by Fzkuji
Self-Programming AI Assistant. Capture, automate, and refine all your workflows.
# Add to your Claude Code skills
git clone https://github.com/Fzkuji/OpenProgramLast scanned: 8/13/2026
{
"issues": [
{
"file": "README.md",
"line": 165,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/Fzkuji/OpenProgram/main/scripts/ins\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-08-13T05:40:50.558Z",
"npmAuditRan": true,
"pipAuditRan": false,
"promptInjectionRan": true
}OpenProgram is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Fzkuji. Self-Programming AI Assistant. Capture, automate, and refine all your workflows. It has 384 GitHub stars.
Yes. OpenProgram passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/Fzkuji/OpenProgram" and add it to your Claude Code skills directory (see the Installation section above).
OpenProgram is primarily written in Python. It is open-source under Fzkuji on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh OpenProgram against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
"The more constraints one imposes, the more one frees oneself." — Igor Stravinsky, Poetics of Music
We propose Agentic Programming. An LLM is flexible; code is deterministic. Let the model run everything and you get chaos — unpredictable execution, context explosion, no output guarantees; hard-code everything and you lose the intelligence. A harness balances the two, interleaved moment to moment — Python for the flow you want fixed, the LLM for the judgement you can't script. (the full rationale →)
Contents
curl -fsSL https://openprogram.io/install | sh
Windows x86_64 or arm64 CLI/server:
irm https://openprogram.io/install.ps1 | iex
Desktop: macOS releases use the unsigned DMG; Windows uses a signed win-x64.exe or win-arm64.exe when that artifact is attached to the GitHub Release. Linux and Windows without that EXE use the complete CLI/server runtime and Web UI.
Platform matrix, PATH, openprogram doctor, and source-checkout install: Installation.
The first openprogram run opens a provider setup wizard, then the terminal chat. Re-run the wizard with openprogram setup.
openprogram
Open the Web UI at http://localhost:18100:
openprogram web
Confirm with one printed reply:
openprogram --print "Introduce yourself in one sentence"
GUI Agent, Research Agent, and Wiki Agent ship with every supported release. Third-party Programs use openprogram programs install <owner>/<repo>. Details: Getting Started.
spawn sub-agents, message across sessions, file-touching branches in git worktrees.@agentic_function and the execution DAG.OpenProgram supports macOS and Linux installations, native Windows x86_64/arm64 CLI/server, multiple providers, and a Web interface (Desktop App or openprogram web → http://localhost:18100). The Windows Desktop distribution path produces a signed per-user installer and embeds the same complete runtime; Windows sandbox execution remains a separate level. The harness itself provides four mechanisms — one primitive and the three capabilities it enables.
An agent is a Python function. You write it like any other function. The docstring is the system prompt: it tells the model what this agent does. Each argument is input for this run. A str argument is the task. In this example the task is the ticket to classify. You do not store the prompt or the JSON as separate variables. They are written as code. choices=[...] asks again until the answer is one of those words.
Here is an example, compared with the common way:
@agentic_function
def triage(ticket: str, runtime=None) -> str:
"""Classify the ticket as bug / feature /
question, then draft a reply."""
kind = llm( # 🤖 LLM decides
ticket, choices=["bug", "feature", "question"])
if kind == "bug": # 🐍 you decide
logs = search_logs(ticket) # 🐍 plain Python
return llm( # 🤖 LLM writes
f"Reply using:\n{logs}")
return llm("Draft a short reply.")
🤖 llm() is the model call
🐍 everything else is ordinary Python, and it runs every time
TRIAGE_PROMPT = """You are a triage
agent. Classify the ticket as bug,
feature, or question. Reply as JSON."""
TOOLS = [{"type": "function", "function": {
"name": "triage",
"parameters": {"type": "object",
"properties": {"ticket": {"type": "string"}},
"required": ["ticket"]}}}]
resp = client.chat(TRIAGE_PROMPT, tools=TOOLS)
kind = json.loads(resp)["kind"] # hope it parses
if kind not in ("bug", "feature"):
... # and re-prompt by hand
Context is an addressable node, not a per-agent buffer — so every multi-agent move is just "point at a different node set":
| Want to… | It's one call |
|---|---|
| Run a sub-agent on a clean context | spawn_branch(...) |
| Send a message to another branch, get the reply | message_branch(message, target=...) |
| Try an alternative without losing the original | fork the node |
| Let a branch touch files safely | it runs in its own git worktree |
A code gate can't be talked past. When the model's answer fails validation, it is sent back to re-decide — this is the real transcript:
llm → "probably a feature request"
gate ✗ no parseable pick from ["bug", "feature", "question"]
llm → {"call": "feature"}
gate ✓ → branch taken in Python
And it grows itself: the agent edits its own @agentic_function files with ordinary file tools → a watcher hot-loads them → the new tool is live on the next turn. No create() / fix() machinery.