open-sourcing — Claude Code skill: get a repo ready for release
Walks a repository through the pre-release checklist: secret audit, license, docs, CI and packaging.
npx skills add trailofbits/skills --skill open-sourcing -a claude-codeWhat open-sourcing does
The skill fires when you ask to open source a project, flip a repo to public, or check whether it is release-ready. Steps run in order, and the secret audit comes first because its outcome shapes everything after it. If credentials or client data ever touched the history, the advice is to leave visibility alone and build a fresh repository from the current tree, archiving the old one.
After that come the readiness check, documentation, licensing, tests and CI, then repository settings. Two scripts do the mechanical work: detect_org.sh reads git remotes and recent committer emails to name an organization profile, and check_readiness.sh prints which of README, LICENSE, CONTRIBUTING, SECURITY.md, CI, tests and semver tags are present. For history scanning it points at gitleaks git . or trufflehog git file://..
License choice follows the organization policy when a profile is detected. Otherwise Apache 2.0 is the permissive default, AGPLv3 covers the case where competitors must not close a fork, and Creative Commons fits non-code artifacts. A formatter or linter that already works stays in place — the skill flags an outdated one and leaves the call to the maintainer. You need a git repository with history, since the commit audit has nothing to run against otherwise.
What it helps with
- check whether API keys leaked into commit history
- pick a license and keep LICENSE, package metadata and README in agreement
- rewrite the README so a stranger can build the project
- set up CI with tests, linting and a coverage gate
- protect the default branch and keep dependencies updated
Example prompts for the agent
- Check this repo for open-source readiness and list what is missing
- We want to make this project public — run a secrets audit over the full history
- Pick a license for this project and apply it across the files
How to install open-sourcing
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill open-sourcing -a claude-code2Manually: put the files in place
~/.claude/skills/open-sourcing/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/open-sourcing/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill open-sourcing -a codex2Manually: put the files in place
.agents/skills/open-sourcing/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill open-sourcing -a cursor2Manually: put the files in place
.cursor/skills/open-sourcing/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills open-sourcing2Manually: put the files in place
.github/skills/open-sourcing/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill open-sourcing -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/open-sourcing/skills/open-sourcingManually: put the files in place
.devin/skills/open-sourcing/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill open-sourcing -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about open-sourcing
How do I install open-sourcing in Claude Code?
Run npx skills add trailofbits/skills --skill open-sourcing -a claude-code. The skill lands at ~/.claude/skills/open-sourcing/SKILL.md.
What does open-sourcing do?
It takes a repository through the release steps: secret audit, readiness check, documentation, licensing, tests and CI, repository settings.
What if the repository history already contains secrets?
The skill advises against publishing it as is. Copy the current tree into a new repository and archive the old one — rewriting history does not reach forks, caches or CI artifacts.
