open-source-contribution — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited open-source-contribution (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Complete workflow for contributing high-quality PRs to open-source projects.
When user says "langsung gas dan maksimalkan" or "contribusi maksimal" or "bantu dia jadi terbaik":
Before forking, understand what's missing:
# Clone to analyze
git clone https://github.com/owner/repo.git
cd repo
# Check structure
ls -la
find src -name "*.tsx" | head -20
# Check existing features
grep -r "TODO\|FIXME" src/
# Check open issues/PRs
gh issue list --repo owner/repo
gh pr list --repo owner/repoCompare with competitors:
Prioritize by impact:
# Fork via GitHub CLI
gh repo fork owner/repo --remote
# Or manually fork on GitHub, then:
git clone https://github.com/YOUR_USERNAME/repo.git
cd repo
git remote add upstream https://github.com/owner/repo.gitAlways star before contributing:
# Check if already starred
gh repo view owner/repo --json viewerHasStarred
# Star the repo
gh api --method PUT /user/starred/owner/repogh pr list --repo owner/repo --json number,title,authorgit checkout main
git pull upstream main
git checkout -b feat/your-feature-nameUse file tools (write_file, patch) to implement features.
#### TypeScript/JavaScript
# Type check (fast, low memory)
npx tsc --noEmit
# Common errors to fix:
# - TS6133: Unused variable/import/parameter
# - TS2304: Cannot find name
# - TS2345: Type mismatchFix unused variables:
// ❌ Bad
const { data, error } = useQuery(); // error unused
return <div>{data}</div>;
// ✅ Good
const { data } = useQuery();
return <div>{data}</div>;Fix unused imports:
// ❌ Bad
import { useState, useEffect } from 'react'; // useEffect unused
// ✅ Good
import { useState } from 'react';Fix unused parameters:
// ❌ Bad
items.map((item, idx) => <div key={item.id}>{item.name}</div>); // idx unused
// ✅ Good
items.map((item) => <div key={item.id}>{item.name}</div>);#### Python
mypy src/
ruff check .#### Rust
cargo clippy -- -D warnings
cargo fmt --checkgit add .
git commit -m "feat(scope): add feature
- Detailed change 1
- Detailed change 2
- Detailed change 3
Closes #issue_number"Commit types:
feat: — New featurefix: — Bug fixrefactor: — Code restructuredocs: — Documentationtest: — Testschore: — Maintenancegit push -u origin feat/your-feature-name
gh pr create --repo owner/repo \
--title "feat: Add Feature Name" \
--body "## Overview
Comprehensive description of changes.
## Features
- Feature 1
- Feature 2
## Testing
- Test approach
See docs/FEATURE.md for details."If CI fails with TypeScript errors:
# Check errors
npx tsc --noEmit
# Fix errors (use patch/write_file)
# Commit fix
git add .
git commit -m "fix: remove unused variables (TypeScript errors)"
git pushnpx tsc --noEmit passes)any, no @ts-ignore)When building comprehensive features (user says "gas semua" or "maksimalkan"):
Phase 1: Quick Wins (1-2 hours each)
Phase 2: Core Features (2-4 hours each)
Phase 3: Advanced Features (4-6 hours each)
# PR #1
git checkout main
git checkout -b feat/command-palette
# Implement, test, commit
npx tsc --noEmit # CRITICAL: Check before push
git push -u origin feat/command-palette
gh pr create --repo owner/repo --title "..." --body "..."
# PR #2 (don't wait for #1 review)
git checkout main
git checkout -b feat/loading-states
# Implement, test, commit
npx tsc --noEmit # CRITICAL: Check before push
git push -u origin feat/loading-states
gh pr create --repo owner/repo --title "..." --body "..."
# Continue for all featuresBenefits:
npx tsc --noEmit before every commit# 1. Fork and star
gh repo fork owner/repo --remote
gh api --method PUT /user/starred/owner/repo
# 2. Check existing PRs
gh pr list --repo owner/repo
# 3. Create branch
git checkout -b feat/command-palette
# 4. Implement feature (use file tools)
# 5. Quality check
npx tsc --noEmit
# Fix any errors
# 6. Commit
git add .
git commit -m "feat(ui): add command palette with keyboard shortcuts"
# 7. Push
git push -u origin feat/command-palette
# 8. Create PR
gh pr create --repo owner/repo \
--title "feat(ui): Add Command Palette and Keyboard Shortcuts" \
--body "Comprehensive command palette with 8 global shortcuts..."
# 9. Fix CI errors if any
npx tsc --noEmit
# Fix, commit, push
# 10. Repeat for next feature
git checkout main
git pull upstream main
git checkout -b feat/loading-states# ❌ Don't use full build on low-memory systems
npm run build # May crash with OOM
# ✅ Use type check only
npx tsc --noEmit # Fast, low memory# Pull latest from upstream
git checkout main
git pull upstream main
# Rebase your branch
git checkout feat/your-feature
git rebase main
# Fix conflicts, then:
npx tsc --noEmitHigh-quality contribution:
npx tsc --noEmit)Impact:
After submitting PRs, perform deep quality review:
Check each PR in order:
# Switch to branch
git checkout feat/your-feature
# Check for TypeScript errors
npx tsc --noEmit 2>&1 | head -30
# Common errors:
# - TS6133: Unused variable/import/parameter
# - TS2304: Cannot find name
# - TS2345: Type mismatchCommon fixes:
// ❌ Unused variable
const { data, error } = useQuery(); // error unused
return <div>{data}</div>;
// ✅ Fixed
const { data } = useQuery();
return <div>{data}</div>;
// ❌ Unused import
import { useState, useEffect } from 'react'; // useEffect unused
// ✅ Fixed
import { useState } from 'react';
// ❌ Unused parameter
items.map((item, idx) => <div key={item.id}>{item.name}</div>); // idx unused
// ✅ Fixed
items.map((item) => <div key={item.id}>{item.name}</div>);# Check Rust syntax (if cargo available)
cd src-tauri
cargo check 2>&1 | tail -30
# If cargo not available, check manually:
grep -n "pub async fn" src-tauri/src/commands/*.rs
# Ensure all commands are registered in lib.rsCheck for common patterns:
#### Out-of-bounds index after filtering
// ❌ Bad: selectedIndex might be out of bounds
const filteredItems = useMemo(() => items.filter(...), [items, search]);
// selectedIndex still points to old array
// ✅ Good: Reset index when filtered items change
useEffect(() => {
setSelectedIndex(0);
}, [filteredItems]);#### Stale state in event listeners
// ❌ Bad: Captures stale state
useEffect(() => {
const handler = () => console.log(count); // Stale count
window.addEventListener('click', handler);
}, []); // Empty deps
// ✅ Good: Include dependencies
useEffect(() => {
const handler = () => console.log(count);
window.addEventListener('click', handler);
return () => window.removeEventListener('click', handler);
}, [count]); // Include count#### Missing cleanup in useEffect
// ❌ Bad: No cleanup
useEffect(() => {
window.addEventListener('keydown', handler);
}, []);
// ✅ Good: Cleanup
useEffect(() => {
window.addEventListener('keydown', handler);
return () => window.removeEventListener('keydown', handler);
}, []);Check for cleanup:
# Find all addEventListener without cleanup
grep -A5 "addEventListener" src/components/**/*.tsx | grep -v "removeEventListener"# Check for aria attributes
grep -n "aria-\|role=" src/components/**/*.tsxCommon fixes:
// ✅ Add aria-label to loading spinners
<CircleNotch aria-label="Loading" className="animate-spin" />
// ✅ Add role/aria-modal to overlays
<div
role="dialog"
aria-modal="true"
aria-label="Loading"
className="fixed inset-0 ..."
>
// ✅ Add aria-hidden to decorative elements
<div aria-hidden="true" className="skeleton">Check for memory leaks:
# Count useEffect cleanup functions
grep -A5 "useEffect" src/components/**/*.tsx | grep -c "return () =>"
# Should match number of useEffect hooks with side effectsCheck for unnecessary re-renders:
// ✅ Use useMemo for expensive computations
const filteredItems = useMemo(() =>
items.filter(item => item.name.includes(search)),
[items, search]
);
// ✅ Use useCallback for event handlers passed to children
const handleClick = useCallback(() => {
// ...
}, [deps]);Check cross-component integration:
# Check event emission
grep -n "dispatchEvent\|new CustomEvent" src/components/**/*.tsx
# Check event listeners
grep -n "addEventListener.*file-selected" src/components/**/*.tsxVerify integration:
file-selected eventfile-selected event# Check for missing imports
grep -r "import.*from" src/ | grep "ComponentName"
# If component doesn't exist in branch, use inline alternative
# Example: Replace <LoadingSpinner /> with <CircleNotch className="animate-spin" />After finding issues, fix and commit:
# Fix TypeScript errors
git add .
git commit -m "fix: remove unused variables (TypeScript errors)
- Remove unused 'mainView' in App.tsx
- Remove unused 'formatShortcut' import in CommandPalette.tsx
- Remove unused 'idx' parameter in CommandPalette.tsx
All TypeScript errors resolved."
git push
# Fix accessibility
git add .
git commit -m "fix(a11y): add aria labels to loading components
- Add aria-label to LoadingSpinner for screen readers
- Add role=dialog, aria-modal, aria-label to LoadingOverlay
- Improves accessibility for visually impaired users"
git push
# Fix dependencies
git add .
git commit -m "fix: remove LoadingSpinner dependency, use inline CircleNotch
FileTree now uses CircleNotch directly instead of importing LoadingSpinner
(which doesn't exist in this branch). Keeps the component self-contained."
git push
# Fix runtime bugs
git add .
git commit -m "fix(ui): reset selectedIndex when filtered commands change
Prevents out-of-bounds index when search filters commands.
Ensures arrow key navigation always works correctly."
git pushBefore marking PR as ready:
npx tsc --noEmit)When submitting multiple PRs, review systematically:
# Review PR #1
git checkout feat/command-palette
npx tsc --noEmit
# Fix issues, commit, push
# Review PR #2
git checkout feat/loading-states
npx tsc --noEmit
# Fix issues, commit, push
# Review PR #3
git checkout feat/file-tree
npx tsc --noEmit
# Fix issues, commit, push
# Continue for all PRsTrack review status:
| PR | TypeScript | Rust | Logic | A11y | Perf | Integration | Status |
|---|---|---|---|---|---|---|---|
| #6 | ✅ | N/A | ✅ | ✅ | ✅ | ✅ | READY |
| #7 | ✅ | N/A | N/A | ✅ | ✅ | ✅ | READY |
| #8 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | READY |
| #9 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | READY |
| #10 | ✅ | N/A | ✅ | ✅ | ✅ | ✅ | READY |
references/tauri-contributions.md — Tauri-specific patterns (Rust commands, IPC, file operations, common pitfalls)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.