by aaronnat23
Self-hosted AI workspace where chat becomes visual workflows, multi-agent operations, and reviewable automations. Local memory; local or cloud models
# Add to your Claude Code skills
git clone https://github.com/aaronnat23/disp8chLast scanned: 7/4/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@discordjs/rest: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@electron/rebuild: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@esbuild-kit/core-utils: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@esbuild-kit/esm-loader: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@next/eslint-plugin-next: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@whiskeysockets/baileys: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@whiskeysockets/libsignal-node: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xenova/transformers: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "app-builder-lib: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "cacache: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "concurrently: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "discord.js: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "dmg-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify contains a Cross-site Scripting vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "drizzle-kit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "drizzle-orm: Drizzle ORM has SQL injection via improperly escaped SQL identifiers",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron: Electron has ASAR Integrity Bypass via resource modification",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder-squirrel-windows: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "eslint-config-next: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "expr-eval: expr-eval vulnerable to Prototype Pollution",
"severity": "high"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "file-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
"severity": "high"
},
{
"type": "npm-audit",
"message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "make-fetch-happen: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "monaco-editor: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "music-metadata: music-metadata has an infinite loop vulnerability in ASF parser",
"severity": "high"
},
{
"type": "npm-audit",
"message": "next: Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-gyp: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nodemailer: Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter",
"severity": "high"
},
{
"type": "npm-audit",
"message": "onnx-proto: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "onnxruntime-web: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
},
{
"file": "README.md",
"line": 39,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/aaronnat23/disp8ch/main/scripts/ins\"",
"severity": "low"
}
],
"status": "FAILED",
"scannedAt": "2026-07-04T06:48:33.433Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}disp8ch is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by aaronnat23. Self-hosted AI workspace where chat becomes visual workflows, multi-agent operations, and reviewable automations. Local memory; local or cloud models. It has 88 GitHub stars.
disp8ch failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/aaronnat23/disp8ch" and add it to your Claude Code skills directory (see the Installation section above).
disp8ch is primarily written in TypeScript. It is open-source under aaronnat23 on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh disp8ch against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Most AI tools give you a chat box. disp8ch gives your chat box a company to run.
Tell it "build a daily 9 AM research digest and send it to my WebChat" and it drafts a real, editable workflow on a visual canvas (triggers, nodes, schedules) and asks before saving. Put a question to a Council of agents and they debate, vote, and record a verdict with the dissent preserved. Give an agent organization goals and budgets and watch heartbeats, costs, and approvals in one dashboard. Everything runs self-hosted, works with fully local models (no API key needed), and every side effect is approval-gated and auditable. No hidden prompt chains, no silent writes.
Linux, macOS, or WSL
curl -fsSL https://raw.githubusercontent.com/aaronnat23/disp8ch/main/scripts/install.sh | bash -s -- --repo https://github.com/aaronnat23/disp8ch.git
Windows PowerShell
$env:DISP8CH_SOURCE_ZIP_URL = "https://github.com/aaronnat23/disp8ch/archive/refs/heads/main.zip"; iex (irm "https://raw.githubusercontent.com/aaronnat23/disp8ch/main/scripts/install-windows.ps1")
The installer sets up a managed Node runtime if needed, starts the app at http://localhost:3100, and opens onboarding. Connect a cloud key or a local model (Ollama, llama.cpp, LM Studio, vLLM, SGLang) and you're working. More options in Quick Start.
Dashboard: live system health, active workflows, agents, board tasks, and quick actions in one operator view.
WebChat is the plain-English control surface for the whole workspace. Workflows is the visual canvas it builds on: trigger → org context → agent brief → council/board follow-up → output.
Council: agents debate live on a court stage, vote, and the chamber records the verdict and the dissent.
Hierarchy: the whole agent organization at a glance: roles, goals, reporting lines, heartbeats, budgets, and workload.
One operating loop: a research brief can become a cited answer, then a Council decision, then a Hierarchy goal, then workflow-backed board tasks, then a saved design artifact, with one audit trail instead of five separate apps.
What can this app currently do? Separate implemented, configured, and callable.
Build a daily 9 AM research digest workflow, but ask before saving if anything is ambiguous.
Start a council session on whether we should prioritize reliability or new features.
Spin up a research team, put them in an org, and give them a board task to compare OCR models.
Create a board task for each blocker in this launch document.
Remember that I prefer concise technical answers. Reply only saved.
More in WebChat Examples, including repo audits, cited research briefs, and design generation.
⭐ If disp8ch looks useful, star the repo. It is the best way to help other people find a local-first alternative. Found a rough edge? Open an issue; bug reports are gifts.
disp8ch is built around one operating loop, not a pile of disconnected tools:
That means a research brief can become a cited WebChat answer, then a Council decision, then a Hierarchy goal, then workflow-backed board tasks, then a saved design artifact, with one audit trail instead of five separate apps.
[SILENT] and downstream sends stay quiet until something actually needs attention./loop <objective> turns a long-running goal into a durable phase/worker run with pause, resu