OSS Contribution Best Practices — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited OSS Contribution Best Practices (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reference: Based on opensource.guide
This skill is the index. The detail topics live in two sibling skills that load on demand:
Both are linked below. Use this file for the universal rules that apply to every contribution regardless of stage; jump to the sibling skills when you're at a specific stage in the cycle.
Be a good open source citizen:
Every line in a PR diff must be directly related to the issue being fixed. Unrelated formatting changes (whitespace, quote style, trailing commas, import reordering, line breaks) make diffs noisy, harder to review, and signal carelessness. Maintainers will flag or reject PRs with formatting bloat.
Rules:
git diff to identify formatting-only changes. Use git checkout -- {files} only for files where ALL changes are formatting-only. For files with mixed changes, use targeted edits to surgically remove formatting hunks. (In interactive terminal contexts, git add -p can also be used for hunk-level staging.)When formatting IS the fix: If the issue itself is about formatting (e.g., "run prettier on codebase", "fix inconsistent indentation"), then formatting changes are in scope. In all other cases, they are not.
A narrow fix should not widen what the project must support forever. Prefer correcting behavior inside an existing public API over adding a new option, flag, method, or parameter. Every new surface is something maintainers have to document, test, and keep backward-compatible — reach for one only when the existing API genuinely cannot express the fix, and say so explicitly rather than defaulting to a new knob.
Trace a bug to where it actually originates before patching. If the cause lives in an upstream dependency, fix or report it there rather than working around it downstream. If the maintainer rejects the root-cause fix as a known limitation, offer a documentation note that warns other users — don't submit a second local patch that papers over the same underlying problem.
A test added alongside a bug fix only earns its place if it fails without the fix. Before including it, check out the base branch (or revert your fix), run the new test, and confirm it FAILS; then restore the fix and confirm it passes. A test that passes on the unpatched base isn't guarding the bug — it's noise.
Before writing any test, name the concrete regression it catches. Can't name one? Don't write it. Adding entries to a map or registry, constants, icons, copy, or config needs no test. A test that restates data, only checks that a file exists or parses, or exercises the language or framework is filler, and maintainers notice. When an automated review agent flags a weak test, delete it unless you can name a real regression for it to catch. Never grow it to clear the finding. A human maintainer's explicit request, or a rule the repo enforces, wins over this: do what they asked, and if it looks like it calls for a filler test, raise it with the user instead of overriding it.
Do NOT comment to "claim" the issue before you have working code. The workflow is:
The PR itself is the claim. A separate "I'm working on this" comment is unnecessary noise when the PR is coming soon.
Only comment on the issue itself when:
Move on silently. Don't comment that you tried and failed. Don't mark the issue on the upstream repo in any way. Remove it from your local list and continue to the next one.
Persistent skip (optional): the /oss "Work Through Issues" workflow (workflows/work-through-issues.md, Phase C) can persist the skip to your local skipped-issues.md via the CLI's skip-add command so the same issue doesn't resurface in future searches. This is a local-only record — nothing is posted on GitHub.
When a task or approach fails, STOP and report back to the user with what failed and why. Don't silently switch strategies or improvise workarounds — let the user decide how to proceed.
This protocol governs unexpected failures: a tool crashing, an external command returning an error you weren't prepared for, a check producing output you don't know how to handle, an assumption turning out to be wrong. In those cases: stop, report what failed, ask.
It does not override decision points that the workflow itself documents. The /oss workflows surface explicit fallback choices in several places (e.g., "if retry fails, offer retry / skip / done for now"). Those branches were planned, are surfaced to the user, and are exactly the kind of "let the user decide" behavior this protocol asks for. Follow them as written.
In short:
pr-etiquette skill — review responses, PR descriptions, dormant-PR follow-up, PR quality checklist, communication style.contribution-ethics skill — AI attribution rules, AI-tell avoidance, when to defer to a human.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.