by vakovalskii
Versatile Almost Local, Eventually Reasonable Assistant 🔫
# Add to your Claude Code skills
git clone https://github.com/vakovalskii/NeuralDeskAppGuides for using ai agents skills like NeuralDeskApp.
Last scanned: 6/22/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@chevrotain/cst-dts-gen: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@chevrotain/gast: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@yao-pkg/pkg: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "chevrotain: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "chevrotain-allstar: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "concurrently: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify contains a Cross-site Scripting vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "langium: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "mermaid: Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "pkg: Pkg Local Privilege Escalation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitest: When Vitest UI server is listening, arbitrary file can be read and executed",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "vm2: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-06-22T09:48:46.484Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}NeuralDeskApp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by vakovalskii. Versatile Almost Local, Eventually Reasonable Assistant 🔫. It has 330 GitHub stars.
NeuralDeskApp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/vakovalskii/NeuralDeskApp" and add it to your Claude Code skills directory (see the Installation section above).
NeuralDeskApp is primarily written in TypeScript. It is open-source under vakovalskii on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh NeuralDeskApp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Versatile Almost Local, Eventually Reasonable Assistant
Desktop AI Assistant with Local Model Support
https://github.com/user-attachments/assets/a8c54ce0-2fe0-40c3-8018-026cab9d7483
~/.valera/memory.md~/.valera/logs/sessions/ValeDesk isn't just another AI assistant — it's a framework you own. Built with TypeScript and Tauri, every component is transparent and modifiable:
Everything runs on your machine:
Perfect for developers, researchers, and AI enthusiasts:
# Run Ollama locally (free, 100% private)
ollama serve
# Configure ValeDesk: http://localhost:11434/v1
# Or use vLLM for faster inference
vllm serve Qwen/Qwen2.5-14B-Instruct --port 8000
# Configure ValeDesk: http://localhost:8000/v1
TL;DR: ValeDesk gives you the power of ChatGPT/Claude with the freedom of open source and privacy of local execution.
execute_python tool)# Clone and enter
git clone https://github.com/vakovalskii/ValeDesk.git
cd ValeDesk
# Install dependencies
npm install
# Run in development mode
make dev
npm run test
# Build DMG (macOS)
make bundle
# Output: ValeDesk-0.0.8.dmg
# 1. Build sidecar binary
npm run build:sidecar
# 2. Build Tauri app
cd src-tauri && cargo build --release
# 3. Create DMG
hdiutil create -volname "ValeDesk" \
-srcfolder src-tauri/target/release/bundle/macos/ValeDesk.app \
-ov -format UDZO ValeDesk-0.0.8.dmg
Windows build requires cross-compilation setup. Check .github/workflows/ for CI builds.
dummy-key for local models)/v1)chmod +x scripts/setup_voice_server.sh./scripts/setup_voice_server.sh (Docker by default; falls back to uvx or venv)PORT, MODEL, DEVICE, COMPUTE_TYPE, DOCKER_TAGDOCKER_MEMORY (e.g. 6g), DOCKER_CPUS (e.g. 6), DOCKER_SHM_SIZE (e.g. 2g)DOCKER_MEMORY=6g DOCKER_CPUS=6 DOCKER_SHM_SIZE=2g ./scripts/setup_voice_server.shVoice Base URL (e.g. http://localhost:8000/v1), Model, optional API Key/LanguageLocal vLLM:
{
"apiKey": "dummy-key",
"baseUrl": "http://localhost:8000/v1",
"model": "qwen3-30b-a3b-instruct-2507"
}
OpenAI:
{
"apiKey": "sk-...",
"baseUrl": "https://api.openai.com/v1",
"model": "gpt-4"
}
Browse and install verified skills for ValeDesk: Skills Marketplace
All tools follow snake_case naming convention (verb_noun pattern):
| Tool | Description |
|---|---|
run_command |
Execute shell commands (PowerShell/bash) |
read_file |
Read text file contents |
write_file |
Create new files |
edit_file |
Modify files (search & replace) |
search_files |
Find files by glob pattern (*.pdf, src/**/*.ts) |
search_text |
Search text content in files (grep) |
read_document |
Extract text from PDF/DOCX (max 10MB) |
| Tool | Description |
|---|---|
execute_js |
Run JavaScript in secure Node.js vm sandbox |
execute_python |
Run Python code (system Python with pip packages) |
| Tool | Description |
|---|---|
search_web |
Search the internet (Tavily/Z.AI) |
extract_page |
Extract full page content (Tavily only) |
read_page |
Read web page content (Z.AI Reader) |
render_page |
Render JS-heavy pages via Chromium (Telegram, SPAs) |
| Tool | Description |
|---|---|
manage_todos |
Create/update task plans with visual progress tracking |
| Tool | Description |
|---|---|
schedule_task |
Create, list, update, delete scheduled tasks |
Features:
| Tool | Description |
|---|---|
manage_memory |
Store/read persistent user preferences |
Security: All file operations are sandboxed to the workspace folder only.
# Build executable and installer
npm run dist:win
# Output: dist/ValeDesk Setup 0.0.8.exe
# Build DMG (ARM64)
npm run dist:mac-arm64
# Build DMG (Intel x64)
npm run dist:mac-x64
# Build AppImage
npm run dist:linux
C:\Users\YourName\AppData\Roaming\ValeDesk\~/Library/Application Support/ValeDesk/~/.config/ValeDesk/Files:
sessions.db — SQLite database with chat history, todos, scheduled tasks, and settingsapi-settings.json — API configurationskills-settings.json — Skills marketplace configuration~/.valera/memory.md — persistent memory storage~/.valera/logs/sessions/{session-id}/ — per-session API logs:
turn-001-request.json — full request (model, messages, tools, temperature)turn-001-response.json — full response (usage, content, tool_calls)See CURSOR.md for development guidelines and project architecture.
ValeDesk Community License — free for individuals and companies with reven