Skip to content
oss-kit
Install
Menu

Nine current skills. One curated kit.

Curated agent skills for open source maintainers.

A deliberately small collection for the recurring work behind healthy repositories. Every opinion is explicit. Every skill earns its place.

npx skills add svyatov/oss-kit
Install the kitBrowse skills
oss-auditEvidence and gaps across every standard domain
Repository Input
Source
Your repository
Scope
Applicable rules
Output
Evidence and routes
  1. 01Documentation10 rules
  2. 02Community9 rules
  3. 03Continuous integration6 rules
  4. 04Security postureExample domain. 15 rules
  5. 05Release and publishing7 rules
  6. 06Changelog and versioning7 rules
  7. 07Agent skills7 rules
Example routeR-SEC-01

Pin every external action and reusable workflow to a full commit SHA

Check
every external uses: line in .github/workflows/, and in every action.yml or action.yaml the repository ships, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA.Read the full check
Fixed by
oss-harden
Finish
Verify on rerun

The current kit

One responsibility per skill.

The standard supplies the canonical domains. Each fixing skill owns one responsibility, while oss-audit reads across all 61 rules.

Cross-domain instrumentoss-auditObservable evidence, prioritized gaps, and one fixing skill per rule
  1. 01Documentationoss-readme + oss-writing10 rules
  2. 02Communityoss-community9 rules
  3. 03Continuous integrationoss-ci6 rules
  4. 04Security postureoss-harden15 rules
  5. 05Release and publishingoss-publish7 rules
  6. 06Changelog and versioningoss-changelog7 rules
  7. 07Agent skillsoss-skill7 rules

Why curated

The collection grows when a maintainer job is missing.

Each skill owns one recurring responsibility, encodes a clear workflow, and ends on evidence a maintainer can inspect.

A new skill joins only when the existing kit leaves a real job uncovered. Skill count is not a goal.

Inspect the current skills

One workflow, end to end

A recommendation stays traceable.

oss-audit connects a concrete check to the skill that owns the fix. The next run checks the same evidence again.

  1. 01 · RuleR-SEC-01

    Pin every external action and reusable workflow to a full commit SHA

    Read the rule
  2. 02 · CheckObservable evidence

    every external `uses:` line in `.github/workflows/`, and in every `action.yml` or `action.yaml` the repository ships, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA.

    Read the full check
  3. 03 · Fixoss-harden

    The rule names one skill that owns the change.

    Open the skill
  4. 04 · VerifyRun the same check

    The rerun closes the gap only when the repository contains the required evidence.

    Open the audit

Opinions in the open

Read the bar before you adopt it.

The standard states every current opinion as a numbered rule with a reason, a check, one fixing skill, and forge scope.

Read all 61 rules
Rule contractR-CI-01
Statement

CI runs on every push to the default branch and on every change request.

Check

the CI configuration triggers on `push` to the default branch and on `pull_request` carrying no `branches:` filter (GitHub), or defines rules for `$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH` and `merge_request_event` (GitLab).

Read the full check
Fixed by oss-ciGitHub and GitLab

Portable by design

One canonical skill source.

The same skills/ directory reaches supported agents through the skills CLI, plugin manifests, or the directory a host already scans.

ForgesGitHub · GitLab
InstallFull kit · One skill
SourceOpen repository · MIT