open-source-contributions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited open-source-contributions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version: 1.1.0 | Last Verified: 2025-11-06 | Production Tested: ✅
Contributing to open source projects requires understanding etiquette, conventions, and what maintainers expect. This skill helps create professional, maintainer-friendly pull requests while avoiding common mistakes that waste time and cause rejections.
Key Focus: Cleaning personal development artifacts, writing proper PR descriptions, following project conventions, and communicating professionally.
Use this skill when:
Auto-triggers on phrases: "submit PR to", "contribute to", "pull request for", "open source contribution"
Planning & Notes Documents:
❌ SESSION.md # Session tracking notes
❌ NOTES.md # Personal development notes
❌ TODO.md # Personal todo lists
❌ planning/* # Planning documents directory
❌ IMPLEMENTATION_PHASES.md # Project planning
❌ DATABASE_SCHEMA.md # Unless adding new schema to project
❌ ARCHITECTURE.md # Unless documenting new architecture
❌ SCRATCH.md # Temporary notes
❌ DEBUGGING.md # Debugging notes
❌ research-logs/* # Research notesScreenshots & Visual Assets:
❌ screenshots/debug-*.png # Debugging screenshots
❌ screenshots/test-*.png # Testing screenshots
❌ screenshot-*.png # Ad-hoc screenshots
❌ screen-recording-*.mp4 # Screen recordings
❌ before-after-local.png # Local comparison images
✅ screenshots/feature-demo.png # IF demonstrating feature in PR description
✅ docs/assets/ui-example.png # IF part of documentation updateTest Files (Situational):
❌ test-manual.js # Manual testing scripts
❌ test-debug.ts # Debugging test files
❌ quick-test.py # Quick validation scripts
❌ scratch-test.sh # Temporary test scripts
❌ example-local.json # Local test data
✅ tests/feature.test.js # Proper test suite additions
✅ tests/fixtures/data.json # Required test fixtures
✅ __tests__/component.tsx # Component testsBuild & Dependencies:
❌ node_modules/ # Dependencies (in .gitignore)
❌ dist/ # Build output (in .gitignore)
❌ build/ # Build artifacts (in .gitignore)
❌ .cache/ # Cache files (in .gitignore)
❌ package-lock.json # Unless explicitly required by project
❌ yarn.lock # Unless explicitly required by projectIDE & OS Files:
❌ .vscode/ # VS Code settings
❌ .idea/ # IntelliJ settings
❌ .DS_Store # macOS file system
❌ Thumbs.db # Windows thumbnails
❌ *.swp, *.swo # Vim swap files
❌ *~ # Editor backup filesSecrets & Sensitive Data:
❌ .env # Environment variables (NEVER!)
❌ .env.local # Local environment config
❌ config/local.json # Local configuration
❌ credentials.json # Credentials (NEVER!)
❌ *.key, *.pem # Private keys (NEVER!)
❌ secrets/* # Secrets directory (NEVER!)Temporary & Debug Files:
❌ temp/* # Temporary files
❌ tmp/* # Temporary directory
❌ debug.log # Debug logs
❌ *.log # Log files
❌ dump.sql # Database dumps
❌ core # Core dumps
❌ *.prof # Profiling output✅ Source code changes # The actual feature/fix
✅ Tests for changes # Required tests for new code
✅ Documentation updates # README, API docs, inline comments
✅ Configuration changes # If part of the feature
✅ Migration scripts # If needed for the feature
✅ Package.json updates # If adding/removing dependencies
✅ Schema changes # If part of feature (with migrations)
✅ CI/CD updates # If needed for new workflowsUse the bundled scripts/pre-pr-check.sh to scan for artifacts:
./scripts/pre-pr-check.shWhat it checks:
git status
git diff --statAsk yourself:
Manual removal:
git rm --cached SESSION.md
git rm --cached -r planning/
git rm --cached screenshots/debug-*.png
git rm --cached test-manual.jsOr use the clean script:
./scripts/clean-branch.shAdd personal patterns to .git/info/exclude (affects only YOUR checkout):
# Personal development artifacts
SESSION.md
NOTES.md
TODO.md
planning/
screenshots/debug-*.png
test-manual.*
scratch.*Template (see references/pr-template.md):
## What?
[Brief description of what this PR does]
## Why?
[Explain the reasoning, business value, or problem being solved]
## How?
[Describe the implementation approach and key decisions]
## Testing
[Step-by-step instructions for reviewers to test]
## Checklist
- [ ] Tests added/updated
- [ ] Documentation updated
- [ ] CI passing
- [ ] Breaking changes documented
## Related Issues
Closes #123
Relates to #456## What?
Add OAuth2 authentication support for Google and GitHub providers
## Why?
Users have requested social login to reduce friction during signup.
This implements Key Result 2 of Q4 OKR1.
## How?
- Implemented OAuth2 flow using passport.js
- Added provider configuration in environment variables
- Created callback routes for each provider
- Updated user model to link social accounts
## Testing
1. Set up OAuth apps in Google/GitHub developer consoles
2. Add credentials to `.env` (see `.env.example`)
3. Run `npm start`
4. Click "Login with Google" and verify flow
5. Verify user profile merges correctly
## Breaking Changes
None - this is additive functionality
## Related Issues
Closes #234
Relates to #156 (social login epic)Format: <type>(<scope>): <description>
Types:
feat: - New featurefix: - Bug fixdocs: - Documentation onlystyle: - Formatting (no code change)refactor: - Code restructuring (no behavior change)perf: - Performance improvementtest: - Adding/updating testsbuild: - Build system changesci: - CI configuration changeschore: - Other changes (no src/test changes)Examples:
✅ feat(auth): add OAuth2 support for Google and GitHub
✅ fix(api): resolve memory leak in worker shutdown
✅ docs(readme): update installation instructions for v2.0
✅ refactor(utils): extract validation logic to separate module
❌ Fixed stuff
❌ Updates
❌ Working on authentication (too vague)See references/commit-message-guide.md for complete guide.
<type>(<scope>): <subject>
[optional body]
[optional footer]Subject line rules:
Body rules (optional):
Footer (optional):
Closes #123BREAKING CHANGE: ...Good:
fix: prevent race condition in cache invalidation
The cache invalidation logic wasn't thread-safe, causing
occasional race conditions when multiple workers tried to
invalidate the same key simultaneously.
Added mutex locks around the critical section and tests
to verify thread-safety.
Fixes #456Bad:
Fixed bug # Too vague
WIP # Not descriptive
asdf # Meaningless
Updated auth.js # Describes file, not change
Fixed the issue with the thing # No specificsResearch-backed guidelines:
Why small PRs matter:
1. One Change = One PR
❌ BAD: Refactor auth module + add OAuth + fix bug + update docs (800 lines)
✅ GOOD:
PR #1: Refactor auth module (150 lines)
PR #2: Add OAuth support (200 lines)
PR #3: Fix authentication bug (50 lines)
PR #4: Update authentication docs (80 lines)2. Separate Refactoring from Features
❌ BAD: Add feature X + refactor related code (500 lines)
✅ GOOD:
PR #1: Refactor to prepare for feature X (200 lines)
PR #2: Add feature X (150 lines)3. Use Feature Flags Ship incomplete features behind flags, merge early and often:
if (featureFlags.newAuth) {
// New OAuth flow (incomplete but behind flag)
} else {
// Existing flow
}4. Break Down by Layer
For "User Authentication" feature:
PR #1: Database schema + migrations (100 lines)
PR #2: API endpoints (150 lines)
PR #3: Frontend components (200 lines)
PR #4: Tests + documentation (150 lines)If unavoidable: Add clear section headers in PR description to guide review.
Always read this FIRST - it's the project's law. Common locations:
/CONTRIBUTING.md/.github/CONTRIBUTING.md/docs/CONTRIBUTING.mdKey sections to check:
Tip: Add /contribute to repository URL to find beginner-friendly issues.
Files to look for:
.eslintrc, .eslintrc.js (JavaScript/TypeScript linting).prettierrc (Code formatting).editorconfig (Editor settings)STYLE.md (Style guide documentation)rustfmt.toml (Rust formatting)pyproject.toml (Python formatting)Run formatters before committing:
npm run lint # Check for style issues
npm run lint:fix # Auto-fix style issues
npm run format # Format code (Prettier, Black, etc.)Look at recent merged PRs:
The Golden Rule: "Do things the way the project maintainers would want it done."
Before submitting:
# Run full test suite
npm test # Node projects
cargo test # Rust projects
pytest # Python projects
go test ./... # Go projects
# Check coverage (if required)
npm run test:coverage
# Run linters
npm run lint
# Build the project
npm run buildNever submit a PR with:
Comment on the issue:
Hi! I'd like to work on this issue. My approach would be to:
1. [Brief outline of approach]
2. [Key implementation detail]
Does this sound good? Any guidance before I start?Why this matters:
Wait for acknowledgment on significant changes before investing time.
When submitting:
@maintainer I've implemented the feature as discussed in #123.
I went with approach A instead of B because [reason].
Ready for review when you have time. Happy to make changes!When responding to feedback:
Good catch! I've updated this in commit abc1234.I considered that approach, but went with X because Y.
Happy to discuss alternatives if you prefer a different direction.Could you elaborate on what you mean by Z?
I want to make sure I understand correctly.Key principles:
Response templates:
Mental framework:
Steps to take:
What NOT to do:
Maintainers are often volunteers:
Timeline expectations:
When to ping:
How to ping:
Hi! Just wanted to gently ping this PR.
No rush at all, just making sure it's on your radar.
Happy to answer any questions or make changes!See Critical Workflow Rules section for detailed guidance on Rules 1-3
1. Not Reading CONTRIBUTING.md
2. Including Personal Development Artifacts
3. Submitting Massive Pull Requests
4. Not Testing Code Before Submitting (Violates RULE 2)
5. Working on Already Assigned Issues
6. Not Discussing Changes First (for large changes)
7. Being Impatient or Unresponsive
8. Not Updating Documentation
9. Ignoring Code Style Standards
10. Ignoring CI Failures
11. Including Unrelated Changes (Violates RULE 3)
12. Not Linking Issues Properly
13. Committing Secrets or Sensitive Data
14. Force-Pushing Without Warning
15. Not Running Build/Tests Locally
npm run build and npm test before pushing16. Working Directly on main/master Branch (Violates RULE 1)
git checkout -b feature/my-feature), NEVER commit to mainInitial setup:
# 1. Fork repository on GitHub (click Fork button)
# 2. Clone YOUR fork
git clone https://github.com/YOUR-USERNAME/project-name.git
cd project-name
# 3. Add upstream remote
git remote add upstream https://github.com/ORIGINAL-OWNER/project-name.git
# 4. Verify remotes
git remote -v
# origin https://github.com/YOUR-USERNAME/project-name.git (fetch)
# origin https://github.com/YOUR-USERNAME/project-name.git (push)
# upstream https://github.com/ORIGINAL-OWNER/project-name.git (fetch)
# upstream https://github.com/ORIGINAL-OWNER/project-name.git (push)Creating feature branch:
# NEVER work on main/master directly!
git checkout -b feature/add-oauth-support
# Make changes...
git add .
git commit -m "feat(auth): add OAuth2 support"
# Push to YOUR fork
git push origin feature/add-oauth-supportKeeping fork in sync:
git fetch upstream
git checkout main
git merge upstream/main
git push origin mainRULE 1: ALWAYS Work on a Feature Branch
# ❌ NEVER DO THIS
git checkout main
# make changes directly on main
git commit -m "add feature" # BAD!
# ✅ ALWAYS DO THIS
git checkout main
git pull upstream main # Sync first
git checkout -b feature/add-oauth-support # Descriptive branch name
# make changes on feature branch
git commit -m "feat(auth): add OAuth support"Why this matters:
Branch naming conventions:
feature/descriptive-name # New features
fix/issue-123 # Bug fixes
docs/update-readme # Documentation
refactor/extract-utils # Refactoring
test/add-unit-tests # Test additionsRULE 2: Test Thoroughly BEFORE Submitting PR
Never submit a PR without:
npm test # Node.js
cargo test # Rust
pytest # Python
go test ./... # Go npm run lint # Linting
npm run build # Build succeeds
npm run type-check # TypeScript checksExample testing checklist for a new OAuth feature:
## Testing Performed
### Automated Tests
- ✅ All existing tests pass
- ✅ Added 12 new tests for OAuth flow
- ✅ Coverage increased from 85% to 87%
### Manual Testing
- ✅ Tested Google OAuth flow end-to-end
- ✅ Tested GitHub OAuth flow end-to-end
- ✅ Verified error handling (invalid tokens, network failures)
- ✅ Confirmed user profile merging works correctly
- ✅ Tested on Chrome, Firefox, Safari
### Evidence
See screenshots below showing successful login flow.Why this matters:
Screenshots for PR descriptions:
✅ Include: Working feature demonstration
✅ Include: Before/after comparisons for changes
✅ Include: Error state handling
❌ Don't include: Debug screenshots in code commits
❌ Don't include: Personal testing screenshots in repo
❌ Don't include: Unrelated screenshots
Location: Add to PR description on GitHub, NOT as files in commitsRULE 3: Keep PRs Focused and Cohesive
One PR = One Feature/Fix
✅ GOOD: Single PR adding OAuth support
- OAuth provider configuration
- Login/callback routes
- User model updates
- Tests for OAuth flow
- Documentation for setup
❌ BAD: PR with multiple unrelated changes
- OAuth support
- + Unrelated bug fix in validation
- + Random formatting changes
- + Update to README for different featureWhy cohesive PRs matter:
How to keep PRs focused:
git diffgit stashBreaking up large features:
If a feature is naturally large, break it into phases:
PR #1: Database schema and models
PR #2: API endpoints
PR #3: Frontend components
PR #4: Integration and testsEach PR:
Handling accidental scope creep:
# You added OAuth + accidentally fixed a bug
# Split them into separate commits and PRs:
# 1. Create bug fix branch from main
git checkout main
git checkout -b fix/validation-bug
# 2. Cherry-pick just the bug fix commits
git cherry-pick <commit-hash-of-bug-fix>
# 3. Submit bug fix PR separately
git push origin fix/validation-bug
# 4. Continue with OAuth PR
git checkout feature/add-oauth-support
# Remove bug fix commits if needed
git rebase -i mainWhen to use:
Benefits:
Create draft PR:
gh pr create --draft --title "WIP: Add OAuth support"Mark ready when:
gh pr readyAutomatic closing keywords (in PR description or commits):
Closes #123
Fixes #456
Resolves #789
# Also works:
Close #123
Fix #123
Resolve #123
# Case insensitive:
CLOSES #123
fixes #123
# Multiple issues:
Fixes #10, closes #20, resolves #30
# Cross-repo:
Fixes owner/repo#123Important: Only works when merging to DEFAULT branch (usually main).
Creating PRs efficiently:
# Interactive (prompts for title/body)
gh pr create
# Auto-fill from commits
gh pr create --fill
# Complete non-interactive
gh pr create \
--title "feat(auth): add OAuth support" \
--body "$(cat <<'EOF'
## What?
Add OAuth2 authentication
## Why?
User request for social login
## Testing
1. Set up OAuth apps
2. Run npm start
3. Test login flow
EOF
)"
# With reviewers
gh pr create --reviewer username1,username2
# Draft PR
gh pr create --draftOther useful commands:
gh pr status # See your PRs
gh pr checks # View CI status
gh pr view # View current PR
gh pr diff # See PR diff
gh pr ready # Mark draft as ready
gh pr merge # Merge PR (when approved)Use this checklist before submitting ANY pull request (see references/pr-checklist.md).
Critical Workflow Rules (see detailed section above):
Code Quality:
npm test, cargo test, etc.)npm run build, etc.)./scripts/pre-pr-check.sh)# Setup
git clone https://github.com/YOUR-USERNAME/project.git
git remote add upstream https://github.com/ORIGINAL/project.git
# Create feature branch
git checkout -b feature/my-feature
# Make changes and commit
git add .
git commit -m "feat: add new feature"
# Push to your fork
git push origin feature/my-feature
# Keep fork synced
git fetch upstream
git checkout main
git merge upstream/main
git push origin main
# Rebase feature branch if needed
git checkout feature/my-feature
git rebase main
git push origin feature/my-feature --force-with-lease# Create PR
gh pr create --title "feat: ..." --body "..."
# Check status
gh pr status
gh pr checks
# View PR
gh pr view
gh pr diff
# Manage PR
gh pr ready # Mark draft as ready
gh pr review --approve # Approve (if reviewer)
gh pr merge # Merge (when approved)# Run checks
npm run lint
npm test
npm run build
# Use skill script
./scripts/pre-pr-check.sh
# Check git status
git status
git diff --stat
# Review changes
git diff
git log --oneline -5See bundled examples for complete before/after comparisons:
assets/good-pr-example.md - Well-structured PRassets/bad-pr-example.md - Common mistakes to avoidBundled Resources:
scripts/pre-pr-check.sh - Scan for artifacts before submissionscripts/clean-branch.sh - Remove common personal artifactsreferences/pr-template.md - PR description templatereferences/pr-checklist.md - Complete pre-submission checklistreferences/commit-message-guide.md - Conventional commits guidereferences/files-to-exclude.md - Comprehensive exclusion listassets/good-pr-example.md - Example of well-structured PRassets/bad-pr-example.md - Common mistakes to avoidExternal Resources:
Production Tested: ✅ Based on real-world open source contributions and maintainer feedback
Token Efficiency: ~70% savings vs learning through trial-and-error
Errors Prevented: 15 common mistakes documented with solutions
Last Verified: 2025-11-05
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.