priyank766/opensource-skill

# GitHub Repository: priyank766/OpenSource-SKILL

**URL:** https://github.com/priyank766/OpenSource-SKILL
**Author:** priyank766
**Description:** a OpenSource Code Review Skill for everyone
**Homepage:** https://priyank766.github.io/OpenSource-SKILL/
**Language:** Python

## Stats
- Stars: 1
- Forks: 0
- Open Issues: 0
- Commits: 2
- Created: 2026-08-03T08:25:51Z
- Updated: 2026-08-06T06:14:21Z
- Pushed: 2026-08-06T06:14:17Z

## README
<div align="center">

<a href="https://priyank766.github.io/OpenSource-SKILL/">
  <img alt="OpenSource Review Suite — review like a maintainer. Eight agent skills for open-source pull requests." src="./image.png" width="100%">
</a>

<br><br>

```bash
npx skills add priyank766/OpenSource-SKILL
```

[**Website**](https://priyank766.github.io/OpenSource-SKILL/) · [**Skills**](#the-skills) · [**Install**](#install) · [**Scoring**](#scoring) · [**Contributing**](./CONTRIBUTING.md)

</div>

---

Eight agent skills that do the slow part of reviewing a pull request — the careful reading
— and hand you the two or three findings that earn a comment.

Reviewing well takes two things that are hard to do quickly: reading the change carefully
enough to find what actually breaks, and then deciding which findings are worth the
author's time. The first is slow. The second is the part that gets skipped when the first
ran long.

- **The reading.** ~80% of every skill is detection procedure — reading order, four passes
  over the diff, blast-radius sweeps across the whole repo, and a reproduction before
  anything is claimed.
- **The filter.** A weighted 10-point score. Anything below the skill's floor never
  reaches you, related findings merge into one comment, and the whole review is capped at
  five.
- **The wording.** Concrete claim, minimal patch, one line of why — so you can approve or
  dismiss each one at a glance.

## The skills

| Skill | Use it when | Floor |
| :--- | :--- | :---: |
| [pr-review](./skills/pr-review) | Any PR. The general procedure the others extend. | 8.0 |
| [security-review](./skills/security-review) | Auth, crypto, input parsing, deserialization, subprocess, paths, secrets, SSRF | 7.5 |
| [dependency-review](./skills/dependency-review) | New or bumped dependencies, lockfile diffs, CI workflow or base-image changes | 7.5 |
| [api-compat-review](./skills/api-compat-review) | Public signatures, exported types, defaults, config keys, CLI flags, wire formats | 7.5 |
| [test-review](./skills/test-review) | The diff is mostly tests, fixtures changed, or CI is flaky | 8.0 |
| [performance-review](./skills/performance-review) | I/O in loops, new queries, caching, allocations, hot paths | 8.0 |
| [docs-review](./skills/docs-review) | README, docstrings, tutorials — or code that silently invalidated them | 8.5 |
| [contributor-experience-review](./skills/contributor-experience-review) | A first-time contributor's PR, or one you have to decline | 8.5 |

**Floor** is the minimum score a finding must reach to be worth posting. It drops to 7.5
where a miss is asymmetric and cannot be un-shipped, and rises to 8.5 where noise is
expensive and the stakes are low — there you cut harder, not softer.

## Install

Every skill is self-contained: `SKILL.md` plus its own `references/`. Installing one copies
nothing it does not need.

```bash
# all eight, to every agent the CLI detects
npx skills add priyank766/OpenSource-SKILL

# just one
npx skills add priyank766/OpenSource-SKILL --skill security-review

# pick the agent
npx skills add priyank766/OpenSource-SKILL -a claude-code -g -y
npx skills add priyank766/OpenSource-SKILL -a codex -g -y
```

Claude Code also takes it as a plugin:

```
/plugin marketplace add priyank766/OpenSource-SKILL
/plugin install opensource-review-suite
```

Codex reads `~/.codex/skills/` globally and `.agents/skills/` per project — `-a codex`
handles both; `-g` picks global.

<details>
<summary><b>Other agents, and installing from a clone</b></summary>

<br>

```bash
git clone https://github.com/priyank766/OpenSource-SKILL
cd OpenSource-SKILL

./scripts/install.sh --list                    # what's available
./scripts/install.sh security-review           # one skill
./scripts/install.sh                           # interactive picker
./scripts/install.sh --all --agent codex       # choose the target
```

Windows: `.\scripts\install.ps1 -All -Agent codex`, same flags.

| `--agent` | Installs to |
| :--- | :--- |
| `claude`, `cowork` *(default)* | `~/.claude/skills/` |
| `codex` | `~/.codex/skills/` |
| `cursor` | `~/.cursor/skills/` |
| `gemini` | `~/.gemini/skills/` |
| `antigravity` | `~/.gemini/antigravity/skills/` |
| `opencode` | `~/.config/opencode/skills/` |
| `copilot` | `~/.copilot/skills/` |
| `generic` | `./.agent/skills/` |

Or skip the script — `cp -r skills/security-review ~/wherever/`. It is Markdown.

</details>

Once installed you do not name the skill; the descriptions carry explicit trigger
conditions.

```
Review PR #482 in this repo.
Security pass on the auth changes in this branch.
This PR bumps 40 packages — anything I should worry about?
```

## Scoring

```
score = 0.30·correctness + 0.30·impact + 0.20·urgency + 0.20·empathy
```

| Score | Band | Action |
| :--- | :--- | :--- |
| 9.0 – 10 | Subtle bug, race, leak, edge-case crash, security flaw | Must post, with a patch |
| 8.0 – 8.9 | Type safety, test isolation, structural polish | Post as a suggestion |
| 6.0 – 7.9 | Cosmetic refactor, micro-optimization, preference | Do not post on the PR |
| below 6.0 | Generic lint, praise, hallucination | Reject silently |

Three separate 7.5 nits about the same pattern do not add up to a 9.0. They add up to
**one** 8.5 about the pattern, posted at the first occurrence.

Full rubric in [`shared/QUALITY-FILTER.md`](./shared/QUALITY-FILTER.md); a walkthrough of
what a review looks like end to end in [`examples/how-it-works.md`](./examples/how-it-works.md).

## Layout

```
skills/<name>/SKILL.md        the skill: frontmatter + procedure
skills/<name>/references/     vendored shared docs, so each skill stands alone
shared/DETECTION-PLAYBOOK.md  how to find the defect — the main phase
shared/QUALITY-FILTER.md      the 10-point rubric
shared/REVIEW-VOICE.md        the tone contract
scripts/                      installers, sync-shared.py, validate.py
```

`shared/` is the single source of truth; `sync-shared.py` copies it into each skill and CI
fails if a copy drifts. Skills must be self-contained because installers copy only the
contents of `skills/<name>/`.

## Contributing

New skills, sharper detection technique, and corrections to any command that does not run
are all welcome — see [CONTRIBUTING.md](./CONTRIBUTING.md). The bar for a new skill: it
must name a defect class the existing eight would miss, and be mostly detection procedure
rather than advice.

---

<div align="center">

If it saved you a review, **[a star](https://github.com/priyank766/OpenSource-SKILL/stargazers)**
is the only signal this project runs on.

<sub>[Apache-2.0](./LICENSE) · © Priyank Patel · [Report a wrong command](https://github.com/priyank766/OpenSource-SKILL/issues/new?template=wrong-command.yml) · [Propose a skill](https://github.com/priyank766/OpenSource-SKILL/issues/new?template=new-skill.yml)</sub>

</div>