remorses/opensrc
cli/skills/opensrc/SKILL.md
Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, fetch implementation details for a dependency, or explore how an npm/PyPI/crates.io package is built. Triggers include "fetch source for", "read the source of", "how does X work internally", "get the implementation of", "opensrc path", or any task requiring access to dependency source code beyond types and docs.
$ install --global
skillsauthnpx skillsauth add remorses/kimaki opensrcInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 19, 2026, 3:33 AM4.6s1 file scanned
SKILL.md
- name:
- opensrc
- description:
- Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, fetch implementation details for a dependency, or explore how an npm/PyPI/crates.io package is built. Triggers include "fetch source for", "read the source of", "how does X work internally", "get the implementation of", "opensrc path", or any task requiring access to dependency source code beyond types and docs.
- allowed-tools:
- Bash(opensrc:*)
Source Code Fetching with opensrc
Fetches dependency source code so agents can read implementations, not just types. Clones repositories at the correct version tag and caches them globally at ~/.opensrc/.
Core Pattern
rg "parse" $(opensrc path zod)
cat $(opensrc path zod)/src/types.ts
find $(opensrc path zod) -name "*.test.ts"
opensrc path <pkg> prints the absolute path to cached source. If not cached, it fetches automatically. Progress goes to stderr, path to stdout, so $(opensrc path ...) works in subshells.
Fetching Source Code
opensrc path zod
opensrc path pypi:requests
opensrc path crates:serde
opensrc path facebook/react
# Multiple packages at once
opensrc path zod react next
opensrc path pypi:requests pypi:flask
opensrc path crates:serde crates:tokio
# Specific versions
opensrc path [email protected]
opensrc path pypi:[email protected]
opensrc path owner/[email protected]
opensrc path owner/repo#main
Version Resolution
For npm packages, opensrc auto-detects the installed version from lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock). Use --cwd to resolve from a different project:
opensrc path zod --cwd /path/to/project
For PyPI and crates.io, explicit versions or latest are used. For repos, use @ref or #ref to pin a branch, tag, or commit.
Managing the Cache
Source is cached globally at ~/.opensrc/ (override with OPENSRC_HOME).
opensrc list # show all cached sources
opensrc list --json # JSON output
opensrc remove zod # remove a package
opensrc remove facebook/react # remove a repo
opensrc clean # remove everything
opensrc clean --npm # only npm packages
opensrc clean --pypi # only PyPI packages
opensrc clean --crates # only crates.io packages
opensrc clean --packages # all packages, keep repos
opensrc clean --repos # all repos, keep packages
When to Fetch Source
Fetch source when you need to:
- Understand internal behavior that types don't reveal
- Debug unexpected library behavior
- Learn patterns from well-known implementations
- Verify how a function handles edge cases
Don't fetch source for simple API usage questions that docs or types can answer.
Related Skills
remorses/npm-package
development
VerifiedTrustedCommunity
Opinionated TypeScript npm package template for ESM packages. Enforces src→dist builds with tsc, strict TypeScript defaults, explicit exports, and publish-safe package metadata. Use this when creating or updating any npm package in this repo.
1,138SKILL.mdUpdated Apr 25, 2026
remorses/new-skill
documentation
VerifiedTrustedCommunity
Best practices for creating a SKILL.md file. Covers file structure, frontmatter, writing style, and where to place skills in a repository. Use when the user wants to create a new skill, update an existing skill, write a SKILL.md, or asks how skills work.
1,130SKILL.mdUpdated Apr 25, 2026
remorses/new-skill
documentation
VerifiedTrustedCommunity
Best practices for creating a SKILL.md file. Covers file structure, frontmatter, writing style, and where to place skills in a repository. Use when the user wants to create a new skill, update an existing skill, write a SKILL.md, or asks how skills work.
1,087SKILL.mdUpdated Apr 19, 2026
remorses/zustand-centralized-state
tools
VerifiedTrustedCommunity
Centralized state management pattern using Zustand vanilla stores. One immutable state atom, functional transitions via setState(), and a single subscribe() for all reactive side effects. Based on Rich Hickey's "Simple Made Easy" principles: prefer values over mutable state, derive instead of cache, centralize transitions, and push side effects to the edges. Resource co-location in the same store is also valid when lifecycle management is safer that way. Also covers state encapsulation: keeping state local to its owner (closures, plugins, factory functions) so it doesn't leak across the app, reducing the blast radius of mutations. Also covers event sourcing: keeping a bounded event buffer and deriving state with pure functions instead of mutable flags, making event handlers easy to test and reason about. Use this skill when building any stateful TypeScript application (servers, extensions, CLIs, relays) to keep state simple, testable, and easy to reason about. ALWAYS read this skill when a project uses zustand/vanilla for state management outside of React.
1,052SKILL.mdUpdated Apr 25, 2026