← Browse

@mrwangjusttodo/open-source-repo-analysis

A

Analyze referenced open-source repositories by reusing or cloning them into the project's git-ignored tmp directory. Use when the user references GitHub links, open-source repositories, external codebases, or asks to compare, inspect, understand, or learn from another repository.

skillclaude

Install

agr install @mrwangjusttodo/open-source-repo-analysis --target claude

Writes 20 files into .claude/skills/, pinned to git-3c5c99e9.

  • .claude/skills/open-source-repo-analysis/.cursorignore
  • .claude/skills/open-source-repo-analysis/.gitignore
  • .claude/skills/open-source-repo-analysis/.graphqlrc.yml
  • .claude/skills/open-source-repo-analysis/.npmrc
  • .claude/skills/open-source-repo-analysis/.prettierignore
  • .claude/skills/open-source-repo-analysis/.prettierrc
  • .claude/skills/open-source-repo-analysis/AGENTS.md
  • .claude/skills/open-source-repo-analysis/LICENSE
  • .claude/skills/open-source-repo-analysis/Lynx.png
  • .claude/skills/open-source-repo-analysis/README.md
  • .claude/skills/open-source-repo-analysis/SKILL.md
  • .claude/skills/open-source-repo-analysis/commit.mjs
  • .claude/skills/open-source-repo-analysis/eslint.config.js
  • .claude/skills/open-source-repo-analysis/global.d.ts
  • .claude/skills/open-source-repo-analysis/opentui.mjs
  • .claude/skills/open-source-repo-analysis/package.json
  • .claude/skills/open-source-repo-analysis/pnpm-lock.yaml
  • .claude/skills/open-source-repo-analysis/pnpm-workspace.yaml
  • .claude/skills/open-source-repo-analysis/test.mjs
  • .claude/skills/open-source-repo-analysis/tsconfig.json

Document


name: open-source-repo-analysis description: Analyze referenced open-source repositories by reusing or cloning them into the project's git-ignored tmp directory. Use when the user references GitHub links, open-source repositories, external codebases, or asks to compare, inspect, understand, or learn from another repository.

Open Source Repo Analysis

Workflow

When the user references an open-source project, such as a GitHub link, first decide whether the user's purpose requires code analysis.

Use code analysis when the user asks to:

  • Understand architecture, implementation, APIs, or patterns.
  • Compare this project with another repository.
  • Reuse, port, or adapt logic from an open-source project.
  • Investigate how a feature, bug fix, or tool works in another codebase.

Do not clone when a general explanation, package metadata, release note, or documentation lookup is enough.

Repository Cache

Use the project-local tmp/ directory as the cache for cloned repositories. This directory is git ignored and should hold temporary external code only.

  1. Normalize the repository name from the URL, for example https://github.com/org/repo becomes tmp/org-repo.
  2. Check whether the target directory already exists in tmp/.
  3. If it exists, analyze the existing local copy directly.
  4. If it does not exist, clone the repository into that target directory.
  5. Read and analyze files from the cloned repository as needed for the user's question.
  6. After completing the analysis, ask the user whether they want to delete the cloned temporary repository.

Guardrails

  • Do not copy code from the external repository into this project unless the user explicitly asks.
  • Prefer shallow clones when full history is not needed.
  • Avoid running install, build, or test commands inside the cloned repository unless the user asks or runtime evidence is necessary.
  • Clearly distinguish findings from the external repository from findings about the current project.

Trustgrade A

  • passBody integrity

    Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.

  • passType matchnot applicable to this artifact type

    Whether the artifact is really the kind of thing its metadata claims it is.

  • passFreshness

    How long since the source repository was last pushed to.

  • passPrompt injection

    Scans the artifact's own text for instructions aimed at your agent rather than at you.

  • passLicense

    Whether the source repository declares an SPDX license permissive enough to redistribute.

How the grade is calculated

Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:

  • Aevery check passed
  • Bone warning
  • Ctwo warnings
  • Dprompt injection or body integrity failed, or three warnings
  • Fone of those failed, and something else is wrong

These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.

Versions

  • git-3c5c99e9d4f52026-07-31