Agent Skill
Open Sourcing skill
open-sourcingtrailofbits/skillsplugins/open-sourcing/skills/open-sourcing/SKILL.md
This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a public launch. Provides a release-readiness workflow covering secrets hygiene, licensing, documentation, CI, and language-specific packaging.
always on
82 tokname + description
once used
2,273 tokSKILL.md body
bundled files
102 scripts
repo stars
7.7kGitHub
Install the Open Sourcing skill
Skills CLI (Claude Code, Codex, Cursor and others)
npx skills add https://github.com/trailofbits/skills --skill open-sourcing
Claude Code, by hand (all projects)
git clone --depth 1 https://github.com/trailofbits/skills.git /tmp/skills mkdir -p ~/.claude/skills cp -R /tmp/skills/plugins/open-sourcing/skills/open-sourcing ~/.claude/skills/open-sourcing
For one project only, copy the folder into .claude/skills/ in that project instead. The agent picks it up when a task matches its description.
What it costs your context
Agent Skills load in three steps. Tokens counted with the o200k tokenizer; your model's count will differ a little.
| When | What loads | Cost |
|---|---|---|
| Every session | Name and description | 82 tok |
| When the agent uses it | The SKILL.md instructions | 2,273 tok |
| Only if opened | 10 bundled files (26 KB) | varies |
Until it is used, open-sourcing costs about 17× less than the median MCP server we measured (1,362 tokens on every turn). Installing all 97 skills from trailofbits/skills would load 7,555 tokens of descriptions. Skills vs MCP study
Checks
- Ships scripts the agent can run. Read them before installing.
Checked 2026-10-22 · method
What's inside
The headings of its SKILL.md. Read the full file on GitHub.
- Open-Sourcing a Repository
- When to Use
- When NOT to Use
- Workflow
- Step 1: Detect the organization profile
- Step 2: Audit for secrets — before anything else
- Step 3: Run the readiness check
- Step 4: Documentation
- Step 5: Licensing
- Step 6: Tests and CI
- Step 7: Repository settings
- Step 8: Releases and versioning
- Step 9: Language-specific practices
- Final Review
- Additional Resources
- Reference Files
- Scripts
More skills from trailofbits/skills
- address-sanitizertrailofbits/skills
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.
7.7k97 tok idle · 2,723 in use - adjudicate-regressiontrailofbits/skills
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
7.7k23 tok idle · 505 in use - aflpptrailofbits/skills
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.
7.7k91 tok idle · 5,638 in use - agentic-actions-auditortrailofbits/skills
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
7.7k105 tok idle · 4,775 in use - algorand-vulnerability-scannertrailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
7.7k54 tok idle · 2,979 in use - atheristrailofbits/skills
Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.
7.7k86 tok idle · 3,559 in use - audit-augmentationtrailofbits/skills
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.
7.7k130 tok idle · 2,108 in use - audit-context-buildingtrailofbits/skills
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.
7.7k55 tok idle · 797 in use