CaoGen — a vendor-neutral, local-first AI work desktop. Multi-provider agent runtime, GUI automation, MCP, Git worktree, task orchestration, effect ledger, and 3D office workspace. macOS/Windows/Linux.
# Add to your Claude Code skills
git clone https://github.com/opengenesishq/CaoGenLast scanned: 9/13/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@jimp/core: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@jimp/custom: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@nut-tree-fork/nut-js: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@nut-tree-fork/provider-interfaces: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@nut-tree-fork/shared: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization",
"severity": "high"
},
{
"type": "npm-audit",
"message": "baseline-browser-mapping: baseline-browser-mapping process termination on invalid input causes denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "browserslist: Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fflate: fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "file-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "jimp: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
"severity": "high"
},
{
"type": "npm-audit",
"message": "monaco-editor: Vulnerability found",
"severity": "low"
}
],
"status": "WARNING",
"scannedAt": "2026-09-13T09:00:46.282Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how CaoGen compares with popular alternatives.
CaoGen is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by opengenesishq. CaoGen — a vendor-neutral, local-first AI work desktop. Multi-provider agent runtime, GUI automation, MCP, Git worktree, task orchestration, effect ledger, and 3D office workspace. macOS/Windows/Linux. It has 121 GitHub stars.
CaoGen returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/opengenesishq/CaoGen" and add it to your Claude Code skills directory (see the Installation section above).
CaoGen is primarily written in TypeScript. It is open-source under opengenesishq on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh CaoGen against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.