OSS Audit skill
Skill that judges a GitHub project like an outside contributor: how outside PRs get merged, how fast maintainers reply.
- 93 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The skill reads data through `gh` with your account permissions, including private repository metadata, and saves it into a report.
- Discussion text from third-party repositories enters the agent context, and protection from prompt injection relies on the agent itself.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/oss-auditDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skill reads data through `gh` with your account permissions, including private repository metadata, and saves it into a report.
- Discussion text from third-party repositories enters the agent context, and protection from prompt injection relies on the agent itself.
This is third-party code. Review the repository files before installing.
What it does
OSS Audit runs a read-only Python collector that reads a repository's pull requests through `gh` over a chosen window (90 days by default). It counts merged outside PRs, time to merge or close, a sample of maintainer replies and PRs sitting without movement. The agent then follows `SKILL.md`, reads real discussions and governance files, and writes a report that keeps facts, inference and unknowns apart. Output is three files: `raw.json`, `report.json` and `report.md`. The 0–100 score is optional: with a small sample or incomplete data no score is given.
Who it is for. A developer choosing an open source project for a first pull request who does not want to spend weeks on a repository where outside changes sit for months.
Good fit when
- Before a first PR to an unfamiliar repository, you want to know whether outside changes are accepted.
- Two projects are on the table and are compared over the same 90-day window.
- You want to see how maintainers answer issues and close PRs rather than just the star count.
- A team decides which dependency to invest effort in.
Not a fit when
- You need a ready ranking of projects: scores here are heuristic and withheld for small samples.
- The repository has almost no PRs in the window, so the statistics come out empty.
- The repository is private and a report with its metadata cannot be kept on disk.
Example request
Assess owner/repo for an outside contributor: show the merged share of outside PRs, response time and one minimal first step.Limitations
The collector needs Python 3.10 or newer, GitHub CLI and a login through `gh auth login`. The outside-author flag comes from `authorAssociation` and does not prove the person is not an employee. The merge share is counted over processed PRs only, pending ones stay out of the denominator. When the page limit is hit (10 pages of 100 PRs by default) the export is marked partial and rate and scores are not computed; add `--max-pages 50` for large repositories. The skill reads third-party discussion text: the ban on running commands from it relies on the host agent and does not guarantee protection from prompt injection, as the README states.
How to disable. Delete the `oss-audit` skill folder from the agent skills directory, for example `.claude/skills/oss-audit` in a project or `~/.claude/skills/oss-audit`. Remove report directories separately.
FAQ
How do I run the collector without an agent?
Run `python3 scripts/collect.py owner/repo --days 90 --output /tmp/my-oss-audit`. The output directory must not exist. A wrapper `bash collect.sh owner/repo` is also available.
Does the skill change anything on GitHub?
No. The collector only reads: it posts no comments, creates no issues or forks and uploads no report to third parties.
Why does a report sometimes have no score?
With a small sample or a truncated export no score is given. The script alone yields at most 75 of 100 points, the rest comes from manual review of communication and governance.
Can I compare two projects?
Yes. Ask the agent to use the same 90-day window for `owner/repo-a` and `owner/repo-b` and to state sample coverage instead of ranking by score alone.
Do I need admin rights on the repository?
No, ordinary read access through `gh` is enough.
Discussion
No questions or reviews yet.
Related
SkillsA skill with four gh scripts that gives an agent pull request state, review threads and CI failures in one call and short output.
An OpenClaw skill that analyzes a GitHub project across many sources: gist, health, top issues, rivals and community view
kyy-logs code-review-skill
code-review-skill
A code review skill with four independent probes, evidence-backed findings and a merge gate derived from JSON
A skill that dissects an open-source project's architecture and returns one Markdown report with Mermaid diagrams and a comparison with rivals
Twenty skills for reading unfamiliar code, reviewing documents and commits, translating Markdown and OpenSpec-driven development
73 skills for a delivery pipeline: plan, code, review and QA, ending in a ready, labeled PR in your own repository.
README in short
The README describes two modes: a standalone collector and a skill for qualitative review. The main text is in Chinese with an English section. Method limits and measures against injection from third-party text are listed separately.