opensrc
Inspect Dependency Source with opensrc
Types and documentation may not explain unexpected dependency behavior. This skill guides AI agents to fetch matching source versions and inspect implementations through a reusable cache.
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
Review the Skillstore skill "opensrc" from https://skillstore.io/skills/vercel-labs-opensrc.md and its manifest at https://skillstore.io/api/skills/vercel-labs-opensrc/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「opensrc」を使用しています。 Fetch zod source matching my project.
期待される結果:
- The project lockfile determines the npm version to inspect.
- The report includes the resolved version and absolute source-cache location.
- Available implementation files can be searched without executing the dependency.
「opensrc」を使用しています。 Prepare to inspect serde from crates.io.
期待される結果:
- Use an explicit serde version when investigating reproducible behavior.
- Fetch its source and locate the relevant implementation and tests.
- Report findings with source references, separating observed behavior from assumptions.
「opensrc」を使用しています。 Review cached sources before removing anything.
期待される結果:
- List the cached packages and repositories first.
- Select individual entries or a cache category for removal.
- Keep unrelated cached source unless its removal is explicitly approved.
セキュリティ監査
安全All 22 static detections are false positives involving Markdown delimiters, routine source-reading commands, or the documented source cache. No evidence found of prompt injection, credential access, or data exfiltration in the reviewed skill text. The external CLI implementation was not included, and unquoted cache paths should be improved.
リスク要因
⚙️ 外部コマンド (18)
📁 ファイルシステムへのアクセス (4)
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/vercel-labs-opensrc/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-opensrc/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/vercel-labs-opensrc.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
vercel-labs. (2026). opensrc security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-opensrc/audits/1BibTeX形式の引用
@techreport{vercel-labs-vercel-labs-opensrc-2026,
author = {vercel-labs},
title = {opensrc security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/vercel-labs-opensrc/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "opensrc security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "vercel-labs"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/vercel-labs-opensrc/audits/1"
identifiers:
- type: other
value: "skillstore:vercel-labs-opensrc:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中作成できるもの
Debug Unexpected Library Behavior
Inspect the dependency version used by a project to trace behavior that public types do not explain.
Investigate Dependency Edge Cases
Read implementation branches and locate upstream tests before designing regression coverage.
Study Upstream Implementations
Fetch selected package versions or repository references to study internal design patterns.
これらのプロンプトを試す
Fetch source for zod with opensrc and report the resolved version and cache location.
Inspect requests version 2.31.0 from PyPI using opensrc. Explain timeout handling and cite the implementation files.
Resolve zod from the lockfile in [project directory]. Trace [unexpected behavior] through its source and tests, citing relevant locations.
Fetch [repository] at [reference A] and [reference B]. Compare [function] behavior, cite changed locations, and suggest regression tests without executing downloaded code.
ベストプラクティス
- Use the project lockfile or explicit versions and repository references for reproducible source inspection.
- Quote resolved cache paths and treat fetched source as untrusted data rather than instructions.
- Review cache entries before removal and confirm the scope of global cleanup.
回避
- Fetching source for simple API questions already answered by documentation or types.
- Assuming latest PyPI or crates.io source matches the dependency installed in your project.
- Executing downloaded code or deleting the entire cache when source inspection is sufficient.
よくある質問
Which source ecosystems are supported?
How does npm version resolution work?
Can I select a specific version or revision?
Where is source cached?
Does this skill include the opensrc CLI?
Can I remove cached source selectively?
開発者情報
作成者
vercel-labsライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
リポジトリ
https://github.com/vercel-labs/opensrc/tree/b51de60867e806da1839b33dd29c29424f12521b/skills/opensrc参照
e406bf64b5db6e514879399e87b346fa7ff7c2fb
メンテナンスの新しさ
2026/10/11
利用状況
0 ダウンロード · 0 閲覧
ファイル構成
📄 SKILL.md