Agent skill
open-source-project-templates
Production-ready templates for CONTRIBUTING.md, SECURITY.md, and GitHub issue forms. OpenSSF Best Practices Badge compliant, copy-paste ready, with realistic SLAs.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/build/skills/open-source-project-templates
SKILL.md
Open Source Project Templates
When to Use This Skill
Copy-paste templates for open source project documentation based on real OpenSSF Best Practices Badge certification work. CONTRIBUTING.md, SECURITY.md, and GitHub issue forms with realistic SLAs and proven compliance.
Source Material
These templates come from the readability project's OpenSSF certification (PRs #93, #94, #95).
Implementation
See the full implementation guide in the source documentation.
Key Principles
How these templates satisfy OpenSSF Badge criteria:
| Criterion | Template | Compliance |
|---|---|---|
| Documentation | CONTRIBUTING.md | ✅ Explains how to contribute |
| Bug Reporting | Bug Report template | ✅ Structured process |
| Enhancement Proposals | Feature Request template | ✅ Clear submission path |
| Security Process | SECURITY.md | ✅ Disclosure mechanism |
| Response Timelines | SECURITY.md SLAs | ✅ Realistic commitments |
| Testing Requirements | CONTRIBUTING.md | ✅ Coverage thresholds |
| Code Review | CONTRIBUTING.md PR process | ✅ Approval requirements |
Badge Checklist Mapping
✅ Contributing file: CONTRIBUTING.md with setup, testing, PR process
✅ Bug reporting: Issue templates with structured fields
✅ Enhancement proposals: Feature request template
✅ Security disclosure: SECURITY.md with private channel (Security Advisories)
✅ Security response: Documented SLAs (48hr initial, 7 day update, 90 day resolution)
Related Patterns
- OpenSSF Best Practices Badge in 2 Hours
- SLSA Provenance Implementation
- SBOM Generation
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?