OSS Security Check

Unified security, quality, and privacy assessment for any external open-source repository or package. This skill is the shared assessment engine used by the git, install-mcp, and install-skill skills.

Input

Caller provides:

• <url> — the repository URL, package name, or source location
• <owner>/<repo> — extracted owner and repo name (or package name)
• <host> — the git host (github.com, gitlab.com, etc.) or package registry (npm, PyPI)

Assessment Workflow

Run all three phases in order. Present combined results at the end.

Phase 1: Reputation and history (web search)

Search the web for known issues. This is the highest-signal check — skip it and you miss the obvious.