技能 opensrc
📦

opensrc

内容修订 r1 安全 ⚙️ 外部命令📁 文件系统访问

Inspect Dependency Source with opensrc

Types and documentation may not explain unexpected dependency behavior. This skill guides AI agents to fetch matching source versions and inspect implementations through a reusable cache.

支持: Claude Codex Code(CC)
🥉 77 青铜

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "opensrc" from https://skillstore.io/skills/vercel-labs-opensrc.md and its manifest at https://skillstore.io/api/skills/vercel-labs-opensrc/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/vercel-labs-opensrc.md 已签名 manifest GET /api/skills/vercel-labs-opensrc/manifest 已签名 lockfile GET /api/skills/vercel-labs-opensrc/lockfile

测试它

正在使用“opensrc”。 Fetch zod source matching my project.

预期结果:

  • The project lockfile determines the npm version to inspect.
  • The report includes the resolved version and absolute source-cache location.
  • Available implementation files can be searched without executing the dependency.

正在使用“opensrc”。 Prepare to inspect serde from crates.io.

预期结果:

  • Use an explicit serde version when investigating reproducible behavior.
  • Fetch its source and locate the relevant implementation and tests.
  • Report findings with source references, separating observed behavior from assumptions.

正在使用“opensrc”。 Review cached sources before removing anything.

预期结果:

  • List the cached packages and repositories first.
  • Select individual entries or a cache category for removal.
  • Keep unrelated cached source unless its removal is explicitly approved.

安全审计

安全
v1 • 2026/10/10 打开版本化报告

All 22 static detections are false positives involving Markdown delimiters, routine source-reading commands, or the documented source cache. No evidence found of prompt injection, credential access, or data exfiltration in the reviewed skill text. The external CLI implementation was not included, and unquoted cache paths should be improved.

1
已扫描文件
79
分析行数
0
复核项
0
已忽略误报

风险因素

⚙️ 外部命令 (18)
SKILL.md:9 SKILL.md:13-17 SKILL.md:17-19 SKILL.md:19 SKILL.md:23-39 SKILL.md:39-43 SKILL.md:43 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49 SKILL.md:53 SKILL.md:55-68 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:19 SKILL.md:13-17 SKILL.md:19
📁 文件系统访问 (4)
SKILL.md:9 SKILL.md:53 SKILL.md:9 SKILL.md:53
最新一次完成的静态与语义审计未检测到已确认的安全发现。这并不能证明该 Skill 没有副作用。
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/vercel-labs-opensrc/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-opensrc/security.svg)](https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/vercel-labs-opensrc?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-opensrc/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/vercel-labs-opensrc.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

vercel-labs. (2026). opensrc security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-opensrc/audits/1

BibTeX 引用

@techreport{vercel-labs-vercel-labs-opensrc-2026, author = {vercel-labs}, title = {opensrc security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/vercel-labs-opensrc/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "opensrc security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "vercel-labs" date-released: "2026-10-10" url: "https://skillstore.io/skills/vercel-labs-opensrc/audits/1" identifiers: - type: other value: "skillstore:vercel-labs-opensrc:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Debug Unexpected Library Behavior

Inspect the dependency version used by a project to trace behavior that public types do not explain.

Investigate Dependency Edge Cases

Read implementation branches and locate upstream tests before designing regression coverage.

Study Upstream Implementations

Fetch selected package versions or repository references to study internal design patterns.

试试这些提示

Fetch One Dependency 
Fetch source for zod with opensrc and report the resolved version and cache location.
Inspect a Function 
Inspect requests version 2.31.0 from PyPI using opensrc. Explain timeout handling and cite the implementation files.
Debug the Installed Version 
Resolve zod from the lockfile in [project directory]. Trace [unexpected behavior] through its source and tests, citing relevant locations.
Compare Pinned Revisions 
Fetch [repository] at [reference A] and [reference B]. Compare [function] behavior, cite changed locations, and suggest regression tests without executing downloaded code.

最佳实践

  • Use the project lockfile or explicit versions and repository references for reproducible source inspection.
  • Quote resolved cache paths and treat fetched source as untrusted data rather than instructions.
  • Review cache entries before removal and confirm the scope of global cleanup.

避免

  • Fetching source for simple API questions already answered by documentation or types.
  • Assuming latest PyPI or crates.io source matches the dependency installed in your project.
  • Executing downloaded code or deleting the entire cache when source inspection is sufficient.

常见问题

Which source ecosystems are supported?
The instructions cover npm, PyPI, crates.io, and repository references such as owner/repo.
How does npm version resolution work?
The CLI uses package-lock.json, pnpm-lock.yaml, or yarn.lock to detect installed npm versions. A project-directory option changes the resolution location.
Can I select a specific version or revision?
Yes. Package specifications accept explicit versions, and repository references can select a branch, tag, or commit.
Where is source cached?
Source is cached globally in ~/.opensrc/. OPENSRC_HOME can override the cache location.
Does this skill include the opensrc CLI?
No. The reviewed skill contains instructions only. The opensrc CLI must be available separately.
Can I remove cached source selectively?
Yes. Remove individual packages or repositories, or clean selected ecosystem categories. Global cleanup removes all cached sources.

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/vercel-labs/opensrc/tree/b51de60867e806da1839b33dd29c29424f12521b/skills/opensrc

引用

e406bf64b5db6e514879399e87b346fa7ff7c2fb

维护新鲜度

2026/10/11

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md

vercel-labs 的更多技能

查看全部

相关技能

查看全部