Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add the-open-agent/oss-skills --skill open-source-playbookgit clone --depth 1 https://github.com/the-open-agent/oss-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/the-open-agent/oss-skills/open-source-playbook)<a href="https://agentmods.dev/skills/the-open-agent/oss-skills/open-source-playbook"><img src="https://agentmods.dev/badge/skills/the-open-agent/oss-skills/open-source-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/the-open-agent/oss-skills/open-source-playbook"><img src="https://agentmods.dev/badge/skills/the-open-agent/oss-skills/open-source-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.01352 |
| Opus 5 | $0.00066 | $0.00676 |
| Sonnet 5 | $0.00026 | $0.00270 |
| Haiku 4.5 | $0.00013 | $0.00135 |
Grade A, and why
open-source-playbook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Open Source Playbook
The router. Your job here is diagnosis before action: figure out what stage the project is actually in, name the one or two bottlenecks that matter, and hand off to the specific skills. Do not attempt to do all of open source in one pass.
Step 1 — Read the repo before advising
Never advise from the prompt alone. Spend two minutes on ground truth:
ls -la # top-level hygiene files
git log --oneline -20 # commit style, cadence, bus factor
git shortlog -sn | head -20 # contributor distribution
gh repo view --json stargazerCount,forkCount,openIssues,createdAt,licenseInfo 2>/dev/null
gh issue list --limit 20 --state open 2>/dev/null
gh pr list --limit 20 --state open 2>/dev/null
Then read README.md, CONTRIBUTING.md, .github/workflows/, and the package
manifest. If gh is unavailable or unauthenticated, work from the local clone and say
so — do not fabricate repo statistics.
Step 2 — Locate the stage
| Stage | Signal | Bottleneck is almost always |
|---|---|---|
| 0. Pre-release | No public repo, or code exists but no license/README | Positioning and legal basics |
| 1. Published, unknown | Public, <50 stars, single contributor | The README and a working install path |
| 2. Discovered | Traffic arriving, issues opening, nobody contributing code | Contributor onboarding and docs |
| 3. Growing | Multiple contributors, PR queue forming | Automation, review throughput, triage |
| 4. Depended-upon | Downstream users, breakage complaints | API stability, release discipline, security |
| 5. Institutional | Many maintainers, org-scale | Governance, sustainability, succession |
Most projects are one stage behind where their owner thinks they are. Calibrate on evidence (issue volume, external PRs, download counts), not ambition.
Step 3 — Route
| The user's goal | Skill to load |
|---|---|
| Start a repo from nothing | repo-bootstrap |
| Pick a license, handle CLA/DCO, vendored code | license-and-legal |
| Nobody understands what this does | readme-that-converts |
| Docs sprawl, users ask answered questions | docs-architecture |
| Public interface design, stability guarantees | api-design |
| Test suite is slow, flaky, or missing | testing-strategy |
| Review an incoming PR | code-review |
| Big rewrite without breaking users | refactor-safely |
| Performance claims, benchmark suite | performance-benchmarking |
| CI is slow, flaky, or absent | ci-pipelines |
| Versioning, changelog, publishing | release-engineering |
| SECURITY.md, provenance, scorecard, CVEs | supply-chain-security |
| Dependency bloat, upgrade churn | dependency-hygiene |
| Issue backlog is unmanageable | issue-triage |
| No one contributes; first PRs stall | contributor-experience |
| Launch, announce, grow adoption | launch-and-growth |
| Decision-making, burnout, funding, succession | governance-and-sustainability |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 106 lines · 131 tokens per session scan A e621ed0606b9
open-source-playbook is a skill published in the GitHub repository the-open-agent/oss-skills (5 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 131 tokens to every session and 1,352 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
issue-comment
Handle a non-build maintainer comment on an issue or PR — close, reopen, label, dedupe, answer a brief question, or triage. Action-only; redirect anything that needs code changes to /build.
pipeline-conductor
Operating procedure for the kirocrew-pipeline-conductor agent - run one issue/PR pipeline on one repository as a supervised fleet. Auto-pick items, preflight every candidate to one deterministic claim verdict, stand up one worker session per item in a dedicated folder, probe them each cycle with one script call…
babysit
Same-session monitoring loop for PRs, CI runs, tickets, and deployments using the monitorstart / monitorupdate / autonudgestop MCP tools. The loop re-injects your check instructions into THIS session on an idle interval — same context, same tools — and works from dashboard chat, Slack threads, and Discord DMs. Use…
work
Handle issue/PR work items with worktree isolation. Triggered by "/work [issuelink|description]" to start focused work.
meta-github-pr-watch-digest
Inspect the user's open GitHub PRs / failing CI / new issues via gh, summarize into 3 buckets (to-review / awaiting-me / CI-red), and persist follow-ups to memory.
meta-issue-to-pr-autopilot
Triages an issue, delegates the fix to sub-agent, drafts a PR description with summarize, and opens the PR via gh. Best used on small, well-scoped issues with clear acceptance criteria.