oss-tool-trust-audit
Use when an open-source developer tool, package, CLI, agent, or MCP server must be evaluated for legitimacy, supply-chain risk, telemetry, dangerous capabilities, claim accuracy, and adoption fit.
Profile →npx skills add asimons81/hermes-field-kit --skill oss-tool-trust-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# oss-tool-trust-audit ## Overview An evidence-driven trust audit that reads source and release machinery, treats popularity as context rather than proof, and separates technical legitimacy from adoption fit. The skill is evidence-first. It identifies unavailable evidence, separates facts from interpretations, and does not claim a repair or successful outcome merely because a command returned with
What does the oss-tool-trust-audit skill do?
Use when an open-source developer tool, package, CLI, agent, or MCP server must be evaluated for legitimacy, supply-chain risk, telemetry, dangerous capabilities, claim accuracy, and adoption fit.
How do I install it?
Run `npx skills add asimons81/hermes-field-kit --skill oss-tool-trust-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asimons81/hermes-field-kit, a repository with 120 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.