aiwg
Reusable project context and specialist workflows for the AI tools you already use. Agents, skills, rules and MCP tools for Claude Code, Codex, Copilot, Cursor and more, plus SDLC workflows, session memory, and Jev decision support that offloads bounded LLM decisions to save tokens.
No outside reports on file
aiwg gives AI agents more autonomy and access to project context, so misconfigured workflows or compromised credentials could lead to unintended code changes or data exposure.
Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourcenpm (aiwg)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y aiwgEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-23.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Aiwg
aiwg provides reusable templates, workflows, and tools designed to help AI agents (like Claude, Copilot, and Cursor) work together more efficiently. It includes pre-built rules, memory management, and decision-support features that aim to reduce how many tokens (billable units of text) AI models need to process.
Who it’s for
Developers and teams using multiple AI coding assistants who want to standardize workflows and share context across different tools. It's designed for people building software who want their AI agents to work more consistently and cost-effectively.
Alternatives
- Anthropic MCP (Model Context Protocol): Official tool integration framework by Anthropic for Claude.
- GitHub Copilot Extensions: Native workflow customization within GitHub's ecosystem.
- Cursor Rules: Built-in customization and memory features in the Cursor editor.
- LangChain / LlamaIndex: General-purpose frameworks for building custom AI agent workflows.
Setup
Check these steps against the project’s own instructions before running anything.
Install via npm with:
npm install aiwg
For Claude Desktop integration, follow the project's README at https://github.com/jmagly/aiwg (opens external site) for MCP server configuration steps.
Why this grade
Signal-based grade (4/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 226
- Weekly npm downloads
- 14.3k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Workflow execution: The tool runs templated workflows that could include unintended operations if custom rules are misconfigured or tampered with.
- Token leakage: Session memory and project context features store conversation history that may accidentally include API keys, credentials, or sensitive code snippets.
- LLM decision delegation: Offloading bounded decisions to AI means the system makes autonomous choices—if rules are poorly defined, it might take unsafe actions without human review.
- Multi-tool access: Integrating with Claude, Copilot, Cursor, and custom tools creates more integration points where permissions could be misused or data could cross boundaries unexpectedly.
- Dependency trust: The project depends on other npm packages; vulnerabilities in those dependencies could affect security.
How to lower the risk
Least-privilege permissions
- Grant AI agents only the files and API keys they actually need.
- Review all custom rules and workflows before deploying to production.
Network isolation
- Run aiwg in isolated environments when handling sensitive projects.
- Monitor what external services (APIs, registries) the tool tries to reach.
Monitoring
- Log all AI agent decisions and actions for audit trails.
- Regularly review session memory to spot leaked credentials or unexpected data.
Red flags to watch for
- Agents making code changes without explicit user approval.
- Workflow execution that tries to access files outside the project scope.
- Credentials appearing in logs or shared context.
Questions
How do I install Aiwg?
Install Aiwg with npm install aiwg or run it directly with npx -y aiwg. For agent integration and configuration flags, see the documentation at github.com/jmagly/aiwg. Pin an exact version and pass --ignore-scripts if you want to block post-install hooks.
Are there security reports about Aiwg?
No reports found for this package in our research (last checked 2026-10-30). Aiwg currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include workflow execution, token leakage, llm decision delegation.
Is Aiwg actively maintained?
Aiwg has 226 GitHub stars and 14.3k weekly npm downloads. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/jmagly/aiwg before pinning it in production.
What are alternatives to Aiwg?
Notable alternatives to Aiwg include Anthropic MCP (Model Context Protocol) (Official tool integration framework by Anthropic for Claude), GitHub Copilot Extensions (Native workflow customization within GitHub's ecosystem), Cursor Rules (Built-in customization and memory features in the Cursor editor), LangChain / LlamaIndex (General-purpose frameworks for building custom AI agent workflows). You can also compare Aiwg side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use Aiwg? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/jmagly-aiwg)HTML embed:
<a href="https://agentarmorhq.com/skills/jmagly-aiwg"><img src="https://agentarmorhq.com/api/badge/jmagly-aiwg" alt="AgentArmorHQ Risk Grade for Aiwg" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "jmagly-aiwg"Share with your security lead
Need sign-off to use aiwg? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: aiwg
- **Listing URL:** https://agentarmorhq.com/skills/jmagly-aiwg
- **Type:** AI agent skill
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 226 GitHub stars, 14.3k weekly npm downloads
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (aiwg)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts aiwg`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- jmagly
- Source code
- github.com/jmagly/aiwg
- Install command
- npm install aiwg
- Est. context load
- ~96 tokens idle · ~500 tokens when active (on-demand skill)
- Popularity
- 226 GitHub stars, 14.3k weekly npm downloads
- Last updated
- 2026-10-30
- Last graded
- 2026-10-23
Community
Discussions for Aiwg
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude