GitHub Top 5: CleanYourTV debloats Android TV, 33K stars

Every week I go through the repos that gained the most GitHub stars in seven days and pick the top five. This week, Oct 19 to 25, 2026, the list runs from DeepSeek's own inference engine and a voice studio that works offline to a skill from Cloudflare that audits your code. Number one is a repo that cleans the ads and telemetry off your Android TV, and it gained more than twice the stars of number two.

The video above counts them down in about ten minutes. Below is the written version, with how each repo works, how to set it up, and what to watch out for. Stars this week come from gittrend.io's weekly ranking; totals are as of Oct 27.

#5 DeepInfer: the inference engine behind DeepSeek's production services

DeepInfer is the high-performance inference framework that powers DeepSeek's own large-scale production services. This open-source release covers offline inference, with the core features needed for serving at scale, and it already has 23,000 stars in total.

For now it supports one model, DeepSeek-V4.1-Flash. The default checkpoint, deepseek-ai/DeepSeek-V4.1-Flash-1017, downloads into the Hugging Face cache on the first run; set DEEPINFER_HF_MODEL_DIR to run from a local copy instead.

What is inside:

• Optimized kernels: DeepSeek's FlashMLA, DeepGEMM, DeepEP, TileKernels and DeepSelect, plus custom TileLang kernels.
• Parallelism: attention data parallelism and balanced context parallelism, and expert parallelism for the mixture of experts with load balancing (EPLB).
• DSpark and confidence-scheduled verification: faster decoding with draft tokens, with confidence estimates deciding when to verify them.
• SWA bounded replay: less decoder prefill work, by replaying only a bounded suffix.
• Asynchronous scheduling: CPU batch scheduling overlaps with device execution. On by default.
• Batch-invariant inference and deterministic sampling: identical results whatever else is in the batch, and identical output for identical input tokens, sampling parameters and a fixed seed. Both are NVIDIA only.
• Structured outputs: constrain generation to a regex, a JSON schema or an EBNF grammar, passed in SamplingParams.

It runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. The published benchmarks were measured on 4 SM100 GPUs for prefill and 64 for decode. You need Linux, GCC 13 or newer and Python 3.12, plus CUDA 13 (NVIDIA) or CANN 9.2 (Ascend). In an empty Python 3.12 environment:

``bash export DEEPINFER_ACCELERATOR=nvidia # or ascend ./build.sh python examples/offline_inference.py ``

One thing to know: this is offline inference, not a complete service. A KV cache system, prefill/decode disaggregation and load balancing across data-parallel replicas are not in this release. DeepInfer was originally built mostly on vLLM, with ideas from SGLang and TensorRT-LLM. Apache-2.0 licensed.

#4 VoiceStudio: an open source voice studio that runs fully local

VoiceStudio calls itself the open source, fully local ElevenLabs alternative. It covers voice cloning, voice design, video dubbing, dictation, transcription and audiobooks, in 646 languages, and it already has almost 89,000 stars in total.

The README sorts it into three columns:

• Create: clone a voice or design your own, and dictate with a floating widget.
• Produce: dub videos with timed speech, and make stories, audiobooks and batch jobs.
• Connect: a local API and an MCP server for your agents, plus reusable recipes and watch folders.

The default engine is k2-fsa's OmniVoice, and you can pick another engine from the catalog. Local workflows run on your hardware; remote services are optional, and usage analytics need your consent.

Install on macOS or Linux: curl -fsSL https://voicestudio.sh/install | sh

On Windows, run irm https://voicestudio.sh/install | iex in PowerShell. The installer keeps your settings, projects and models. There are also releases for macOS, Windows, Linux, Android and iPhone, and a Docker setup.

It runs on a lot of hardware: CUDA on NVIDIA cards, Metal on Apple Silicon from M1 to M5, and plain CPU on older PCs, just slower. A preview runs the models on Android phones and iPhones, offline once downloaded. You can also paste an install prompt into Claude Code, Codex or Cursor; the agent guide covers hardware detection, asks before downloading models and finishes with a test generation. Agents that support skills can run npx skills add debpalash/VoiceStudio.

One rule from the license section: the app is AGPL-3.0, but model weights, voices and generated output come with their own conditions. And clone voices only with permission.

#3 AI Job Search: a job search framework built on Claude Code

AI Job Search is a job application framework built on Claude Code. Its author, a geophysicist whose job was cut in late 2025, used it for a real job search: 69 tailored applications, 20 first interviews and one signed contract.

Three commands do the core work:

1. /setup fills in your profile, from a documents folder (CV, LinkedIn export, diplomas), a single CV pasted into the chat, or an interview.
2. /scrape searches job portals and sorts the matches by fit.
3. /apply <url> runs the whole application: it evaluates your fit, drafts a tailored CV and cover letter in LaTeX, hands them to a second agent that critiques them, then revises and gives you the final version.

Ten more commands extend it. /interview builds a prep pack and runs a mock interview, /outcome records what happened, /rank scores a whole batch of postings, /upskill maps your skill gaps, and there are Gmail and Notion syncs plus an offline HTML dashboard.

The core workflow works in any language and country. The job portal search is built for the Danish market (Jobindex, Jobnet and others), plus LinkedIn; anywhere else, /add-portal builds a search skill for your local job board.

It treats job postings as untrusted input: a gate checks each posting for hidden text and invisible characters before the agents read it. The README still says to skim what was fetched and written before you hit send.

The catch: a fork of a public repo is always public, and /setup writes your personal data, such as your name, contact details and salary expectations, into tracked files. For your own search, use a private repository with this one as upstream. You need Claude Code, which has no free tier, plus Python, Bun and a LaTeX install. MIT licensed.

#2 Cloudflare's security audit skill: your coding agent as a security auditor

This is a coding-agent skill that turns your agent into a security auditor. It is the skill that seeded Cloudflare's vulnerability discovery harness, the single-repo starting point that harness grew from.

It runs an audit in six phases:

1. Reconnaissance: maps architecture, trust boundaries and input surfaces into architecture.md and a coverage ledger.
2. Coverage-led hunting: isolated hunters take units from the ledger, and coverage critics look for gaps.
3. Candidate validation: every candidate goes to a fresh verifier that tries to disprove it.
4. Structured output: records go into findings.json, validated against a schema.
5. Independent record verification: fresh agents verify the final source claims.
6. Target-neutral reporting: REPORT.md and the detail files come from the verified records.

The key rule: the agent that checks a finding is never the agent that found it. There are three verdicts. confirmed has a complete source trace, needs_validation names the exact unresolved fact and carries no severity, and rejected records a disproved candidate. The hunting prompts come in eleven files, from core attack classes and memory safety to prompt injection for LLM apps, supply chain, cloud, and desktop and mobile apps.

Install with the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Then start your agent in your codebase and ask: "security audit this codebase".

It needs a model with tool use and parallel sub-agents, Node.js for the validators, and an OS-enforced sandbox with no external network for running target code. Without that sandbox, a lead stays at needs_validation instead of being executed. Run it more than once: in Cloudflare's test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total, and runs are additive. MIT licensed.

#1 CleanYourTV: debloat your Android TV over Wi-Fi

CleanYourTV gained 33,300 stars this week, more than twice the number two. On Oct 17 its author posted a before and after of their parents' TV, cleaned up by Claude Code over Wi-Fi. The post reached 7.4 million views, and in four days the replies turned into lists for more than 170 TV models from more than 200 contributors.

How it works: Android TVs have the same debug bridge as Android phones. Switch on USB debugging in developer options, allow your computer once, and the rest is standard Android tooling. Then three steps:

1. Back up the list of installed packages and settings.
2. Disable the manufacturer's telemetry, ad services, content rows and preloaded junk with pm disable-user.
3. Install a small native launcher as the home screen.

No root, no cable, and nothing is uninstalled. It uses Android's own disable command, the same switch as Settings > Apps > Disable, so a one-line restore undoes every step, and the scripts never leave the TV without a home app.

The easy path: clone the repo, open it in your coding assistant (Claude Code, Codex, Gemini CLI or Antigravity CLI), paste PROMPT.md and fill in your TV model. It discovers the bloat on your TV, asks before touching anything you might use, and checks each step with screenshots. The README says it takes about fifteen minutes. Without an assistant, the same tools run by hand with Python 3.

What you get looks like an Apple TV: a pitch-black home with a dock of your four favourite apps, a top shelf with an ambient glow taken from the app's artwork, and one floating glass highlight that springs from tile to tile. The launcher is about 526 KB of plain Java, built for TVs with 1 GB of RAM, with no network permission, no background services, and 28 languages.

It works on anything running Android TV or Google TV; Fire TV gets the debloat half only. Samsung, LG and Roku are not supported, but cleanyour.tv has a step-by-step guide to turn off the tracking with your remote. There is also a privacy audit that lists voice, ACR and telemetry candidates with the evidence for each, and the README is honest that it cannot prove intent. MIT licensed; you run it on a TV you own, at your own risk.

Which one to try first

If you have an Android or Google TV, #1 is a fifteen-minute job with a full restore. If you ship code, #2 is the one to run on your own repo this week, ideally more than once. If you are job hunting, #3 shows what a structured agent workflow looks like end to end.

A new Top 5 comes out every week, as a video on the XHEART TV YouTube channel and as an article here.