Skip to content
oss-kit
GitHubInstall
Menu

Nine current skills. One curated kit.

Curated agent skills for open source maintainers.

A deliberately small collection for the recurring work behind healthy repositories. Every opinion is explicit. Every skill earns its place.

npx skills add svyatov/oss-kit
Install the kitBrowse skills
Cross-domain scanoss-auditEvery standard domain
Repository Input
Source
Your repository
Scope
Applicable rules
Output
Evidence and routes
  1. 01Documentationoss-readme + oss-writing5 rules
  2. 02Communityoss-community6 rules
  3. 03Continuous integrationoss-ci5 rules
  4. 04Security postureoss-harden9 rules
  5. 05Release and publishingoss-publish4 rules
  6. 06Changelog and versioningoss-changelog5 rules
  7. 07Agent skillsoss-skill7 rules
Example routeR-SEC-01

Pin every external action and reusable workflow to a full commit SHA

Check
every external uses: line in .github/workflows/, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA.
Fixed by
oss-harden
Finish
Verify on rerun

The current kit

One responsibility per skill.

The standard supplies the canonical domains. Each fixing skill owns one responsibility, while oss-audit reads across all 41 rules.

Cross-domain instrumentoss-auditObservable evidence, prioritized gaps, and one fixing skill per rule
  1. 01Documentationoss-readme + oss-writing5 rules
  2. 02Communityoss-community6 rules
  3. 03Continuous integrationoss-ci5 rules
  4. 04Security postureoss-harden9 rules
  5. 05Release and publishingoss-publish4 rules
  6. 06Changelog and versioningoss-changelog5 rules
  7. 07Agent skillsoss-skill7 rules

Why curated

The collection grows when a maintainer job is missing.

Each skill owns one recurring responsibility, encodes a clear workflow, and ends on evidence a maintainer can inspect.

A new skill joins only when the existing kit leaves a real job uncovered. Skill count is not a goal.

Inspect the current skills

One workflow, end to end

A recommendation stays traceable.

oss-audit connects a concrete check to the skill that owns the fix. The next run checks the same evidence again.

  1. 01 · RuleR-SEC-01

    Pin every external action and reusable workflow to a full commit SHA

    Read the rule
  2. 02 · CheckObservable evidence

    every external uses: line in .github/workflows/, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA.

  3. 03 · Fixoss-harden

    The rule names one skill that owns the change.

    Open the skill
  4. 04 · VerifyRun the same check

    The rerun closes the gap only when the repository contains the required evidence.

Opinions in the open

Read the bar before you adopt it.

The standard states every current opinion as a numbered rule with a reason, a check, one fixing skill, and forge scope.

Read all 41 rules
Rule contractR-CI-01
Statement

CI runs on every push to the default branch and on every change request.

Check

The workflow declares both trigger paths.

Fixed by oss-ciGitHub and GitLab

Portable by design

One canonical skill source.

The same skills/ directory reaches supported agents through the skills CLI, plugin manifests, or the directory a host already scans.

ForgesGitHub · GitLab
InstallFull kit · One skill
SourceOpen repository · MIT