open-sourcing
This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a public launch. Provides a release-readiness workflow covering secrets hygiene, licensing, documentation, CI, and language-specific packaging.
npx skills add trailofbits/skills --skill open-sourcing --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Open-Sourcing a Repository Prepare a repository for public release so that an outsider with no prior context can build, use, and contribute to it — and so that nothing sensitive ships with it. Work through the steps in order; the secrets audit comes first because its outcome (keeping vs. recreating the repository) affects everything after it. ## When to Use - Making a private repository public - Auditing an existing public repository for release quality ("make it official") - Choosing a license for a project - Setting up packaging, versioning, or release automation ahead of a public launch ## When NOT to Use - Routine development on an already-released project (no release event) - Auditing third-party code for vulnerabilities (use a security-review skill) - Publishing a package from a repository that will stay private — only the release-management steps apply; skip the rest ## Workflow ### Step 1: Detect the organization profile ```sh bash {baseDir}/scripts/detect_org.sh ``` The script inspects git remotes and recent committer emails, and prints a profile name. If it prints `trailofbits`, read [references/trailofbits.md](references/trailofbits.md) now and apply its license policy
- When to Use
- When NOT to Use
- Workflow
- Step 1: Detect the organization profile
- Step 2: Audit for secrets — before anything else
- Step 3: Run the readiness check
- Step 4: Documentation
- Step 5: Licensing
- Step 6: Tests and CI
- Step 7: Repository settings
- Step 8: Releases and versioning
- Step 9: Language-specific practices
- Final Review
- Additional Resources
bash {baseDir}/scripts/detect_org.sh
bash {baseDir}/scripts/check_readiness.shWhat does the open-sourcing skill do?
This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a public launch. Provides a release-readiness workflow covering secrets hygiene, licensing, documentation, CI, and language-specific packaging.
How do I install it?
Run `npx skills add trailofbits/skills --skill open-sourcing --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.