The O2San Stack
Everything I use to run O2San, my AI team in Claude Code: the agents, add-ons, video pipeline, website and work tools. Each open-source piece has been checked. Please check my work.
How I check a tool
My rule: nothing gets installed until it's been scanned.
SkillSpector by NVIDIA, rules only (--no-llm). The code is read, never run.
A rules-only scan gives almost any big repo a 100, even Anthropic's own plugins, because docs, tests and bundled code match its patterns. The score alone means little. I read every critical flag and check for known vulnerable dependencies; that hand check is the verdict.
For code libraries I use npm audit, which checks for known vulnerabilities. Paid services can't be scanned; they're listed so you can see what's connected.
Use it, watch it, or skip it. Each decision and its reason is listed below.
The core
What O2San runs on.
| Tool | What it does | What I use it for | Check |
|---|---|---|---|
| Claude Codeby Anthropic | AI coding agent in the terminal and desktop app. | Runs O2San: the Chief of Staff and every agent. | Service |
| Codexby OpenAI | AI coding agent. | Backup runner when Claude is busy, using the same folder. | Service |
| Obsidian | Notes app over plain Markdown files. | The shared Brain: rules, decisions, one state page per project. | Service |
| GitHub CLIgh | GitHub from the terminal. | Repo scans (read-only) and code reviews. | Open source |
Claude Code add-ons
Skills and plugins installed in O2San, scanned with SkillSpector and checked by hand.
| Tool | What it does | What I use it for | Score · hand check |
|---|---|---|---|
| superpowersClaude Code plugin | Plans before building, writes tests first, debugs step by step, checks work before calling it done. | How every agent builds and checks code. | 100 Hand check: OKFlags were docs, tests and install notes. No vulnerable dependencies. |
| claude-securityClaude Code plugin by Anthropic | Security scans of a codebase or of recent changes, with suggested fixes. | Checking my websites and tools before release. | 100 Hand check: OKFlags were security-scanner instructions and docs. No vulnerable dependencies. |
| frontend-designClaude Code plugin by Anthropic | Design guidance for pages and app screens. | Landing pages and app screens. | 13 · Safe |
| cavemanClaude Code plugin | Short, token-saving replies, plus usage tools. | Saving tokens on long runs. Off by default. | 100 Hand check: OKThe 2 critical flags: its compress tool sends text to a model you configure (local Ollama by default). The rest were tests, CI and docs. |
| stageshowClaude Code skill | Mock product screens and animated app demos with a cursor. | App demos for my videos. | 100 Hand check: OKFlags were wording in animation docs, like "clear state". |
| SkillSpectorby NVIDIA | Scans skills and plugins for hidden instructions and key theft. | The scan step above, before every install. | The scanner |
Video
My video pipeline, from script to final render.
| Tool | What it does | What I use it for | Check |
|---|---|---|---|
| HyperFramesby HeyGen | Renders video from HTML, CSS and GSAP animations. | Motion graphics and final renders in my video pipeline. | 100 Hand check: OKFlags were bundled build code. npm audit: 5Kit total: 3 high, 2 moderate, in packages HyperFrames brings in (sharp, adm-zip, source-map-js, hono). It only runs on my own machines. Update pending. |
| GSAP | Animation library for the web. | Captions, cards and motion in videos and on my site. | npm audit: 0 |
| three.js | 3D in the browser. | 3D scenes in explainer videos. | Open source |
| Playwrightby Microsoft | Runs a browser by script, with no window. | Rendering video frames; snapshots of my HQ page. | Open source |
| FFmpeg | Command-line video and audio tool. | Cuts, resizing, audio mixing, thumbnails. | Open source |
| Pillow | Image library for Python. | Image crops and checks in my scripts. | Open source |
| ElevenLabs | AI voice. | Voice-overs. | Service |
| Groq (Whisper) | Fast speech-to-text API. | Transcripts and caption timing. | Service |
| CapCut | Video editor. | Editable projects I finish by hand. | Service |
| Apple VideoToolboxbuilt into macOS | On-device video processing. | Upscaling clips to 1080p on the Mac. | Service |
Website
What elronnaranja.com is built with, including this page.
| Tool | What it does | What I use it for | Check |
|---|---|---|---|
| React | UI library. | My website and landing pages. | npm audit: 0 |
| Vite | Build tool and dev server. | Building and previewing the site. | npm audit: 0 |
| TypeScript | JavaScript with types. | All site code. | npm audit: 0 |
| Framer Motion | Animation for React. | Page and section animations. | npm audit: 0 |
| Lenis | Smooth scrolling. | Scrolling on my pages. | npm audit: 0 |
| Matter.js | 2D physics engine. | Playful footer letters. | npm audit: 0 |
| Lucide | Icon set. | Site icons. | npm audit: 0 |
| react-markdown + remark-gfm | Renders Markdown in React. | Text-heavy pages. | npm audit: 0 |
| oxlint | Fast code checker. | Catching mistakes before release. | npm audit: 0 |
Automation and work tools
Services the agents reach through official connectors or APIs, never by clicking around in a browser.
| Tool | What it does | What I use it for | Check |
|---|---|---|---|
| n8n | Workflow automation. | Forms, emails, reminders and webhooks between my tools. | Service |
| Google WorkspaceGmail, Drive, Docs, Sheets, Calendar | Email, files and spreadsheets. | Inbox triage, drafts, trackers and SOPs, through official connectors. | Service |
| Trello | Boards and cards. | Client project tracking. | Service |
| Discord | Team chat. | Team updates and a read-only daily digest. | Service |
Watching
Worth a look, but not installed. Each one gets scanned before it's installed.
| Tool | What it does | Why I'm watching it | Scan |
|---|---|---|---|
| Context7by Upstash | Gives Claude the latest docs for any code library. | Fewer outdated code fixes on my sites and tools. | Not yet |
| unslop | Finds "AI-looking" design and copy. | Design QA for agency work. | Not yet |
| visant-skills | Audits screens for AI-looking design; cuts a site walkthrough into a rough edit. | Design QA. | Not yet |
| carrossel-skill | Brand carousels that learn from what you approve. | Social carousels. | Not yet |
| nomore | CLAUDE.md rules plus a checker for repeated instructions. | Leaner agent briefs. | Not yet |
| video-director | An AI director and QA pass for videos. | Video QA. | Not yet |
| paper-reel | Faceless explainer reels. | Content ideas. | Not yet |
Didn't pass (yet)
Scanned and not installed, with the reason.
| Tool | What it does | What the scan found | Score · hand check |
|---|---|---|---|
| claude-memv15.9.0 | Records what Claude does each session and brings it back next time. | One real issue: it pins shell-quote 1.9.0, which has a known command-injection advisory. I read the other critical flags by hand; they were false alarms or opt-in features (like a Telegram feed). It also sends usage analytics unless DO_NOT_TRACK=1 is set. I'll scan it again when the dependency is fixed. | 100 Hand check: wait |
Cross-audit me
If you run your own scan and get a different result, or I missed something, tell me: elron.naranja@gmail.com. Please include the repo, the version or commit, and what you found. I'll update this page.