oss-tool-trust-audit
From the author
Use when an open-source developer tool, package, CLI, agent, or MCP server must be evaluated for legitimacy, supply-chain risk, telemetry, dangerous capabilities, claim accuracy, and adoption fit.
Install
npx skills add asimons81/hermes-field-kit --skill oss-tool-trust-audit -a claude-code
Installs to .claude/skills/oss-tool-trust-audit/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 75
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- skill-supply-chain-auditseb1n/awesome-ai-agent-skillsAudit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.Finance★ 229
- oma-securityfirst-fluke/oh-my-agentScan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.Security★ 1.4K
- capability-auditRtur2003/Claude-Code-Promts-SkillsUse when evaluating, comparing, installing, or recommending a Claude Code plugin, Agent Skill, MCP server, agent toolkit, or GitHub-hosted AI extension, especially when popularity is weak evidence or the candidate requests shell, network, filesystem, or credential access.Engineering★ 54
- dx-auditOutlineDriven/outline-driven-developmentUse when auditing the developer-facing surface of a CLI, SDK, library, or package: API contracts, errors, public types, onboarding, and config.Engineering★ 54
- scope-osstonone-ai/tononeOpen source license compliance audit — flag GPL, LGPL, AGPL, copyleft risks. Use when asked to "check our open source licenses", "do we have GPL risk", or "run an OSS license audit".Legal★ 76
- code-auditcoco-research/cocoUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Engineering★ 787
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in