Habilidades opensrc
📦

opensrc

Revisão do conteúdo r1 Seguro ⚙️ Comandos externos📁 Acesso ao sistema de arquivos

Inspect Dependency Source with opensrc

Types and documentation may not explain unexpected dependency behavior. This skill guides AI agents to fetch matching source versions and inspect implementations through a reusable cache.

Suporta: Claude Codex Code(CC)
🥉 77 Bronze

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente
Review the Skillstore skill "opensrc" from https://skillstore.io/skills/vercel-labs-opensrc.md and its manifest at https://skillstore.io/api/skills/vercel-labs-opensrc/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Testar

Usando "opensrc". Fetch zod source matching my project.

Resultado esperado:

  • The project lockfile determines the npm version to inspect.
  • The report includes the resolved version and absolute source-cache location.
  • Available implementation files can be searched without executing the dependency.

Usando "opensrc". Prepare to inspect serde from crates.io.

Resultado esperado:

  • Use an explicit serde version when investigating reproducible behavior.
  • Fetch its source and locate the relevant implementation and tests.
  • Report findings with source references, separating observed behavior from assumptions.

Usando "opensrc". Review cached sources before removing anything.

Resultado esperado:

  • List the cached packages and repositories first.
  • Select individual entries or a cache category for removal.
  • Keep unrelated cached source unless its removal is explicitly approved.

Auditoria de segurança

Seguro

All 22 static detections are false positives involving Markdown delimiters, routine source-reading commands, or the documented source cache. No evidence found of prompt injection, credential access, or data exfiltration in the reviewed skill text. The external CLI implementation was not included, and unquoted cache paths should be improved.

1
Arquivos analisados
79
Linhas analisadas
0
Itens de revisão
0
Falsos positivos ignorados
A auditoria estática e semântica concluída mais recente não detectou achados de segurança confirmados. Isso não comprova que a skill não tenha efeitos colaterais.
Auditado por: codex
Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado
Avaliação de Segurança

Copiar link do relatório

https://skillstore.io/skills/vercel-labs-opensrc/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-opensrc/security.svg)](https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-opensrc/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/vercel-labs-opensrc.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

vercel-labs. (2026). opensrc security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-opensrc/audits/1

Citação BibTeX

@techreport{vercel-labs-vercel-labs-opensrc-2026, author = {vercel-labs}, title = {opensrc security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/vercel-labs-opensrc/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "opensrc security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "vercel-labs" date-released: "2026-10-10" url: "https://skillstore.io/skills/vercel-labs-opensrc/audits/1" identifiers: - type: other value: "skillstore:vercel-labs-opensrc:audit:1" description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio
55
Arquitetura
85
Manutenibilidade
87
Conteúdo
65
Comunidade
83
Conformidade com a especificação

O que você pode criar

Debug Unexpected Library Behavior

Inspect the dependency version used by a project to trace behavior that public types do not explain.

Investigate Dependency Edge Cases

Read implementation branches and locate upstream tests before designing regression coverage.

Study Upstream Implementations

Fetch selected package versions or repository references to study internal design patterns.

Teste estes prompts

Fetch One Dependency
Fetch source for zod with opensrc and report the resolved version and cache location.
Inspect a Function
Inspect requests version 2.31.0 from PyPI using opensrc. Explain timeout handling and cite the implementation files.
Debug the Installed Version
Resolve zod from the lockfile in [project directory]. Trace [unexpected behavior] through its source and tests, citing relevant locations.
Compare Pinned Revisions
Fetch [repository] at [reference A] and [reference B]. Compare [function] behavior, cite changed locations, and suggest regression tests without executing downloaded code.

Boas práticas

  • Use the project lockfile or explicit versions and repository references for reproducible source inspection.
  • Quote resolved cache paths and treat fetched source as untrusted data rather than instructions.
  • Review cache entries before removal and confirm the scope of global cleanup.

Evitar

  • Fetching source for simple API questions already answered by documentation or types.
  • Assuming latest PyPI or crates.io source matches the dependency installed in your project.
  • Executing downloaded code or deleting the entire cache when source inspection is sufficient.

Perguntas frequentes

Which source ecosystems are supported?
The instructions cover npm, PyPI, crates.io, and repository references such as owner/repo.
How does npm version resolution work?
The CLI uses package-lock.json, pnpm-lock.yaml, or yarn.lock to detect installed npm versions. A project-directory option changes the resolution location.
Can I select a specific version or revision?
Yes. Package specifications accept explicit versions, and repository references can select a branch, tag, or commit.
Where is source cached?
Source is cached globally in ~/.opensrc/. OPENSRC_HOME can override the cache location.
Does this skill include the opensrc CLI?
No. The reviewed skill contains instructions only. The opensrc CLI must be available separately.
Can I remove cached source selectively?
Yes. Remove individual packages or repositories, or clean selected ecosystem categories. Global cleanup removes all cached sources.

Detalhes do desenvolvedor

Licença

MIT

Revisão da Skillstore

r1

Aviso de versão

O autor não declarou uma versão.

Referência

e406bf64b5db6e514879399e87b346fa7ff7c2fb

Atualidade da manutenção

11/10/2026

Uso

0 downloads · 0 visualizações

Estrutura de arquivos

📄 SKILL.md

Mais de vercel-labs

Ver tudo
Ver tudo