Maintainer of this skill?
Automated security scan — not a certification.
by chigwell
Continuous improvement for AI coding agents: Penelopa analyzes real Codex and Claude Code sessions, finds repeated workflow patterns, and turns them into reusable skills, checks, prompts, and recommendations.
# Add to your Claude Code skills
git clone https://github.com/chigwell/Penelopa.aiLast scanned: 9/6/2026
{
"issues": [
{
"file": "README.md",
"line": 24,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://penelopa.ai/script | sh\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-09-06T08:23:51.494Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how Penelopa.ai compares with popular alternatives.
Penelopa.ai is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by chigwell. Continuous improvement for AI coding agents: Penelopa analyzes real Codex and Claude Code sessions, finds repeated workflow patterns, and turns them into reusable skills, checks, prompts, and recommendations. It has 139 GitHub stars.
Yes. Penelopa.ai passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/chigwell/Penelopa.ai" and add it to your Claude Code skills directory (see the Installation section above).
Penelopa.ai is primarily written in JavaScript. It is open-source under chigwell on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh Penelopa.ai against similar tools.
No comments yet. Be the first to share your thoughts!
30 days in the Featured rail · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
Continuous improvement for AI coding agents. Connect Codex and Claude Code once, keep working, and review practical recommendations in your personal dashboard or desktop companion.
curl -fsSL https://penelopa.ai/script | sh
If your Linux installation has wget instead of curl:
wget -qO- https://penelopa.ai/script | sh
$installer = Join-Path $env:TEMP "penelopa-install.ps1"
Invoke-WebRequest -UseBasicParsing -Uri "https://penelopa.ai/script.ps1" -OutFile $installer
powershell.exe -NoProfile -ExecutionPolicy Bypass -File $installer
The command downloads a verified private Node/npm runtime, connects your account, configures the hooks, and builds Penelopa.ai on your computer. Git, Python, system npm, Homebrew, Xcode and Visual Studio are not prerequisites. No system package manager or global PATH is changed.
Desktop targets: macOS 13.5+ on Apple Silicon or Intel, and Windows 10 22H2+ / Windows 11 x64. Linux x64/arm64 with kernel 4.18+ and glibc 2.28+ supports hooks only. Windows ARM and Linux Desktop are not included in this release. Allow 3 GB of free space for desktop builds, staging and rollback, plus internet access to Penelopa, nodejs.org, the npm registry, and official Electron release downloads.
/hooks. Installing the files does not automatically approve them.Closing the window keeps Penelopa in the tray/menu bar. Quit closes the desktop client; hooks still capture events and launch their own delivery worker. Failed uploads remain queued, and are retried by the running client or subsequent hook events. No additional always-running system service is installed.
The app displays the current web dashboard, including activity, recommendations, individual reports, Telegram settings and the Sessions explorer. Sessions lets you browse captured conversations, inspect each message and tool input/output, follow newly delivered events, and trace process steps back to their evidence. Large content is read in bounded fragments; availability follows server retention. Older clients show an update prompt for Sessions until the desktop is updated. An internet connection is needed for these pages. Connection diagnostics and app settings remain available offline.
Mac builds receive an ad-hoc signature, without a Developer ID or notarization. Windows builds do not claim a trusted publisher signature. These are local builds; Gatekeeper, SmartScreen, enterprise policies and notification permissions can still require user action or prevent launch. The installer reports a desktop failure separately and preserves successfully installed hooks. It does not disable OS protections, strip quarantine attributes or add trusted root certificates.
After installation, commands can run offline from the private runtime. On macOS/Linux:
"$(cat "$HOME/.auto-improve/node-path")" "$HOME/.auto-improve/bin/penelopa.cjs" --diagnose
"$(cat "$HOME/.auto-improve/node-path")" "$HOME/.auto-improve/bin/penelopa.cjs" --repair
To refresh an existing Claude Code hook with a supplied account token in one command:
curl -fsSL https://penelopa.ai/script | AUTO_IMPROVE_TOKEN='YOUR_TOKEN' sh -s -- --repair --agent claude --no-desktop
Alternatively, download/rerun the original installer with these options. PowerShell uses the corresponding names, for example -Diagnose, -Repair, -Token, -NoDesktop.
| Option | Purpose |
|---|---|
--agent codex|claude|both |
Choose agents; default is both |
--no-desktop |
Install hooks without building a client |
--desktop required |
Require a supported production desktop target |
--diagnose |
Print diagnostics without credentials or transcripts |
--repair |
Repair or update Penelopa hooks, repeat the local self-test, and keep the account token unless a new token is supplied |
--no-launch |
Build without opening the app |
--force-new-token |
Explicitly create a new account token |
--no-access-link |
Suppress the private browser sign-in link |
--uninstall |
Remove Penelopa hooks/app/startup registration, retaining account and queued data |
--uninstall --purge-data |
Also remove Penelopa credentials and local queued data |
Normal installation logs do not print tokens or private sign-in URLs. A repeated installation reuses the account. Sign out of client does not pause collection; Pause collection stops new capture and delivery while preserving the queue. Authentication errors do not automatically create a new account.
Existing endpoint, token, environment-file, source-schema and upload-limit options remain available; use --help. The old --install-deps switch is retained for compatibility; private runtime installation is automatic. Explicit custom uploader URLs must implement the current snapshot/receipt contract. Custom API endpoints are supported for hooks only and disable desktop account import.
~/.auto-improve (override with AUTO_IMPROVE_HOME).~/.auto-improve-hook.env or ~/.auto-improve-hook.json, protected for the current user. Independent hooks need this credential file; it is not encrypted by the desktop app.~/Applications/Penelopa.ai.app; Windows: %LOCALAPPDATA%/Programs/Penelopa.ai with a Start Menu shortcut.AUTO_IMPROVE_DATA_DIR, AUTO_IMPROVE_HOOK_CONFIG, CODEX_HOME and CLAUDE_CONFIG_DIR remain supported. App settings and credentials are stored outside the replaceable app bundle.Use the Node version pinned in desktop/release-config.json and CI (currently 24.20.0):
npm ci
npm run typecheck
npm run test:web:unit
npx playwright install chromium
npm run test:web
npm run verify:desktop-assets
npm run test:desktop
npm run build
build builds the website. test:desktop generates temporary bundles from current source, while verify:desktop-assets checks the published asset hashes without rewriting them. On macOS or Windows, npm run verify:desktop-build packages and launches current source in a temporary directory.
Run npm run release:desktop explicitly to prepare deterministic source ZIPs, checksummed manifests and public shell/PowerShell bootstraps. It refuses different content at an existing versioned release path. Before preparing a changed release, bump the versions together in desktop/package.json, desktop/package-lock.json and desktop/release-config.json, and retain previous releases.
Source bundles contain an isolated desktop lockfile and the durable uploaders. Installation uses npm ci --ignore-scripts and an explicitly verified Electron archive; it does not run arbitrary npm lifecycle scripts or compile Chromium. See desktop delivery notes for the architecture, CI matrix, launch verification and release sequence.
npm run test:web:visual compares the reviewed macOS Chromium screenshots. Browser tests mock API responses and control time; they do not need an account. The Session Explorer notes, behavior contracts and refactor ledger describe preserved differences, validation evidence and separate migration work. The standalone penelopa-how-it-works-demo.html is an archived reference; maintain the React demo in app/components/.
The desktop checks for updates at startup and daily. Update & restart prepares the next version outside the running app, checks its signature/launch, and then replaces it. Failure keeps the previous working bundle and the existing account, settings and queue.