Skip to content
oss-kit
Skills
Standard
Guides
Changelog
Search
Ctrl
K
Cancel
GitHub
Select theme
Dark
Light
Auto
Install
Start here
Getting started
Install
Adoption guide
Standard
Skills
All skills
oss-audit
Skill
oss-changelog
Skill
oss-ci
oss-ci
Skill
GitHub Actions reference
GitLab CI/CD reference
oss-community
oss-community
Skill
GitHub reference
GitLab reference
oss-harden
oss-harden
Skill
GitHub reference
GitLab reference
oss-publish
oss-publish
Skill
crates.io
npm
PyPI
RubyGems
oss-readme
oss-readme
Skill
Badge policy
oss-skill
oss-skill
Skill
Where each host looks for skills
oss-writing
oss-writing
Skill
Tell catalog
Rules
All rules
Documentation
Overview
The README opens with one sentence saying what the project does
R-DOC-01
The README shows how to install the project and one runnable example, in that order, near the top
R-DOC-02
The README links to the license, the changelog, and the contributing guide
R-DOC-03
Every version, command, and support claim in the README matches the repository
R-DOC-04
Documentation prose is plain, active, and free of marketing language
R-DOC-05
Community
Overview
The repository ships a license file whose license matches the package manifest
R-COM-01
CONTRIBUTING.md tells a newcomer how to set up, test, and submit a change
R-COM-02
CODE_OF_CONDUCT.md exists and names a working reporting contact
R-COM-03
SECURITY.md states a private reporting channel and a response window
R-COM-04
Issue and change-request templates exist so reports arrive with the facts you need
R-COM-05
A CODEOWNERS file assigns a reviewer to every path
R-COM-06
Continuous integration
Overview
CI runs on every push to the default branch and on every change request
R-CI-01
CI runs the same lint, test, and build commands the contributing guide gives to humans
R-CI-02
The test matrix covers every runtime version the project claims to support
R-CI-03
Dependency caches are keyed on the lockfile
R-CI-04
Every job has a timeout, and superseded runs for the same branch are cancelled
R-CI-05
Security posture
Overview
Pin every external action and reusable workflow to a full commit SHA
R-SEC-01
Workflows declare least-privilege permissions
R-SEC-02
Automated dependency updates cover both application dependencies and CI dependencies
R-SEC-03
The default branch requires review and passing checks before merge, and rejects force pushes
R-SEC-04
Release tags are signed and verifiable
R-SEC-05
A GitLab pipeline pins external execution inputs and restricts inbound job-token access
R-SEC-06
Untrusted input never reaches a privileged context
R-SEC-07
Registry dependencies resolve through a committed lockfile
R-SEC-08
Static analysis runs on pull requests where the language supports it
R-SEC-09
Release and publishing
Overview
Publishing happens in CI, triggered by a tag, never from a developer machine
R-PUB-01
The publish job authenticates to the registry with trusted publishing, not a stored token
R-PUB-02
Published artifacts carry build provenance
R-PUB-03
A human approves the run before anything reaches a public registry
R-PUB-04
Changelog and versioning
Overview
Each release unit keeps a discoverable changelog in its declared format
R-CHG-01
Semantic versions reflect changes to the declared public API
R-CHG-02
Every release unit uses one version across its tag, manifests, and changelog
R-CHG-03
Forge release notes derive from the changelog without contradicting it
R-CHG-04
A public API is deprecated in a release before it is removed
R-CHG-05
Agent skills
Overview
Skills live in a top-level `skills/` directory, one directory per skill
R-SKL-01
Every skill conforms to the Agent Skills specification
R-SKL-02
A `SKILL.md` body stays under 500 lines, with depth in `references/`
R-SKL-03
Every `SKILL.md` declares a license
R-SKL-04
A skill that ships a script uses portable sh or JavaScript with no dependencies
R-SKL-05
Every host the repository claims support for has a working install path
R-SKL-06
Each skill is a focused, progressively disclosed procedure
R-SKL-07
Changelog
GitHub
Select theme
Dark
Light
Auto
Rules
Documentation
(5 rules)
Community
(6 rules)
Continuous integration
(5 rules)
Security posture
(9 rules)
Release and publishing
(4 rules)
Changelog and versioning
(5 rules)
Agent skills
(7 rules)