is-github

/is-github

Find an existing GitHub repository or function, inspect it for security and license risks, and either extract the small piece you need or recommend installing the full package.

A practical, tested skill for AI coding agents that want to reuse existing open-source code without skipping security or license checks.

This project, JunWeiLi233/Is-Github, keeps one platform-neutral workflow in INSTRUCTIONS.md. The same workflow is exposed as a native Agent Skill for Codex, Claude Code, and OpenCode, with the scan and dependency-analysis scripts bundled alongside the OpenCode adapter.

Contributing · Security · Support · Accessibility · License

Why use it?

AI coding agents often find a plausible repository before they establish whether it is safe to clone, legally reusable, or small enough to copy. This skill turns that decision into a repeatable workflow:

• search internal code and public package/repository sources;
• compare candidates using maintenance, license, and ownership signals;
• deep-scan the selected repository for suspicious files, scripts, secrets, obfuscation, network calls, large blobs, dependency risk, and history anomalies; and
• extract only a small dependency tree with provenance, or explain why the full package is safer.

It is automated triage, not a guarantee that third-party code is safe. Review the result before shipping copied code.

Supported skill platforms

The repository also contains instruction-only compatibility adapters for Cursor, Cline/Roo, Windsurf, Copilot, Qodo, Continue, Cody, Amazon Q, and Aider. Those adapters point back to the same canonical workflow; the three platforms above are the supported native SKILL.md installations.

Project health

This is an early-stage project with a deterministic local smoke suite. Before contributing, read CONTRIBUTING.md. Use the structured bug report, feature request, or accessibility report when the repository is published with its issue forms. Never put vulnerability details or secrets in a public issue; follow SECURITY.md.

Install it by asking your AI agent

Copy one of these prompts into the agent you use in your project:

Download https://github.com/JunWeiLi233/Is-Github.git into .is-github-skill.
I use Codex. Install the project skill from
.is-github-skill/.agents/skills/is-github/SKILL.md into
.agents/skills/is-github/, copy the sibling INSTRUCTIONS.md and scripts there,
then verify the SKILL.md frontmatter before using /is-github.

Download https://github.com/JunWeiLi233/Is-Github.git into .is-github-skill.
I use Claude Code. Install the project skill from
.is-github-skill/.claude/skills/is-github/SKILL.md into
.claude/skills/is-github/, copy the sibling INSTRUCTIONS.md and scripts there,
then verify the SKILL.md frontmatter before using /is-github.

Download https://github.com/JunWeiLi233/Is-Github.git into .is-github-skill.
I use OpenCode. Install .is-github-skill/.opencode/skills/is-github into
.opencode/skills/is-github, copy INSTRUCTIONS.md into that skill directory,
merge .opencode/skills into opencode.jsonc without adding machine-specific
absolute paths, and tell me if OpenCode must be restarted.

The agent should preserve any existing project instructions and merge an existing opencode.jsonc instead of replacing it.

Fast install with the Agent Skills CLI

For Codex, Claude Code, and other Agent Skills-compatible harnesses, the standard distribution can be installed interactively with:

npx skills@latest add JunWeiLi233/Is-Github

Select is-github when the installer asks which skill to add. The portable bundle includes its instructions and helper scripts, so it does not depend on an absolute path in this repository. The repository also ships Claude Code plugin metadata in .claude-plugin/ for users who prefer managed plugin installation.

Manual installation

From the root of the project that should receive the skill:

git clone --depth 1 https://github.com/JunWeiLi233/Is-Github.git .is-github-skill

Codex:

mkdir -p .agents/skills/is-github
cp .is-github-skill/.agents/skills/is-github/SKILL.md .agents/skills/is-github/
cp .is-github-skill/INSTRUCTIONS.md .agents/skills/is-github/
cp -R .is-github-skill/.opencode/skills/is-github/scripts .agents/skills/is-github/

Claude Code:

mkdir -p .claude/skills/is-github
cp .is-github-skill/.claude/skills/is-github/SKILL.md .claude/skills/is-github/
cp .is-github-skill/INSTRUCTIONS.md .claude/skills/is-github/
cp -R .is-github-skill/.opencode/skills/is-github/scripts .claude/skills/is-github/

OpenCode:

mkdir -p .opencode/skills
cp -R .is-github-skill/.opencode/skills/is-github .opencode/skills/
cp .is-github-skill/INSTRUCTIONS.md .opencode/skills/is-github/

Ensure opencode.jsonc contains the portable project path below alongside any existing skill paths. Do not copy a path containing another user's home directory.

{
  "skills": { "paths": [".opencode/skills"] }
}

Restart OpenCode after changing skill or command configuration. Codex and Claude Code will discover the project skill on the next session.

Usage

/is-github I need a debounce function for TypeScript
/is-github I need a CSV parser --lang python --license mit
/is-github-clean

The agent should:

1. Parse the request and detect the project language.
2. Check internal repositories and the local codebase before public search.
3. Present up to three candidates with stars, recency, license, and owner signals.
4. Ask which candidate to inspect, then shallow-clone it into a temporary directory.
5. Run the nine-point scan and report a 0–100 security score with a safe/caution/blocked verdict.
6. Check license compatibility before copying code.
7. Trace internal dependencies: extract small trees (up to five files), otherwise recommend the full package.
8. Inline only after the scan passes or the user explicitly overrides a caution, and add a provenance header.
9. Append extraction metadata to .is-github-extractions.json and clean temporary artifacts.

The scan is automated triage, not a guarantee of safety. Review third-party code before shipping it.

Flags

Security scan

The bundled scanner checks for:

• dangerous binaries and suspicious install scripts;
• minified or obfuscated code, encoded payloads, and dynamic evaluation;
• hardcoded network calls and committed secrets;
• large blobs and dependency vulnerabilities;
• suspicious commit history patterns; and
• license presence, SPDX detection, and usage permissions.

Scores are reported as 🟢 80–100 (safe), 🟡 50–79 (caution), or 🔴 0–49 (blocked). A missing license is always called out because permission to reuse code cannot be assumed.

Requirements

• An AI coding agent with skill support
• bash, python3, and git
• npm for JavaScript dependency audits (optional)
• gh or GITHUB_TOKEN for higher-rate GitHub searches (optional)

Maintainer notes

GitHub-side description, topics, release, and community-health guidance lives in docs/maintainer-playbook.md. Keep the public metadata aligned with the three supported native adapters and only publish badges or release claims after the underlying workflow has passed.

Repository layout

.
├── INSTRUCTIONS.md
├── skills/is-github/                     # Standard Agent Skills distribution
├── .agents/skills/is-github/SKILL.md       # Codex
├── .claude/skills/is-github/SKILL.md       # Claude Code
├── .opencode/skills/is-github/SKILL.md    # OpenCode
├── .opencode/commands/                     # /is-github and /is-github-clean
├── .opencode/skills/is-github/scripts/     # scan, license, audit, extraction
├── .opencode/skills/is-github/test/        # deterministic fixtures
└── .scratch/is-github/                     # PRD and local tickets

Verification

Run the bundled smoke suite from the repository root:

bash .opencode/skills/is-github/scripts/test.sh

The suite exercises the bundled helper scripts, validates the native skill adapters, and creates an isolated mock consumer project. The mock flow scans the clean fixture, extracts debounce, inlines it with provenance, loads the resulting Node module, and verifies the extraction manifest. It does not contact GitHub or modify the working tree.

It also checks the standard skills/is-github distribution against the canonical instructions and scripts. Maintainers can check the mirror directly:

python3 .opencode/skills/is-github/scripts/sync-skill-distribution.py --check

To run only the mock project:

python3 .opencode/skills/is-github/scripts/mock-project-test.py

License

MIT.