跳到正文

正在自动登录…

今日发布 · 第 25 期

次日 08:00出刊 · 北京时间

跨设备协同、AI 智能体与安全研究:今日开源项目亮点

日报 · 2026-11-02 · GitHub 新星

当日新增收录 29 个项目本文涉及 12 个项目约 13 分钟阅读

覆盖日期:2026-11-02 · 北京时间

发布时间:2026/11/3 08:00:20

本期日报收录 29 个项目,涵盖应用服务、提示词、研究项目与资源合集。文章聚焦跨设备协同工具 NectarLink 与 DuoDesk、AI 智能体 AnyModelBot、自主渗透测试系统 ARTEX 及其 PoC、轻量编码代理 UNCUT 等代表性项目,探讨它们解决的问题、适用场景与差异,并提及 Steam 库存评估、红果短剧下载、物理教科书等实用工具。

今天的开源项目呈现出几个清晰的脉络:跨设备协同工具在功能上走向整合,AI 智能体开始强调本地优先与模型中立,安全研究领域则出现了更多基于 LLM 的自动化尝试。以下从这些主题出发,介绍本期值得关注的项目。

1. 跨设备协同:从单一功能到一体化工作台

跨设备连接工具并不新鲜,但本期两个项目都试图把过去分散在多个应用里的功能收拢到一个界面中。

NectarLink 的目标很直接:让 Android 手机和 Windows PC“像一台设备一样工作”。它把通知、消息、通话、剪贴板、文件传输、照片浏览、屏幕镜像和远程控制整合在一起,甚至支持把手机当作网络摄像头或 PC 的扬声器。项目作者坦言,自己之前同时使用 Phone Link、KDE Connect 和 LocalSend 三款工具,分别处理通知、剪贴板和文件,NectarLink 正是为了替代这种碎片化体验而诞生。它采用本地优先、端到端加密的设计,不需要账户和云服务,每个功能都有独立的开关,敏感功能默认关闭。

https://github.com/thtbee/nectarlink

与 NectarLink 定位相似但覆盖面更广的是 DuoDesk,它支持 Mac、Windows、Linux 和 Android 之间的任意组合,除了常规的鼠标键盘共享、文件传输和剪贴板同步,还允许把 Android 平板变成第二屏幕,或在电脑上接听手机电话、使用手机摄像头参与视频会议。DuoDesk 同样强调无账户、无云端,设备之间通过加密链路直接通信,连接方式涵盖同一 Wi-Fi、USB 线、蓝牙甚至 Wi-Fi Direct。值得注意的是,它的 Mesh 模式目前不支持图片剪贴板和多设备文件拖拽,手机同时只能连接一台电脑,Linux 设备仅能通过同一 Wi-Fi 连接。

https://github.com/0xCodez/DuoDesk

这两款工具适合那些在多设备间频繁切换、希望减少重复操作的个人用户。NectarLink 更聚焦 Android 与 Windows 的组合,DuoDesk 则覆盖了更广泛的平台矩阵,选择哪一款往往取决于你的设备构成。

2. AI 智能体:本地优先与模型中立

AI 智能体是近期的热门方向,本期收录的 AnyModelBot 提供了一个值得关注的思路:把智能体跑在用户自己的设备上,同时保持对模型的自由选择。

AnyModelBot 是一个本地优先的 AI 智能体应用,支持 Windows、macOS 和 Linux。它的核心设计是“一个机器人就是一个人设”,每个机器人拥有自己的默认模型、工作区和记忆。用户可以在应用内直接对话,也可以把它接入微信、飞书、Telegram、Slack 和 Discord 等聊天渠道。机器人能够读写文件、执行命令、操作桌面,但一旦要越出自己的工作区,就会先征求用户同意。对话、记忆、文件和 API Key 都保留在本地设备上。

https://github.com/modelflare-ai/AnyModelBot

与 Grok Bot、OpenAI dots 或 Claude Duet 这类绑定特定厂商的智能体不同,AnyModelBot 通过 Modelflare 服务接入 GPT、Claude、Gemini、Grok、DeepSeek 等 70 多个模型,按 token 计费,不绑定任何一家的订阅。它提供了桌面版、命令行、Docker 和本地网页控制台四种运行方式,方便用户按需部署。不过,电脑操作功能需要桌面会话,macOS 上仍为 Beta;Telegram、Slack、Discord 目前只处理单聊。

对于希望拥有一个常驻个人 AI 助手、又不想被单一模型厂商绑定的开发者来说,AnyModelBot 提供了一个开源且灵活的选项。

3. 安全研究:LLM 驱动的自动化渗透测试

本期安全方向出现了两个同名项目 ARTEX,它们都是基于 LLM 多代理的自主渗透测试系统,但维护者不同。

BaaRai/ARTEX 是原项目的中文源码英译版,RuoJi6/ARTEX 则是独立维护的版本,保留了原始提交历史与 AGPL-3.0 许可证。两者功能基本一致:通过 Go 后端和 Next.js 前端提供 Web 界面,支持资产同步、流量捕获、漏洞重测、人在环路对话等功能。系统依赖 PostgreSQL 数据库,探索功能需要配置 LLM(支持 Anthropic、OpenAI 或本地 Ollama)。安装方式灵活,可以选择一键脚本、Docker Compose 或预编译二进制。

https://github.com/BaaRai/ARTEX

https://github.com/RuoJi6/ARTEX

需要特别注意的是,RuoJi6/ARTEX 的作者明确声明,该项目仅供个人学习、代码研究与本地技术验证使用,严禁用于对任何线上系统或网站发起实际测试。BaaRai/ARTEX 的演示模式也仅生成明确标记的模拟记录,不会请求真实目标。这类工具的价值在于帮助安全研究人员理解 LLM 在自动化测试中的潜力,而非直接投入生产环境。

与 ARTEX 形成互补的是 KillaBoi/StealMyBitcoin-PoC,这是一个针对 PHP 8.4.26 的 CTF 解题 PoC 脚本。它通过内存泄漏和伪造结构,最终执行系统命令,完整复现了“Steal My Bitcoin”挑战的攻击链。脚本仅使用 Python 标准库,针对 Alpine PHP 8.4.26 CLI 服务器(四 worker)校准,攻击成功率约 70%,需要多次尝试。作者特别提醒,Debian 的 php:8.4.26-fpm 虽然版本号相同,但二进制布局不同,代码指针指纹无法匹配,运行会在代码泄漏阶段中止。这个 PoC 适合安全研究人员和 CTF 爱好者研究 PHP 内存破坏技术,但它的适用范围非常狭窄,仅针对特定构建环境。

https://github.com/KillaBoi/StealMyBitcoin-PoC

4. 开发工具与实用小工具

在开发工具方面,UNCUT 提供了一个轻量级的编码代理框架。它只有 7 MB 的静态二进制,包含四个工具,通过标准输入输出工作,专为 shell 管道、CI 作业、容器和本地模型设计。UNCUT 的核心卖点是“无损”:整个对话在每次模型调用时都会完整发送,文件内容和命令输出不会被截断;如果提供方在输出限制处截断响应,UNCUT 会报错退出,而不是把部分答案当作成功。它没有 TUI、遥测、插件系统或自动重试,刻意保持极简。不过,UNCUT 不是沙箱,模型可以以操作系统用户的权限执行 shell 命令,作者建议在一次性容器或隔离环境中运行不可信任务。

https://github.com/Balanov/uncut

面向普通用户的实用工具中,steam-stash-value-report-card 可以在终端评估 Steam 库存价值并生成可分享的卡片。它支持 CS2、Dota 2、TF2、Rust 等游戏的库存定价,对比 Steam 市场和多个现金交易平台的价格,输出报告卡、游戏卡、库存图、收据等多种版式。每个数字都标注了来源和时间窗口,Steam 钱包资金与现金严格区分。作者建议在家用电脑上运行,因为 Steam 对数据中心和云服务器 IP 限流严重。

https://github.com/AssassinCreator/steam-stash-value-report-card

hongguo-downloader 则是一个红果短剧的批量下载工具,采用网页服务模式:用户粘贴分享链接,云端完成下载、解密、校验和打包,按实际下载的集数计费。它支持单集直链和整剧 ZIP 打包,扣费发生在取件时,失败不收费。项目明确声明与红果及字节跳动无任何关联。

https://github.com/parallelpan/hongguo-downloader

5. 内容创作与教育

内容创作方面,ai-manju-skills 提供了 21 个题材的 AI 漫剧全流程模板。每个模板是一个 SKILL.md 文件,输入一句故事点子,就能生成企划案、资产图提示词、分集剧本、分镜与视频提示词。它可以在 Claude Code、WorkBuddy 中使用,也可以直接粘贴到 DeepSeek 等聊天工具。作者提醒,当前版本仅在 WorkBuddy 实测通过,部分题材只做过安装校验或阶段 1 试跑,其余尚未逐一实测;发布前需按平台规则确认内容并标注 AI 生成。

https://github.com/zhanghao123vip/ai-manju-skills

git-koi 则是一个有趣的小项目:根据 GitHub 账号的公开活动生成像素锦鲤 GIF,用于个人资料页展示。它的语言配色、贡献增长、连续天数都会影响锦鲤的外观,每天结束时的活动决定它如何游动。用户可以通过 GitHub Action 在个人资料仓库中运行,也可以从命令行使用,或作为 Rust 库集成。

https://github.com/yalongwastaken/git-koi

教育领域,atlas-of-physics 是一本交互式 3D 物理教科书,面向 AP Physics 1 和 AP Physics C 课程。它用 3D 动画展示运动、力学、电磁学等概念,滚动翻页、悬停高亮、点击分解向量和图表,并配有 AP 风格练习题。项目采用 MIT 许可证,并注明 AP 是 College Board 的商标,本站未获其认可。

https://github.com/nathanliow/atlas-of-physics

6. 结语

本期项目呈现出几个值得关注的趋势:跨设备协同工具从单一功能走向一体化,AI 智能体开始强调本地运行与模型中立,安全研究领域则出现了更多 LLM 驱动的自动化尝试。无论是 NectarLink 和 DuoDesk 对多设备工作流的整合,还是 AnyModelBot 对模型自由的选择,抑或 ARTEX 对渗透测试自动化的探索,都反映了开发者对“减少重复劳动”和“掌控自己数据”的共同追求。对于普通用户,这些项目提供了切实可用的工具;对于开发者,它们则是观察当前技术方向的有益样本。

文章生成于 2026/11/3 08:01:50 · 依据本期保存的资料撰写

本期项目与来源资料

收录数按本期首次达标收录的项目统计。

  • thtbee/nectarlinkRust · 1,698 Stars

    跨设备连接、文件传输、屏幕镜像

    Stars 统计更新于 2026/11/3 07:55:52

    查看原始资料

    作者描述

    Your Android phone and your Windows PC, working as one. Local-first, end-to-end encrypted, no account.

    编报时的 AI 中文解读

    NectarLink 是一款免费开源的跨设备连接工具,让 Android 手机和 Windows PC 协同工作,支持通知、消息、通话、剪贴板、文件传输、照片浏览、屏幕镜像和远程控制等功能。它采用本地优先、端到端加密的设计,无需账户和云服务。

    编报时的 README 依据

    <div align="center"> <img src="assets/brand/icon.svg" alt="" width="96" height="96"> # NectarLink **Your Android phone and your PC, working as one.** Notifications, messages, calls, clipboard, files, photos, screen mirroring and phone apps in windows, between Android and Windows 10 (2004+) or 11. Free and open source. Local-first, end-to-end encrypted, no account and no cloud. Hi, I'm Bee, and yes, a bee built an app called NectarLink. I build cool stuff in the open on [𝕏 @thtbee_](https://x.com/thtbee_), so come see what's next. Feedback, bugs or ideas? DM me directly.
    The [user guide](docs/guide/README.md) walks through every step and feature. ## What it does **Stay on top of your phone** - **Notifications** on the PC, with replies, actions, Live Updates (progress, timers, deliveries) and a **Copy code** button for one-time codes. Clear on one side, cleared on the other. - **Messages**: SMS and MMS conversations plus chats from RCS, WhatsApp, Telegram, Signal and other apps in one inbox. Reply, send pictures, start new conversations. - **Calls**: see who's calling, answer, decline or hang up from the PC, call
    - **Touchpad, air mouse, keyboard, voice typing and presentation remote.** - **Deck**: a Stream Deck style grid of buttons for the PC (media, shortcuts, apps, OBS Studio, commands), with live volume and mute. - **Lock, sleep and wake** the PC. **Camera and sound** - **Phone as a webcam** in Zoom, Teams, Meet, OBS and the Camera app. - **Continuity Camera**: take a photo or scan a document with the phone and have it on the PC's clipboard. - **Phone as a speaker** for the PC's sound, and a **voice recorder** that saves straight to the PC.
    <img src="docs/screenshots/desktop-glass-home.png" alt="NectarLink for Windows: Home with the phone's notifications and music playing, Glass theme" width="880"> </p> ## Why NectarLink NectarLink came out of my own frustration. I kept juggling Phone Link for notifications and messages, KDE Connect for the clipboard and LocalSend for files, and always wanted one app that did all of it. So I made one. It covers what those three did for me, with one app on each side, plus a lot of new features I wanted that I think you'll enjoy having too. ## Download | | Download | Needs | |---|---|---|
    > allow your browser or file manager to install apps when asked. > [!IMPORTANT] > In India and many other countries, Google Play Protect blocks the APK with > no **Install anyway** button. Pause **Scan apps with Play Protect** while you > install it (Play Store › your profile › Play Protect › Settings), then turn it > back on, or install it from a PC with `adb install`. See > [Play Protect blocks the APK](docs/guide/troubleshooting.md#google-play-protect-blocks-the-apk-without-an-install-anyway-button). ## Get started 1. Install NectarLink on your PC and on your phone.
    2. On the PC, the setup walkthrough shows a QR code. Scan it with the phone (from the NectarLink app or any camera app), or pick the PC from the phone's list of nearby devices and compare a 6-digit code. A USB cable works too. 3. Allow what you want to share. Every feature has its own switch per device, and the sensitive ones are off until you turn them on. 4. Optional: set up **Wireless debugging** once in the phone app for the features Android reserves for privileged apps (phone apps in windows, real touch input, background clipboard sync). No root, nothing else to install.
    | **Windows (x64)** | [Installer (.exe)](https://github.com/thtbee/nectarlink/releases/download/v0.1.4/Nectarlink-0.1.4-x64-setup.exe) | Windows 10 (2004+) or 11, 64-bit Intel or AMD (Phone as webcam needs Windows 11) | | **Windows (ARM64)** | From the next release | Windows 11 on ARM (Snapdragon) | | **Linux (x86_64)** | From the next release: [one command](#on-linux), or a .deb, .rpm, AppImage or .tar.gz | Ubuntu 24.04 or newer, Debian 13, Fedora 40 or newer, 64-bit Intel or AMD |
    | **Android** | [App (.apk)](https://github.com/thtbee/nectarlink/releases/download/v0.1.4/Nectarlink-0.1.4-android.apk) | Android 8.0 or newer | The apps update themselves from GitHub Releases and check every download against its SHA-256 sums. ### On Linux From the next release, one command installs NectarLink with everything it needs, and shows each step as it goes: ```bash curl -fsSL https://github.com/thtbee/nectarlink/releases/latest/download/install.sh | sh ``` It picks the package for your system (.deb with apt, .rpm with dnf or zypper,
    | Photos browser & download | Yes | Yes | Yes | | Continuity Camera | Yes | Yes | Yes | | Calls & SMS viewer | Yes | Yes | Yes | | Phone quick toggles & volume | Yes | Yes | Yes | | Clipboard text & image sync | Yes | Yes | Yes (two-way text, incoming photo) | | System notifications | Yes | Yes | Yes (system banners) | | Phone screen mirroring | Yes | Yes | Not yet (in development) | | Screen recording (MP4) | Yes | Yes | Not yet | | PC audio stream / phone mic | Yes | Yes | Not yet | | Phone as webcam | Yes | Yes (with v4l2loopback) | Not yet |
  • modelflare-ai/AnyModelBotTypeScript · 1,328 Stars

    AI智能体、模型服务接入、聊天辅助

    Stars 统计更新于 2026/11/3 07:31:13

    查看原始资料

    作者描述

    🤖 Open-source, local-first alternative to Grok Bot, OpenAI dots and Claude Duet. Your own AI bots on any model: GPT, Claude, Gemini, Grok, DeepSeek, Kimi, GLM and 70+ more through one Modelflare key. Reach them in the app, WeChat or Feishu; they remember you, work in the background, run commands and use your computer. Pay per use.

    编报时的 AI 中文解读

    本地优先的AI智能体应用,支持Windows、macOS和Linux,可连接微信、飞书、Telegram等渠道,在后台执行任务并操作电脑。 通过Modelflare服务使用GPT、Claude、Gemini等70多个模型,按token计费,数据保留在本地设备。

    编报时的 README 依据

    <p align="center"> <img src="docs/assets/features/model-switch.gif" alt="打开模型选择器、搜索一个模型、查看它的上下文长度和参考价,并把当前对话切换过去" width="100%"> </p> ## 🧠 有记忆,随处可达 - **记忆会延续。** 机器人用 Markdown 保存三层记忆(团队、机器人、群),会过滤看起来像密钥的内容。 - **长对话也能用下去。** 上下文快满之前,上下文管家会压缩,或开一个新段并带上交接摘要。 - **账号全局共用。** 微信、飞书、Telegram、Slack、Discord、Notion 的账号在设置里加一次,所有机器人共用,每个服务可以加多个、起别名。在聊天软件里发一次 `/bot 名字` 就换一个机器人聊,也可以让机器人读你的 Notion 和飞书消息。 - **微信和飞书。** 微信扫码连接,飞书机器人支持流式回复卡片;微信还能收发图片和文件。 - **Telegram、Slack、Discord。** 在 设置 › 连接 里填 token 连接,不需要公网地址;回复边写边显示,能收发图片和文件。目前只处理单聊,审批和提问回复文字。 - **四种运行方式。** 桌面版、命令行、Docker,以及 `127.0.0.1:3600` 的本地网页控制台。
    **用 Docker 部署到 NAS 或服务器**(镜像同时支持 x64 和 arm64) ```bash docker run -d --name amb -p 3600:3600 -v amb-data:/data ghcr.io/modelflare-ai/anymodel-bot docker exec amb cat /data/ui-token # 然后打开 http://<主机>:3600/?token=<令牌> ``` 不要把 3600 端口直接暴露到公网。 **从源码运行** ```bash git clone https://github.com/modelflare-ai/AnyModelBot.git cd AnyModelBot npm install npm run setup # 拉取并编译内置网关 npm start # 本地管理界面:http://127.0.0.1:3600/ ``` 从源码构建需要 Node.js 22.13+ 和 Go 1.26.8+。想自己构建 Docker 镜像,见[开发文档](./docs/development.md)。 # 🌠 截图 截图是简体中文界面;应用也有英文界面,在设置里切换。 <picture>
    - **遥测保持关闭。** 内置电脑操作驱动的遥测已关闭,内置网关以关闭自动更新的方式运行。 - **浅色、深色或跟随系统。** 六个机器人角色,眼睛会跟着你的鼠标转。 - **托盘与开机自启。** 关闭窗口会收到托盘;macOS 和 Windows 支持开机自启。 <p align="center"> <img src="docs/assets/features/characters-eyes.gif" alt="六个 AnyModelBot 角色排成一排,鼠标从它们上方移过时,眼睛会跟着转" width="100%"> </p> > [!NOTE] > 功能是否可用取决于你选择的模型、操作系统和授予的权限。电脑操作需要桌面会话,macOS 上的电脑操作为 Beta。模型请求会经过 Modelflare 转发给你选定的供应商,详见[工作原理与隐私](#-工作原理与隐私)。 # 🆚 对比 Grok Bot / OpenAI dots / Claude Duet
  • BaaRai/ARTEXGo · 1,153 Stars

    自主渗透测试、资产同步、流量捕获

    Stars 统计更新于 2026/11/3 07:51:27

    查看原始资料

    作者描述

    ARTEX - AI autonomous penetration testing system (English translation)

    编报时的 AI 中文解读

    ARTEX 是一个基于 LLM 多代理的自主渗透测试系统,提供 Go 后端和 Next.js 前端,用于自动化执行安全测试任务,支持资产同步、流量捕获、漏洞重测等功能。

    编报时的 README 依据

    The script will: detect / auto-install Docker → then let you choose **① all-Docker** or **② local build and run**: - **① All-Docker**: enter a Postgres password (press Enter for a random one) → auto-writes `.env` → `docker compose up -d`. - **② Local run**: choose a database (connect to an existing one / start one with Docker) → generates `config.json` → `go` builds the embedded single binary → starts. Once installed, open **http://localhost:8787** (on first entry, `/setup` sets the admin password). ### Option 2: Docker Compose (manual) ```bash
    `/message?sessionId=...` returned by the server; when configuring, set the URL to `/sse` and the request header as `Authorization=Bearer <token>`. ### Option 3: download prebuilt binaries (Releases) Download the zip for your platform from [Releases](https://github.com/BaaRai/ARTEX/releases); after extracting you get `artex` + `start.sh` (`start.bat` on Windows) + `skills/` + `config.example.json`: ```bash cp config.example.json config.json # fill in the database connection ./start.sh # → http://localhost:8787 ```
    > Please start with `start.sh` / `start.bat` instead of running `./artex` directly. It is a daemon script: if the process crashes, it restarts it after a backoff. > To keep it running in the background: `nohup ./start.sh >artex.log 2>&1 &`. ### Option 4: build the single binary from source ```bash # 1) frontend static export cd web && npm ci && npm run build:static && cd .. # 2) copy into the embed directory cp -r web/out server/webui/dist # 3) build (only -tags embedui embeds the frontend) CGO_ENABLED=0 go build -tags embedui -o artex ./cmd/artex ./start.sh ```
    - Choose the targets and asset types to sync by **project** or **task** (domains / subdomains / IPs / ports / sites / endpoints…); - One-click import, merged by company asset scope, straight into ARTEX's asset graph for agents to explore. --- ## Installation > Requires a **PostgreSQL** database; exploration requires an **LLM** (`ANTHROPIC_API_KEY` or `OPENAI_API_KEY`, which can also be configured in the UI). ### Option 1: one-click install script (recommended) ```bash git clone https://github.com/BaaRai/ARTEX.git cd ARTEX ./install.sh ```
    **LLM**: `export ANTHROPIC_API_KEY=sk-...` (or `OPENAI_API_KEY`); you can also fill it in on the UI's "LLM Configuration" page — which can add a local Ollama server as a keyless provider (format "Ollama", base URL default `http://127.0.0.1:11434/v1`, models loaded from the server). Optional: `ARTEX_LLM_PROVIDER` (anthropic | openai | openai-responses | ollama) / `ARTEX_LLM_MODEL` / `ARTEX_LLM_BASE_URL` / `ARTEX_LLM_PROXY`. **Concurrency**: the number of work agents per task is configured in "System Settings" (default 3).
    UPX self-extracting binaries may be incompatible with some Linux kernels, virtualization environments, or security policies, so they are disabled by default. Use `ARTEX_TARGETS` to customize the targets; when you have confirmed the target runtime is compatible, explicitly pass `--upx` to further shrink the binary: ```bash ARTEX_TARGETS=linux/amd64,windows/amd64 ./build.sh --release ./build.sh --target linux/amd64 --upx ``` --- ## Backups `scripts/backup.sh` dumps the Postgres database (and optionally the data directory) with timestamped output and rotation: ```bash
    In this version, history is viewed via vulnerability details and sessions; it is not yet included in vulnerability report exports or task archive packages, and is not automatically linked to traffic captures. Demo mode only generates clearly labeled simulated records and never requests real targets. ### Running and testing locally ```bash ./dev.sh # backend(:8787) + traffic proxy(:8788) + frontend next dev(:5173) → http://localhost:5173 ``` - Backend: `go run ./cmd/artex` (without `-tags embedui`, the frontend is not embedded)
  • KillaBoi/StealMyBitcoin-PoCPython · 1,034 Stars

    CTF解题、PHP漏洞利用

    Stars 统计更新于 2026/11/3 07:36:08

    查看原始资料

    作者描述

    A public release of the Steal My Bitcoin challenge

    编报时的 AI 中文解读

    这是一个CTF解题的PoC证明脚本,复现了针对PHP 8.4.26的Steal My Bitcoin挑战的攻击链,通过内存泄漏和伪造结构最终执行系统命令。适合安全研究人员、CTF爱好者研究PHP内存破坏和利用技术。

    编报时的 README 依据

    **Everything below is written against the Docker lab**, not the live challenge. The lab is a local Alpine PHP 8.4.26 CLI server behind nginx, which is the same build and worker model the offsets were calibrated on. [Stand it up in a minute](#the-lab) and the whole chain runs end to end on your own machine. The live run that actually solved the challenge is kept as a historical note at the [bottom](#the-live-run-that-solved-it). ``` stage what goes out what comes back ─────────────────────────────────────────────────────────────────────────────
    0 health GET /php-version.php -> PHP 8.4.26 confirmed 1 heap leak 249,042 B producer + 8 x 6,672 B -> 256 B cookie (OOM poisons a worker) └─ Zend chunk base 2 code leak 251,557 B producer + 8 x 92,388 B -> 16 B cookie (OOM poisons a worker) └─ zval_ptr_dtor 3 callback 368,812 B POST -> forged HashTable runs (fake HashTable + command) └─ zif_system(cmd)
    <p align="center"> <sub>sponsored with ❤️ by</sub>&nbsp;<a href="https://hextree.io" title="he didnt want a dono so i gave him this banner, ty mr liveoverflow for helping"><img src="https://i.ibb.co/fVZ3Nvcx/hextree.jpg" alt="hextree.io" height="22" align="middle"></a> </p> # Steal My Bitcoin CTF proof of concept > One live PHP callback against the Steal My Bitcoin challenge, start to finish, in a single standard-library Python file. ![Python](https://img.shields.io/badge/python-3.11%2B-blue) ![Dependencies](https://img.shields.io/badge/dependencies-none-success)
    A couple of notes on that recipe. The image is the `fpm` tag but the container runs `php -S`, so the SAPI is `cli-server`, which is what the calibration was measured against. `PHP_CLI_SERVER_WORKERS=4` is what gives the leak stages more than one worker to race for. My own lab harness also passed `--cap-add SYS_PTRACE --security-opt seccomp=unconfined` so it could attach a tracer to the workers; the PoC itself never does that, so those are left out above. --- ## Start here Python 3.11 or newer, standard library only, nothing to install: ```powershell
    python .\stealmybitcoin_poc.py --url http://127.0.0.1:18166/php-version.php ``` Run it with no arguments and it prints its help and exits without touching the network. A good run looks like this: ```console [health] PHP 8.4.26 confirmed [heap] strict Zend base 0x78113e800000 [code] strict zval_ptr_dtor 0x615b1f512930 {"stage": "final", "nonce": "1ef0e73d8615157a", "execution_proof_verified": true, "response_path": "..."} ```
    The offsets in this PoC are calibrated for **Alpine PHP 8.4.26 running the built-in CLI server with four workers**. The lab reproduces exactly that, behind nginx, on loopback. > [!IMPORTANT] > The build matters more than the version string. A Debian `php:8.4.26-fpm` stack reports the same `PHP/8.4.26` but has a different binary layout, so the code-pointer fingerprint will never match and the run aborts at the code-leak stage. Use the Alpine image below. Three small files. Put them in an empty directory: **`public/php-version.php`** (the health endpoint, and the only page the PoC needs)
    The script makes no claim about whether a returned WIF controls the advertised Bitcoin address. A checksum-valid WIF only tells you the string encodes a private key properly. Deriving the address and comparing it is a separate job. --- ## How often it actually works Both leak stages are races against three other workers, so a single run is not expected to succeed every time. Ten consecutive runs against the lab described above, with no retries and nothing else talking to the container: | Result | Count | | --- | --- | | `execution_proof_verified: true` | 7 |
  • RuoJi6/ARTEXGo · 1,026 Stars

    自主渗透测试、漏洞管理、资产同步

    Stars 统计更新于 2026/11/3 07:51:28

    查看原始资料

    作者描述

    Autumn-27/ARTEX 持续维护开源版本

    编报时的 AI 中文解读

    ARTEX 是一套基于 LLM 多 agent 的自主渗透测试系统,提供 Web 界面用于管理任务、查看资产和漏洞,并支持人在环路对话。适用于安全研究人员在本地隔离环境中进行技术验证和学习。

    编报时的 README 依据

    本项目采用 **GNU Affero General Public License v3.0(AGPL-3.0)** 授权,完整条款见仓库根目录的 [LICENSE](LICENSE) 文件。 这意味着任何人都可以自由使用、修改和分发本项目,但**衍生作品必须同样以 AGPL-3.0 开源**;特别地,**若你修改本项目并通过网络(如部署为在线服务)向用户提供,也必须向这些用户公开对应的完整源码**。 > ⚠️ **重要提示**:开源协议本身不限制软件的使用用途。以下的「使用限制」与「免责声明」是作者对使用者的额外约定与郑重声明,请务必遵守。 **ARTEX 仅供个人学习、代码研究与本地技术验证使用,不得用于对任何线上系统或网站发起实际测试。** ### 允许使用范围 - 仅可用于**阅读、学习与研究本项目源码**,以及在**本地隔离环境**中进行技术原理验证; - 适用于个人学习、学术研究、代码审阅等非攻击性用途。 ### 禁止事项 - **严禁使用本工具对任何网站、线上服务或联网系统发起扫描、探测、利用或攻击**(无论是否获得授权、是否为自有资产); - 严禁将本工具用于任何实际的渗透测试、攻防对抗或生产环境; - 严禁将本工具用于非法入侵、数据窃取、勒索、拒绝服务或任何破坏性、犯罪性活动; - 严禁利用本工具从事违反所在国家/地区法律法规的行为。
    <div align="center"> # ARTEX AI 自主渗透测试系统(Go 后端 + Next.js 前端) 🌐 **在线 Demo**: [https://artex-demo-ruoji6.vercel.app/](https://artex-demo-ruoji6.vercel.app/) </div> 本仓库为独立维护的 [RuoJi6/ARTEX](https://github.com/RuoJi6/ARTEX),保留 https://github.com/Autumn-27/ARTEX 的原始提交历史与 AGPL-3.0 许可证。程序发布包从本仓库 Releases 下载,Docker 镜像 [ruoji6/artex](https://hub.docker.com/r/ruoji6/artex) 由本仓库 GitHub Actions 构建并发布。 --- ## 截图预览 > 完整交互见[在线 Demo](https://artex-demo-ruoji6.vercel.app/)。 | 仪表盘(总览 / Token 消耗 / 活动流) | 任务列表 | | :---: | :---: | | ![仪表盘](screenshots/dashboard.png) | ![任务](screenshots/tasks.png) |
    - **① 全部 Docker**:填一个 Postgres 密码(可回车随机)→ 自动写 `.env` → `docker compose up -d`。 - **② 本地运行**:选数据库(连已有 / 用 Docker 起一个)→ 生成 `config.json` → `go` 编译内嵌单二进制 → 启动。 装好后打开 **http://localhost:8787**(首次进入 `/setup` 设置管理员密码)。 ### 方式二:Docker Compose(手动) ```bash git clone https://github.com/RuoJi6/ARTEX.git cd ARTEX cp .env.example .env # 填 POSTGRES_PASSWORD、可选 ANTHROPIC_API_KEY docker compose up -d # 拉取 ruoji6/artex 镜像 + postgres # → http://localhost:8787 ``` 镜像已含常用工具(ripgrep/curl/vim/npm/nmap…);`./skills` 与 `./data` 以绑定挂载持久化。
    此后按正常流程发布更高版本即可自动更新 Demo。若 Demo 部署失败,已发布的程序包和镜像仍然有效,旧 Demo 通常继续提供服务;修复设置后单独重跑 `deploy-demo`,不必重新发布整个 Release。两个版本同时发布时,部署串行执行,并在构建前、上线前检查 latest,避免已过期的构建覆盖新版。 这里采用发布流程直接调用部署 job,是因为使用 `GITHUB_TOKEN` 创建的 Release 不会继续触发另一个 `release: published` 工作流。`demo.yml` 也监听网页手工发布的 Release,经过同样的正式版、完整发布包和 latest 检查后部署;手工重试则运行 `deploy-demo`。 --- ## 安装 > 依赖数据库 **PostgreSQL**;探索需配置 **LLM**(`ANTHROPIC_API_KEY` 或 `OPENAI_API_KEY`,也可在 UI 里配)。 ### 方式一:一键安装脚本(推荐) ```bash git clone https://github.com/RuoJi6/ARTEX.git cd ARTEX ./install.sh ``` 脚本会:检测 / 自动安装 Docker → 让你选 **① 全部 Docker** 或 **② 本地编译运行**:
  • AssassinCreator/steam-stash-value-report-cardPython · 590 Stars

    库存价值评估、价格对比、报告生成

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    Value your Steam stash in the terminal and print it as a share card: per game, per market, what sold and what sits. One Windows portable build, no account.

    编报时的 AI 中文解读

    在终端中评估Steam库存价值并生成可分享的卡片,支持多种游戏和交易市场,提供详细的价格分析。 适用于Steam玩家、交易者以及希望了解库存价值的用户。

    编报时的 README 依据

    **Stashcard** values a Steam account and its inventories (CS2, Dota 2, TF2, Rust, Steam community items or any custom app) from your terminal, prices them on Steam and on the big cash marketplaces, and prints the result as a shareable card: a report card, a game card, an inventory picture, a thermal receipt, a marketplace comparison, or a then-vs-now / A-vs-B diff. Every number carries its venue and window. `LOWEST` is the floor listing right now. `AVG` is the mean of real sales over a window you pick. Steam money is wallet funds; everything else is cash, and the two
    | Marketplaces | `markets P` (or `card P --mode markets`) | Each venue's floor total, fee and net with coverage; best cash route; cheapest buy and best cash sell per item | | Quick value | `value P` | Terminal only. Tables, warnings, `--json` / `--csv` | | Compare | `diff A B` | Then-vs-now (same profile) or A-vs-B (two profiles, side by side) | | Demo | `demo [--mode ...]` | The same pipeline on a bundled fictional profile. No network needed | Utilities: `history P`, `config show | me | api-key | cookie | forget-secrets | reset | path`, `cache info | clear`, `currencies`. ## Options
    Settings, cache and history go to `%LOCALAPPDATA%\stashcard` (`stashcard config path` prints the exact folders). The CI runs the test suite and the demo on Windows as well as Linux. ## Quick start ```sh stashcard # interactive: paste a profile, arrow keys for the rest stashcard demo # offline demo, writes stashcard-demo-summary.png stashcard demo --mode all --out-dir cards # every layout at once stashcard card https://steamcommunity.com/id/yourname --mode grid --game cs2 -c EUR -o stash.png
    stashcard markets yourname -c EUR # every venue's floor, net after fees, where to sell stashcard value 76561197960287930 --lowest-from best --json valuation.json --csv items.csv stashcard diff yourname@last yourname # then vs now, from local history stashcard diff yourname theirname # A vs B, redacted by default stashcard render stash.json --theme paper # re-render a sidecar offline ``` Profiles can be pasted in any form: `steamcommunity.com/id/<name>`, `/profiles/<steamid64>`, a bare
    `card.alt.txt` with alt text you can paste wherever you post the image. ## Install > [!IMPORTANT] > **This is a Windows build.** Stashcard runs on Windows 10/11 (x64) with Python 3.11+. The CLI refuses to start on other systems (`This build is Windows-only.`), because the packaged companion runtime is a Windows program. ```sh pipx install git+https://github.com/AssassinCreator/steam-account-value-checker.git ``` Or from a clone: ```sh git clone https://github.com/AssassinCreator/steam-account-value-checker.git cd stashcard
    pipx install . # or: python -m venv .venv && .venv/bin/pip install -e ".[dev]" ``` Python 3.11 or newer. Dependencies: `httpx`, `brotli`, `rich`, `questionary`, `Pillow`, `platformdirs`. Inter and JetBrains Mono are bundled (SIL Open Font License). Windows steps are below. ## Where to run it **Use your home PC. Windows is recommended; home Linux and macOS work fine too.** Steam throttles inventory and market requests per IP, and datacenter, VPS and cloud ranges are throttled much harder than home connections. In our tests a Linux server in a datacenter got
    <img src="assets/demo.gif" alt="Recording of the interactive flow: typing 'demo', picking Report card with the arrow keys, choosing games, marketplaces (adding CSFloat) and LOWEST from the cheapest venue, watching the progress steps, reading the per-game and top-items tables, and ending on the saved card with a half-block preview" width="100%"> </p> > [!TIP] > **Run Stashcard on your home PC. Windows is the recommended setup.** Steam rate-limits datacenter, > VPS and cloud IPs heavily, so live scans from a server are unreliable. On a server only the demo and
    | Option | Default | Meaning | | --- | --- | --- | | `-g, --game` | `cs2,dota2,steam` | `cs2`, `dota2`, `tf2`, `rust`, `steam`, or a custom `appid/contextid`. Repeat or comma-separate | | `-c, --currency` | `USD` | Any Steam Market currency; Skinport covers 16; USD-only venues are converted (`stashcard currencies`) | | `--source` | `both` | `both` = LOWEST from Steam, AVG from Skinport; `steam`; `skinport` | | `--markets` | `steam,skinport,waxpeer,csgotm,lisskins` | Venues to price on; add `csfloat` (experimental) or use `all` |
  • Balanov/uncutGo · 571 Stars

    AI辅助编程

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    The lossless, headless coding agent harness. One 7 MB static binary, four tools, plain stdin/stdout, no silent cuts.

    编报时的 AI 中文解读

    UNCUT 是一个轻量级的编码代理工具,专为 shell 管道、CI 作业、容器和本地模型设计,强调无损传输,不截断或压缩上下文。适用于需要可靠、可复现的自动化编码任务的开发者。

    编报时的 README 依据

    export UNCUT_BASE_URL="http://localhost:11434/v1" export UNCUT_MODEL="qwen3:8b" uncut "Explain this repository" ``` No API key is required by default for local endpoints. In PowerShell, set variables with `$env:UNCUT_BASE_URL = "..."` and `$env:UNCUT_MODEL = "..."`. Replace the example model with one actually installed on your machine; tool-call behavior depends on the model. ### Unix pipelines ```sh git diff | uncut "Review this diff. Do not edit files." cat failing-test.log | uncut "Find the likely cause" ```
    Piped input is appended to the prompt verbatim. UNCUT accepts valid UTF-8 text and rejects invalid input rather than replacing bytes silently. ### JSONL events ```sh uncut --json "Run the tests and fix the failure" ``` The event stream contains `user`, `assistant`, `assistant_meta`, `tool`, and finally `done` or `error` records. Assistant messages include complete tool calls; tool messages include complete results. Usage and finish reasons are separate `assistant_meta` events. ### Sessions ```sh uncut --session .uncut/work.jsonl "Start the refactor"
    [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE) [![Go](https://img.shields.io/badge/Go-1.26%2B-00ADD8?logo=go&logoColor=white)](go.mod) UNCUT is a tiny coding-agent harness for shell pipelines, CI jobs, containers, and agent experiments. It deliberately has no TUI, telemetry, plugin system, background agents, automatic retries, or context compaction.
    - **Small and portable.** One statically linked Go binary, no runtime or third-party Go dependencies. - **Provider neutral.** Works with OpenAI-compatible Chat Completions endpoints, including local servers. - **Resumable.** Optional append-only JSONL sessions preserve every message and tool result. - **Forkable.** 837 lines of implementation Go, four tools, one provider protocol, one agent loop, MIT license. ## Install ### Linux ```sh VERSION=0.1.1 ARCH=amd64 # Use arm64 on ARM64. curl -fSLo uncut "https://github.com/Balanov/uncut/releases/download/v${VERSION}/uncut-linux-${ARCH}"
    Binary files and invalid UTF-8 are rejected explicitly. UNCUT uses non-streaming Chat Completions and supports text plus tool calls, not images. ## Safety **UNCUT is not a sandbox.** The model can execute shell commands with your operating-system user's permissions. Workspace checks on file tools do not constrain what a shell command can access. Run untrusted tasks in a disposable container or isolated environment, and review sessions and changes yourself. There are no approval popups, automatic commits, automatic retries, or hidden recovery loops. ## Verify the lossless contract
    grep "uncut-linux-${ARCH}$" checksums.txt | sha256sum -c - ``` The binaries are not code-signed yet, so SmartScreen or Gatekeeper may warn. Verify the SHA-256 checksum before allowing a downloaded executable. On macOS, after verification, remove quarantine from this file only: ```sh xattr -d com.apple.quarantine "$HOME/.local/bin/uncut" ``` You can also build from source instead. ### Go install and source builds With Go 1.26+: ```sh go install github.com/Balanov/uncut/cmd/uncut@latest ``` Or build a checkout: ```sh git clone https://github.com/Balanov/uncut.git cd uncut
  • yalongwastaken/git-koiRust · 540 Stars

    生成像素锦鲤

    Stars 统计更新于 2026/11/3 07:36:08

    查看原始资料

    作者描述

    Draw a pixel-art koi from a GitHub account's public activity, as a looping GIF for a profile README.

    编报时的 AI 中文解读

    根据 GitHub 账号的公开活动生成像素锦鲤 GIF,用于个人资料页展示。

    编报时的 README 依据

    # Git koi Git koi draws a pixel-art koi from a GitHub account's public activity. Its languages color it, its contributions grow it, its streaks mark it, and the day that just ended decides how it swims. A nightly workflow puts the koi on a profile README as a looping GIF, the same tool runs from the command line, and the Rust library underneath is published on crates.io. <p align="center"> <img src="https://raw.githubusercontent.com/yalongwastaken/yalongwastaken/main/koi/koi.gif" width="256" alt="The author's koi, redrawn every night from the day's activity" /> </p> <picture>
    ``` ## Usage ### Requirements - For a koi on your profile README: a GitHub account. The Action runs in your profile repository's workflow with its built-in token. - For the command line: a binary from the [releases page](https://github.com/yalongwastaken/git-koi/releases), or Rust at or above the `rust-version` in [Cargo.toml](Cargo.toml), plus the [GitHub CLI](https://cli.github.com), authenticated. - For the library: Rust at or above that same version. [docs/getting-started.md](docs/getting-started.md) walks through all three: the
  • zhanghao123vip/ai-manju-skills未标注语言 · 461 Stars

    漫剧创作、剧本生成、提示词生成

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    21 个题材的 AI 漫剧全流程 Skill:一句点子生成企划案、资产图提示词、分集剧本、分镜与视频提示词。可用于 Claude Code、WorkBuddy、DeepSeek

    编报时的 AI 中文解读

    提供21个题材的AI漫剧全流程模板,输入一句故事点子即可生成企划案、资产图提示词、分集剧本、分镜与视频提示词,适用于Claude Code、WorkBuddy和DeepSeek等工具。

    编报时的 README 依据

    | 现代 | 职场商战 | [shangzhan-manju](skills/shangzhan-manju/SKILL.md) | | 现代 | 年代文 | [niandai-manju](skills/niandai-manju/SKILL.md) | | 现代 | 娱乐圈 | [yule-manju](skills/yule-manju/SKILL.md) | | 现代 | 大学校园青春 | [xiaoyuan-manju](skills/xiaoyuan-manju/SKILL.md) | | 类型片 | 悬疑刑侦 | [xuanyi-manju](skills/xuanyi-manju/SKILL.md) | | 类型片 | 民俗怪谈 | [minsu-manju](skills/minsu-manju/SKILL.md) | ## 怎么用 ### DeepSeek 等聊天工具 1. 打开对应题材的 `SKILL.md`,复制全部内容。 2. 开一个新对话,粘贴发送。 3. 它回复"模板已就绪"后,发一句故事点子。 一部剧用一个对话,一个对话只用一个模板,否则容易串设定。 ### Claude Code 把需要的题材文件夹复制到 `~/.claude/skills/`,然后直接发故事点子。 ### WorkBuddy
    如果你的版本支持导入 Skill,就导入对应文件夹;不支持就按聊天工具的方法整段粘贴。 ## 常用指令 | 你说 | 它做 | |---|---| | 一句故事点子 | 输出立项卡和企划案 | | 继续 | 写当前阶段的下一批,写完后进入下一阶段 | | 第3集手册 | 写第3集的资产图和镜头 | | 第3集发布包 | 写第3集的封面和文案 | | 改:女主改成冷面师姐 | 只改相关部分,并检查前后是否矛盾 | ## 输出内容 1. **企划案**:故事、人物、世界体系、逐集剧情、伏笔、美术、声音、发布 2. **资产库**:人物、道具、场景、特效的出图提示词 3. **分集剧本**:分场与逐字对白 4. **分集导演手册**:本集资产图、分镜图提示词、分时段视频提示词 5. **发布包**:封面提示词、片尾与预告方案、发布文案 默认 30 集、每集约 4 分钟、9:16 竖屏,可以在点子里指定别的。镜头数和时长不固定:每个题材有自己的节奏,每集再按内容调整。 内容较长,所以分批输出,每批开头标明进度,回复"继续"写下一批。能直接写文件的工具可以连续写完,文件结构写在 `SKILL.md` 第一章。 ## 使用前请注意
    - **测试状态**:当前版本已在 WorkBuddy 实测通过;此前玄幻修仙版经过实际使用测试,宫斗、宅斗、年代文、系统无限流、总裁甜宠、重生复仇、职场商战做过安装校验或阶段1试跑;其余题材尚未逐一实测。 - **视频工具**:提示词里的 `{{Mixed N}}` 是参考图的引用写法,换工具时请改成对应写法。 - **上线合规**:发布前请按所在平台的规则确认内容,并标注 AI 生成内容。悬疑刑侦、民俗怪谈等题材平台要求较多,请先确认。 - **原创**:模板要求人物和设定全部原创。生成内容的版权与合规责任由使用者自行承担。 ## 许可证 [MIT](LICENSE)
  • parallelpan/hongguo-downloader未标注语言 · 437 Stars

    视频下载、批量下载、打包下载

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    红果短剧下载工具:红果短剧 / 红果免费短剧 全集下载、批量下载与整剧打包 ZIP,粘贴分享链接即云端处理、按集取件,免安装网页版。Hongguo downloader — short drama downloader for cdrama & duanju: paste a link, fetch every episode online, pay per episode, no install.

    编报时的 AI 中文解读

    红果短剧批量下载工具,提供网页版服务,用户粘贴分享链接即可云端处理,按集付费下载或打包。 面向需要保存红果短剧完整剧集的用户,免安装,支持单集和整剧ZIP打包下载。

    编报时的 README 依据

    <div align="center"> <img src="assets/logo.svg" width="76" alt="hongguo-downloader" /> # 红果短剧批量下载工具 · hongguo-downloader **红果短剧全集下载 · 批量下载 · 整剧打包** —— 粘贴一条分享链接,云端处理,按集付费取件。 把「手动逐集存片」变成「一条链接」的下载交付系统,**在线版、免安装**,打开网页即可使用。 <p> <a href="https://guoshi.app?utm_source=github&utm_medium=readme&utm_campaign=hongguo-downloader"> <img src="assets/badges/cta-live.svg" height="34" alt="在线体验 guoshi.app" /> </a> &nbsp; <a href="#架构"> <img src="assets/badges/cta-arch.svg" height="34" alt="看架构" /> </a> </p> <p> <img src="assets/badges/version.svg" height="20" alt="version" />
    | 本地存一堆文件,找起来靠记忆 | 统一任务列表 + 24 小时有效直链,随时回来取 | | 先付钱、不知道能不能下成 | **取件时才扣费**,失败不收费,重复取件不重复扣 | **和桌面客户端的区别**:**免安装**、不用配环境、不用自己合并转码 —— 打开网页就能用,手机同样可以操作。下载完成既可按**分集直链**逐集取,也可一次**整剧打包**。 --- ## 三步完成一次交付 | ① 贴链接 | ② 云端处理 | ③ 取件计费 | |---|---|---| | 粘贴红果分享链接、整段分享口令,或直接填剧集编号。解析后立刻看到剧名、封面、集数与更新进度。 | 关掉网页也没关系。任务在服务端排队执行,每集独立重试,进度实时可见,完成后站内提醒。 | 勾选需要的集数,确认后一次性扣费并生成 24 小时直链,可单集取、也可打整包 ZIP。 | ![下载任务列表](assets/screenshots/jobs.png) --- ## 功能一览 | 模块 | 能力 | |---|---| | 解析 | 分享链接 / 分享口令 / 剧集编号三种输入;24 小时缓存,重复解析不重复请求上游 | | 发现 | 热播榜、真人榜、AI 榜、动漫榜四类榜单(6 小时刷新);按剧名搜索,60 秒缓存 |
    | 任务 | 同剧同集自动复用运行中的任务,不重复扣费;失败集单独重试,可随时取消 | | 交付 | 分集直链 / 按需整剧打包 ZIP;直链默认以「附件」下发,点开即下载而不是在线播放;支持断点续传 | | 计费 | 余额 + 卡密 + 在线支付三通道;**扣费发生在取件**,`job_id` 唯一键保证并发取件只扣一次 | | 支付 | Binance Pay(USDT,唯一金额指纹 + 备注码)与 Stripe(卡 / Apple Pay,托管收银台)双通道,官方查单为准 | | 后台 | 总览、用户、订单、卡密、下载任务五个页面;CSV 导出;卡密生成与作废(唯一的不可逆写操作) | | 运维 | 健康检查暴露 db / oss / device / queue 状态;任务心跳超时自动回收 | --- ## 界面 ### 用户端 <table> <tr> <td width="50%"><img src="assets/screenshots/series.png" alt="剧集详情" /></td> <td width="50%"><img src="assets/screenshots/recharge.png" alt="余额与充值" /></td> </tr> <tr>
    <img src="assets/badges/status.svg" height="20" alt="status" /> <img src="assets/badges/tests.svg" height="20" alt="tests" /> <img src="assets/badges/license.svg" height="20" alt="license" /> </p> <sub>非官方项目,与红果 / 字节跳动无任何关联。</sub> </div> ![hongguo-downloader 首页](assets/screenshots/hero-home.png) --- ## 这是什么 红果短剧只提供「在 App 里一集一集看」,没有全集下载,也没有批量导出。想留存一套完整剧集,要么手动点几百次,要么装个客户端硬啃。 这个项目把整条链路做成了一个网页服务:**你只负责贴链接,下载、解密、校验、打包、发直链全部在云端完成,最后按实际下载的集数计费。** | 传统做法 | 本系统 | |---|---| | 逐集点击、逐集等加载,1000 集要几小时 | 贴一条链接,云端并发处理,交付以分钟计 | | 断在中间得从头再来 | 每集独立状态,失败自动重排,已完成的跳过 |
    <summary><b>支持红果免费短剧的全集下载吗?</b></summary> <br /> 支持。粘贴任意一集或整部剧的分享链接,解析后可以一次勾选全部集数;取件时既可单集直链下载,也可一次生成 ZIP 整包,两种方式都支持断点续传。 </details> <details> <summary><b>为什么按集计费,而不是会员制?</b></summary> <br /> 因为成本与集数线性相关(带宽、存储、设备占用),会员制会让「下 1000 集」和「下 10 集」的人付一样的钱,最后只能靠限速来平衡。按集计费更接近真实成本,用户也更容易算清一次要花多少。 </details> <details> <summary><b>重复取件会不会重复扣费?</b></summary> <br /> 不会。扣费绑定在「取件记录」上,`job_id` 唯一键保证同一任务只生成一条扣费记录;重复点取件只会刷新直链有效期。 </details> <details> <summary><b>下载失败会扣钱吗?</b></summary> <br /> 不会。失败的集不计费;已经扣费但交付失败的,走退款流水回补余额。 </details> --- ## 免责与权利声明
  • nathanliow/atlas-of-physicsJavaScript · 370 Stars

    物理学习、交互式阅读

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    An interactive 3D textbook for AP Physics 1 and AP Physics C

    编报时的 AI 中文解读

    这是一个交互式3D物理教科书,面向AP物理1和AP物理C课程,通过3D动画展示运动、力学、电磁学等概念,并配有练习题。

    编报时的 README 依据

    Tools need `npm install` (puppeteer-core) and Chrome (set `CHROME` to its path if not at the macOS default). Screenshots: `CHAPTER=newton PARTS=rest:0,car:5 node tools/shoot.mjs shots/newton` (PARTS = key or key:page) Run: `python3 -m http.server 8137` (any static server; three.js loads from jsDelivr) and open http://127.0.0.1:8137/ Keys: ← → turn pages, Esc puts a part back. Links: `newton/#4` opens page 2.4. Phones and tablets: the figure stacks over the text, swipes snap to whole pages, a tap breaks a part down; resolution steps down by itself if frames run slow.
    AP® is a trademark of the College Board, which does not endorse this site. The equation sheet follows the published AP Physics equation tables. MIT licensed.
  • 0xCodez/DuoDeskJavaScript · 360 Stars

    跨设备协同、鼠标键盘共享、文件传输

    Stars 统计更新于 2026/11/3 07:31:15

    查看原始资料

    作者描述

    All your computers and your phone, working as one desk. Aurora redesign of TwinDesk. GPL-3.0

    编报时的 AI 中文解读

    DuoDesk 是一款免费开源的跨设备协同工具,让 Mac、Windows、Linux 和 Android 设备像一台机器一样协同工作。支持共享鼠标键盘、屏幕扩展、文件传输、剪贴板、相机、通话短信等,无需账号或云端。适用于需要在多台设备间高效切换和共享资源的个人或团队。

    编报时的 README 依据

    <img src=".github/assets/hero.jpg" alt="The DuoDesk Overview window, 'What should your desks do?', with cards for Workstation, Studio-Mac and Pixel 8, between a Windows PC on the left and a MacBook and a phone on the right, on one glowing desk line" width="100%"> </p> Your devices are good at their own jobs and bad at working together. DuoDesk fixes that. Put a **Mac and a Windows PC** side by side and use them with one mouse and keyboard. Open the PC's apps on the Mac. Turn an old laptop or your **Android tablet** into a second screen. Answer
    your **phone's calls and texts** from the computer, use its **camera in a video call**, and paste on one device what you copied on another. - **Any combination.** Mac ↔ Windows, Mac ↔ Mac, PC ↔ PC, Linux ↔ anything, and Android ↔ any computer. Or, with [DuoDesk Mesh](#-duodesk-mesh-every-device-at-once), all of them at once. - **Anywhere.** Same Wi-Fi, a USB cable, or no shared network at all: Bluetooth and a direct Wi-Fi link of their own. - **No account, no cloud.** Devices talk only to each other, on an encrypted link.
    <p align="center"> <img src=".github/assets/icon.png" width="112" alt="DuoDesk icon"> </p> <h1 align="center"><a href="https://getduodesk.vercel.app">DuoDesk</a></h1> <p align="center"> <b>All your computers and your phone, working as one desk.</b><br> Screens, apps, files, clipboard, cameras, calls, texts, notifications, mouse and keyboard, shared between Mac, Windows, Linux and Android.<br> Free and open source. No account, no cloud, no shared network needed. </p> <p align="center"> <a href="#download"><b>⬇️ Download 2.5</b></a> ·
    ### 📡 [Connections](#-connections) Same Wi-Fi · USB cable · **Bluetooth** · **Wi-Fi Direct** and **hotspot** links made on demand · picked for you, moved for you </td> </tr> <tr> <td width="33%" valign="top"> ### 🚀 [Get started](#-get-started) Download · open on both · pair once with a code · turn on what you want · [privacy](#privacy): no account, no telemetry </td> <td width="33%" valign="top"> ### 🐧 [Linux](#linux) and 🤖 [Android](#android-in-detail) in detail
    X11 and Wayland · shared folders through Samba · the phone app page by page · [wireless debugging](#wireless-debugging), set up once </td> <td width="33%" valign="top"> ### 🛠 [Under the hood](#how-it-works) [How it works](#how-it-works) · [build and run](#build-and-run) on macOS, Windows, Linux, NixOS and Android · [GitHub Actions](#github-actions) </td> </tr> </table> <a name="download"></a> ## ⬇️ Download <table> <tr> <td width="25%" align="center" valign="top"> **🍎 macOS**<br><sub>13 Ventura or later</sub>
    <img alt="Windows 10/11" src="https://img.shields.io/badge/Windows-10%20%7C%2011-0078d4"> <img alt="Linux X11 and Wayland" src="https://img.shields.io/badge/Linux-X11%20%7C%20Wayland-f0a30a"> <img alt="Android 10+" src="https://img.shields.io/badge/Android-10%2B-3ddc84"> <img alt="License: GPL-3.0" src="https://img.shields.io/badge/license-GPL--3.0-blue"> <a href="https://github.com/0xCodez/DuoDesk/releases"><img src="https://img.shields.io/github/downloads/0xCodez/DuoDesk/total" alt="Downloads"></a> </p> <p align="center">
    <a href="https://github.com/0xCodez/DuoDesk/releases/download/v2.5.0/DuoDesk-2.5.0-arm64.dmg"><img src="https://img.shields.io/badge/Apple_Silicon-.dmg-000000?style=for-the-badge" alt="macOS, Apple Silicon"></a> </td> <td width="25%" align="center" valign="top"> **🪟 Windows**<br><sub>10 and 11</sub> <a href="https://github.com/0xCodez/DuoDesk/releases/download/v2.5.0/DuoDesk-Setup-2.5.0.exe"><img src="https://img.shields.io/badge/x64-Installer-0078d4?style=for-the-badge" alt="Windows, x64"></a><br>
    Mesh works on Windows, Mac and Linux: turn it on in the **Multi-device** tab, and off again any time with everything as you left it. Connecting just two devices? You won't need it. Still coming to Mesh: pictures on the clipboard, and files dragged to more than one device at a time; the phone connects to one computer at a time, and Linux joins over the same Wi-Fi only. --- # 📱 Phone and tablet Most phone links stop at notifications and a file drop. In DuoDesk your Android phone or tablet is a **full peer**: it pairs like a computer and gets the same features, plus its calls, texts, photos,
  • robertnisipeanu/mgu-storeJavaScript · 351 Stars

    车载应用管理

    查看原始资料

    作者描述

    App store for BMW iDrive 7 / iDrive 8 head units: install and update apps from GitHub repos, URLs and USB sticks

    编报时的 AI 中文解读

    为宝马iDrive 7和iDrive 8车机提供应用商店,可在车载屏幕上浏览、安装、更新和卸载来自GitHub仓库、网址或USB存储的应用。

  • tang1693/KIKUmapSwift · 318 Stars

    聊天监控、思维导图整理、聊天导出导入

    查看原始资料

    作者描述

    A mind map for your Claude/ChatGPT chats — macOS menu-bar app

    编报时的 AI 中文解读

    Kikumap是一款macOS菜单栏应用,用于将Claude和ChatGPT的固定聊天以思维导图形式整理和监控,支持查看运行状态、未读提醒、导出和导入聊天内容,帮助用户跟踪多个AI对话。 该应用面向重度使用Claude和ChatGPT桌面应用的用户,通过菜单栏图标和桌面小组件展示正在运行、等待关注的聊天及使用量统计,并提供定时任务时间线功能。

  • justrach/nanolightZig · 220 Stars

    应用启动、数学计算、网页搜索

    查看原始资料

    作者描述

    A ⌘Space launcher for the Mac, drawn by nanoui: apps, math, Google suggestions with results in the panel, Grok and X

    编报时的 AI 中文解读

    Nanolight 是一款面向 Mac 的快速启动器,通过快捷键唤起面板,可搜索应用、进行数学计算、获取 Google 建议并直接在面板中查看结果,同时支持调用 Grok 和搜索 X。适合希望提升操作效率的 Mac 用户。

  • SAOS-3624/dsh-see-nowJavaScript · 161 Stars

    屏幕画面采集、视频帧筛选、AI视觉输入

    查看原始资料

    作者描述

    让 AI 实时看见你的屏幕:按变化量筛选帧、多帧拼进一张图,静止画面几乎不花 token

    编报时的 AI 中文解读

    See Now 是一个为 DSH 设计的实时视觉插件,通过按变化量筛选屏幕帧并拼接成图,让 AI 实时看见屏幕内容,同时节省 token。适用于需要 AI 辅助观看屏幕、视频或摄像头的场景,个人和非商业用途免费。

  • a55uka/nupPython · 146 Stars

    游戏打包

    查看原始资料

    作者描述

    NUP is a clean-room container format for unencrypted NX (Nintendo Switch 1/2) game dumps.

    编报时的 AI 中文解读

    NUP是一种用于存储未加密Nintendo Switch 1/2游戏转储的容器格式,可将基础内容、更新和附加内容打包到一个压缩文件中。

  • ravencaio/tlou-remastered-pcC++ · 140 Stars

    游戏运行

    查看原始资料

    作者描述

    Native Windows PC port of The Last of Us Remastered (PS4, CUSA00552). Runs the game’s own x86-64 code on a custom runtime, with PS4 system libraries reimplemented and a Vulkan renderer based on shadPS4. Includes a launcher. No game files included: you need your own copy.

    编报时的 AI 中文解读

    这是一个在Windows上原生运行《最后生还者 重制版》PS4游戏的移植项目,通过自定义运行时和Vulkan渲染器执行游戏代码,需要用户自备游戏文件。

  • egoist/godrawGo · 136 Stars

    白板绘图、tldraw兼容

    查看原始资料

    作者描述

    infinite canvas in mygo

    编报时的 AI 中文解读

    godraw 是一个本地原生白板应用,用 Go 和 MyGo 编写,无需 Web 视图或 JavaScript,可读写 tldraw 的 .tldr 文件,提供绘图、编辑、导出等功能。

  • artemnovitckii/claude-animation-skillsJavaScript · 130 Stars

    动画生成、视频制作

    查看原始资料

    作者描述

    Six Claude Code skills that make animations for reels, no footage needed: 3D cartoon explainer, stick figure, minimal line art, 3D map route, exploded view, line graph.

    编报时的 AI 中文解读

    为Claude Code提供六个技能,用于生成无需实拍素材的动画短片,包括3D卡通解说、简笔画、极简线条艺术、3D地图路线、分解视图和折线图。用户通过斜杠命令输入描述,Claude自动生成动画视频。

  • elhajahmadj/offline-emergency-libraryPowerShell · 119 Stars

    离线资料下载、本地AI聊天、离线地图

    查看原始资料

    作者描述

    One command downloads a complete offline, no-internet emergency library: local AI (CPU/GPU), document Q&A, full Wikipedia, offline maps for any country/region (default US), survival/repair/medical archives, and public-domain manuals. Asks only where to save.

    编报时的 AI 中文解读

    这是一个用于下载完整离线应急知识库的工具,包含本地AI聊天、文档问答、维基百科、离线地图、生存维修医疗档案等,适用于断网、偏远地区或需要自包含参考资料的场景。

  • mille-okws/pestinhaPython · 108 Stars

    虚拟宠物互动

    查看原始资料

    作者描述

    Pestinha é um pet virtual de desktop para Windows, com rede neural pulsada, emoções e personalidade que evolui com o usuário. Ele aprende com carinho e consequências, faz travessuras, brinca, trabalha e reage ao ambiente. Tudo funciona localmente, sem depender da nuvem.

    编报时的 AI 中文解读

    Pestinha 是一款桌面虚拟宠物应用,支持 Windows、macOS 和 Linux,内置脉冲神经网络,能表达情绪、学习用户行为并做出恶作剧等互动。适合喜欢桌面宠物、想体验本地运行 AI 驱动的虚拟生物的电脑用户。

  • duyunzhoudyz/dyz-med-paper-skillsPython · 98 Stars

    医学论文写作、文献检索、审稿回复

    查看原始资料

    作者描述

    医学论文写作与科研助手:面向中国医生和医学研究生的 32 个 Agent Skills,适用于 Claude Code、Codex,覆盖选题、PubMed 文献检索、中英写作、选刊投稿与审稿修回。Medical writing & research skills.

    编报时的 AI 中文解读

    面向中国医生和医学研究生的医学论文写作与科研辅助工具,提供32个Agent Skills,覆盖选题、文献检索、中英写作、选刊投稿和审稿修回等环节。

  • wendersoon/radar-cnpj-mcpTypeScript · 96 Stars

    公司查询、本地数据检索

    查看原始资料

    作者描述

    Servidor MCP e CLI para localizar empresas brasileiras por CNAE e região, utilizando dados abertos de CNPJ da Receita Federal.

    编报时的 AI 中文解读

    这是一个MCP服务器和命令行工具,用于在巴西CNPJ公共数据库中按经济活动(CNAE)和地区查找公司,数据来自巴西联邦税务局。它旨在让AI代理或终端用户快速查询本地数据。

  • alla2001/material-painterRust · 69 Stars

    纹理绘制、贴图烘焙、材质设计

    查看原始资料

    作者描述

    PBR texture painter: paint, bake mesh maps and design materials with a node graph. Rust + wgpu.

    编报时的 AI 中文解读

    Material Painter 是一款面向游戏和影视资产制作的 PBR 纹理绘制工具,支持图层、智能材质、遮罩、网格贴图烘焙、节点图材质设计以及自定义 WGSL 着色器,并提供多种引擎导出预设。

  • routerhubSI/uncensored-models未标注语言 · 54 Stars

    模型资源索引

    查看原始资料

    作者描述

    The uncensored model library — every uncensored and abliterated model, what it does, free open weights on Hugging Face and hosted API access, in one index. Maintained by RouterHub.

    编报时的 AI 中文解读

    这是一个索引库,汇总了未审查和去除拒绝方向的模型,按系列分组列出,提供规格、价格和Hugging Face链接,适合寻找这类模型的开发者或研究者参考。

  • uriyovsiannikov/OpenSilliconC · 54 Stars

    操作系统学习

    查看原始资料

    作者描述

    be simple!

    编报时的 AI 中文解读

    OpenSillicon 是一个从零开始构建的小型 x86_64 操作系统,包含内核、帧缓冲终端、shell 和用户空间,适合对操作系统原理感兴趣的学习者或开发者。

  • Balanov/baiagent-distributionJavaScript · 53 Stars

    产品分发规划、渠道分析、物物交换方案

    查看原始资料

    作者描述

    Evidence-driven partner pilots and distribution experiments for innovators within Start Pervyh.

    编报时的 AI 中文解读

    面向创新者与产品所有者的本地优先分发工具,帮助产品构建可验证的市场推广路径、生成物物交换方案并准备自动化行动流。

  • woniuniuniu/dsh-media-deskJavaScript · 52 Stars

    内容创作、灵感管理、排期管理

    查看原始资料

    作者描述

    DeepSeek Harness 自媒体工作台插件:一句话记灵感,一键生成脚本、封面、配图和分镜

    编报时的 AI 中文解读

    这是一个DeepSeek Harness插件,为自媒体创作者提供灵感记录、一键生成脚本、封面、配图和分镜,以及排期和复盘功能。

查看本期全部收录项目

本期完 · GitHub 新星

AI 文章依据本期保存的项目资料撰写,可能存在遗漏或误读,可展开来源资料核对。观察范围为本站收录项目。Stars 为编报时取得的累计数量,正文项目注明统计更新时间;补刊不还原过去的 Stars。

项目资料在发布时保存,Markdown 文章由后台生成后自动发布。后续 Stars 更新不会改写已保存资料;无法公开的仓库会隐藏。 收录等级不代表安全或质量评价。