cross-provider translation, convention validation |
| 👁️ | The Sentinel | Integrity, cross-member contradiction detection |
| ⚖️ | The Warden | Code health, complexity enforcement |
| 🧭 | The Steward | Context economy, provider cache strategies |
| 🎯 | The Strategist | Goal refinement, requirement discovery |
| 🩺 | The Operator | Runtime health, deployments, rollback |
| 👁️ | The Inspector | Visual-reasoning benchmarking, pixel analysis |
| 📬 | The Mailman | Message delivery, scheduling, cross-posting |
npm install --save-dev agenthood
npx agenthood init # interactive setup (~1 minute)
npx agenthood check # verify everything is in place
Members are loaded as context by your existing AI assistant. Works with Claude Code and Copilot.
Execute members as real LLM agents that reason, act, and remember across sessions.
# From the repo clone (when installed via npm, the runtime is pre-built)
npm run build # build the runtime (once)
npx agenthood list # see available agents
npx agenthood run the-scribe "write a commit message for the current diff"
npx agenthood run the-reviewer "review the changes in the last commit"
npx agenthood run the-architect "plan the implementation for issue #42"
npx agenthood verify # validate member SKILL.md integrity
npx agenthood status --watch # live project health monitoring
npx agenthood rollback the-scribe # restore SKILL.md from lockfile
npx agenthood workflow review-pr # execute the review-pr workflow
Set one of these in a .env file in your project root (loaded automatically by the runtime):
| Variable | Provider | Free tier |
|---|---|---|
GROQ_API_KEY | Groq (default) | console.groq.com |
ANTHROPIC_API_KEY | Anthropic | — |
OPENAI_API_KEY | OpenAI | — |
OPENCODE_API_KEY | OpenCode / OpenCodeGo | opencode.ai |
Or use Ollama for fully offline execution (no key required).
For a full walkthrough — install, commands, CI pipeline, and next steps — see the Academy Getting Started guide.
See the CHANGELOG.md for the full version history.
Agenthood Studio — a browser-based chat interface for all 16 Society members. Features configurable provider backend (Anthropic, OpenAI, Groq, Ollama, OpenCode), SSE streaming, turnstile CAPTCHA, session-scoped config persistence, Upstash Redis rate limiting, and structured logging with field-level redaction. Source
Agenthood is agent-agnostic. The skill files work with:
.claude/skills/.github/copilot-instructions.mdThe TypeScript runtime (agenthood run) supports Groq (default, free tier at console.groq.com), Anthropic, OpenAI, OpenCode, and Ollama for fully offline execution.
The Agenthood Studio playground exercises the same runtime through a browser UI — every chat request runs through agenthood/dist/llm with provider routing, failover, and streaming.
The framework runs on five core principles adapted from production AI agent systems. See the architecture docs for details on how agents coordinate, prioritize, fail over, and stay safe.
| Principle | Document |
|---|---|
| Multi-agent orchestration & agent roles | agent-system.md |
| Priority queues & concurrency slots | concurrency-and-queues.md |
| Agent mode vs Ask mode | operating-modes.md |
| Multi-LLM support & automatic failover | provider-failover.md |
| Tool registry, scoping & safety caps | built-in-tools.md |
| Agent memory tiers | memory — ResidualMemory, ShortTermMemory, LongTermMemory, EpisodicMemory, ProjectMemory, DecisionLog, MetricsCollector, InMemoryStore, PersonalisationStore, LanceDBStore |
| Workflow engine & quality gates | workflows — WorkflowEngine, QualityGates, DiffImpactAnalyzer, WorkflowCheckpoint, GoalChain |
| Service-agnostic RAG (graph, vector, agentic) | rag — KnowledgeGraphStore, FixedSizeChunkStrategy + MarkdownHierarchicalChunkStrategy, Indexer, Retriever, AgenticRAG, TreeSitterParser, ProjectIngestion |
npm install && npm run build
make setup # activates git hooks and commit template
npm test # run all tests
npm run typecheck # strict TypeScript check
npm run lint # ESLint
See STRUCTURE.md for the full directory tree.
Structured learning path from "what is a prompt?" to "ship agents to production."
Open source. No sign-up. Works with any agent runtime. Membership is free. Standards are not.
FAQs
A full AI engineering team as plain Markdown files. 14 specialized agents for code quality, commits, reviews, security, and more — works with any agent runtime.
The npm package agenthood receives a total of 104 weekly downloads. As such, agenthood popularity was classified as not popular.
We found that agenthood demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.