GitHub Repository Research skills for AI agents

Activate this skill when the user must choose between several open-source libraries, frameworks, or tools for the same job and wants a defensible comparison rather than a popularity contest: weighing API fit, maintenance, performance, community, license, and the cost of leaving later, and recording the decision so it can be revisited. Triggers on keywords like "compare libraries," "which should we adopt," "library evaluation," "decision matrix," "architecture decision record," "ADR," "exit cost," "vendor lock-in," "build vs buy vs adopt," "technology selection," and "candidate comparison." Covers criteria definition, spikes, weighted scoring with sensitivity checks, exit-cost estimation, and a decision record template.

Activate this skill when the user wants to contribute to an open-source project they do not maintain: filing an issue well, preparing a first pull request that gets merged, matching the project's conventions, handling review feedback, and deciding when to fork instead. Triggers on keywords like "first pull request," "contributing to open source," "CONTRIBUTING.md," "how to file an issue," "PR etiquette," "code review feedback," "DCO sign-off," "CLA," "changelog entry," "upstream a fix," and "fork or contribute." Covers reading contribution guidelines, issue etiquette, scoping small PRs, style and tests, changelog practice, responding to review, and the fork decision.

Activate this skill when the user must audit what a project actually depends on: reading lockfiles, mapping transitive dependencies, checking license compatibility, producing or consuming an SBOM, matching packages against vulnerability advisories, or judging whether the people behind a dependency can be trusted. Triggers on keywords like "dependency audit," "license compatibility," "lockfile," "transitive dependencies," "SBOM," "SPDX," "CycloneDX," "osv-scanner," "npm audit," "GPL contamination," "supply chain," "known vulnerabilities," and "third-party license review." Covers lockfile reading per ecosystem, dependency graph tooling, license classes and their interactions, advisory databases, maintainer risk, and an audit report template.

Activate this skill when the user needs to find out when, why, or by whom a behaviour in a codebase changed: hunting a regression, understanding a strange line of code, recovering lost work, or building evidence from commit messages and pull request discussions. Triggers on keywords like "git blame," "git bisect," "pickaxe," "git log -S," "when did this change," "who wrote this," "find the commit that broke," "reflog," "regression hunting," "commit archaeology," and "history forensics." Covers path-scoped logs, blame that survives refactors, pickaxe searches, bisection with automated tests, reflog recovery, and reading PR discussions as evidence.

Activate this skill when the user wants to find existing code, issues, or discussions on GitHub before building or debugging something: locating prior art for a design, finding whether a bug has already been reported or fixed in a fork, discovering how other projects integrate a library, or searching a large organisation's code for a pattern. Triggers on keywords like "github search," "code search operators," "search issues," "has this been reported," "find a fork that fixed," "how do others use this library," "prior art," "search qualifiers," "gh search," and "github repository research." Covers code search syntax, issue and PR qualifiers, fork mining, integration discovery, keeping reusable searches, and the blind spots of the search index.

Activate this skill when the user has to understand a codebase they did not write: onboarding to a new repository, evaluating a library's internals before adopting it, tracing how a request flows through a service, or figuring out where to make a change in a large project. Triggers on keywords like "understand this codebase," "where is the entry point," "how does this repo work," "trace a request," "code reading," "navigate a large codebase," "ripgrep," "ctags," "folder structure," and "onboarding to a repository." Covers entry points, build files, folder mapping, end-to-end tracing, reading tests as documentation, tooling, and time-boxed exploration.

Activate this skill when the user is evaluating whether an open-source project on GitHub is safe to depend on, doing "github repository research" before adopting a library, or asking whether a project is maintained, abandoned, or risky. Triggers on keywords like "repository health," "is this repo maintained," "bus factor," "release cadence," "issue response time," "abandoned project," "dependency due diligence," "open source risk," "CI status," "license check," and "security policy." Covers a scored health checklist, the signals that actually predict maintenance, and the red flags that should end an evaluation early.

Activate this skill when the user needs to judge how well a GitHub repository defends itself and its downstream users: whether secrets have leaked into history, whether its GitHub Actions workflows can be hijacked, whether the default branch is protected, how dependencies are updated, whether commits and releases are signed, and whether there is a working vulnerability disclosure process. Triggers on keywords like "security posture," "secrets in git history," "pull_request_target," "pin actions to SHA," "branch protection," "dependabot," "renovate," "signed commits," "SECURITY.md," "supply chain attack," "OpenSSF Scorecard," and "workflow permissions." Covers history scanning, Actions supply-chain risks, protection rules, update automation, signing, and disclosure policy.

Activate this skill when the user is trying to run the code released with an academic paper or a research prototype and get results that match the claims: setting up a pinned environment, mapping the paper's equations and tables to the code, handling datasets and random seeds, and writing up a reproduction that others can trust. Triggers on keywords like "reproduce this paper," "research code," "reproducibility," "paper vs code," "random seed," "can't match the reported numbers," "replication," "pin the environment," "ML reproducibility," and "reproduction report." Covers environment pinning, reading the paper against the code, datasets and seeds, running the smallest experiment first, documenting deviations, and honest reporting.