# open-sourcing

Walks a repository through the pre-release checklist: secret audit, license, docs, CI and packaging.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1300 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/open-sourcing/skills/open-sourcing/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/open-sourcing

## What it does

The skill fires when you ask to open source a project, flip a repo to public, or check whether it is release-ready. Steps run in order, and the secret audit comes first because its outcome shapes everything after it. If credentials or client data ever touched the history, the advice is to leave visibility alone and build a fresh repository from the current tree, archiving the old one.

After that come the readiness check, documentation, licensing, tests and CI, then repository settings. Two scripts do the mechanical work: `detect_org.sh` reads git remotes and recent committer emails to name an organization profile, and `check_readiness.sh` prints which of README, LICENSE, CONTRIBUTING, SECURITY.md, CI, tests and semver tags are present. For history scanning it points at `gitleaks git .` or `trufflehog git file://.`.

License choice follows the organization policy when a profile is detected. Otherwise Apache 2.0 is the permissive default, AGPLv3 covers the case where competitors must not close a fork, and Creative Commons fits non-code artifacts. A formatter or linter that already works stays in place — the skill flags an outdated one and leaves the call to the maintainer. You need a git repository with history, since the commit audit has nothing to run against otherwise.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill open-sourcing -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/open-sourcing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/open-sourcing/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill open-sourcing -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/open-sourcing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill open-sourcing -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/open-sourcing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills open-sourcing
```

2. **Manually: put the files in place**
- File: `.github/skills/open-sourcing/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill open-sourcing -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/open-sourcing/skills/open-sourcing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/open-sourcing/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill open-sourcing -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/open-sourcing/skills/open-sourcing/SKILL.md

## When to use it
- check whether API keys leaked into commit history
- pick a license and keep LICENSE, package metadata and README in agreement
- rewrite the README so a stranger can build the project
- set up CI with tests, linting and a coverage gate
- protect the default branch and keep dependencies updated

## Example prompts
- Check this repo for open-source readiness and list what is missing
- We want to make this project public — run a secrets audit over the full history
- Pick a license for this project and apply it across the files

## Similar
- [triage](https://affpapa.org/en/nevibecode/skills/triage.md) — skill · 990453 installs
- [code-review](https://affpapa.org/en/nevibecode/skills/code-review.md) — skill · 789521 installs
- [implement](https://affpapa.org/en/nevibecode/skills/implement.md) — skill · 774700 installs
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [setup-pre-commit](https://affpapa.org/en/nevibecode/skills/setup-pre-commit.md) — skill · 489289 installs
- [scaffold-exercises](https://affpapa.org/en/nevibecode/skills/scaffold-exercises.md) — skill · 480196 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md