opensrc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited opensrc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetches dependency source code so agents can read implementations, not just types. Clones repositories at the correct version tag and caches them globally at ~/.opensrc/.
rg "parse" $(opensrc path zod)
cat $(opensrc path zod)/src/types.ts
find $(opensrc path zod) -name "*.test.ts"opensrc path <pkg> prints the absolute path to cached source. If not cached, it fetches automatically. Progress goes to stderr, path to stdout, so $(opensrc path ...) works in subshells.
opensrc path zod
opensrc path pypi:requests
opensrc path crates:serde
opensrc path facebook/react
# Multiple packages at once
opensrc path zod react next
opensrc path pypi:requests pypi:flask
opensrc path crates:serde crates:tokio
# Specific versions
opensrc path [email protected]
opensrc path pypi:[email protected]
opensrc path owner/[email protected]
opensrc path owner/repo#mainFor npm packages, opensrc auto-detects the installed version from lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock). Use --cwd to resolve from a different project:
opensrc path zod --cwd /path/to/projectFor PyPI and crates.io, explicit versions or latest are used. For repos, use @ref or #ref to pin a branch, tag, or commit.
Source is cached globally at ~/.opensrc/ (override with OPENSRC_HOME).
opensrc list # show all cached sources
opensrc list --json # JSON output
opensrc remove zod # remove a package
opensrc remove facebook/react # remove a repo
opensrc clean # remove everything
opensrc clean --npm # only npm packages
opensrc clean --pypi # only PyPI packages
opensrc clean --crates # only crates.io packages
opensrc clean --packages # all packages, keep repos
opensrc clean --repos # all repos, keep packagesFetch source when you need to:
Don't fetch source for simple API usage questions that docs or types can answer.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.