opensource-pipeline

Fork, sanitize, and package private projects for safe public open-source release.

Updated Mar 18, 2026
One-click install
npx skills add https://github.com/freedom909/real-estate-saas --skill opensource-pipeline-freedom909
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: opensource-pipeline
Source: https://github.com/freedom909/real-estate-saas/tree/main/.trae/skills/opensource-pipeline
Command: npx skills add https://github.com/freedom909/real-estate-saas --skill opensource-pipeline-freedom909

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Releasing a private project publicly risks leaking secrets, credentials, PII, and internal references. This Skill automates a three-stage pipeline that forks the project, verifies it is clean, and generates all the packaging files needed for a public GitHub release. ## Core Features & Use Cases - Secret Stripping Fork: Copies the project while excluding .git, node_modules, and virtual environments, strips credentials, and generates a .env.example file. - Sanitization Verification: Runs six scan categories (secrets, PII, internal references, dangerous files, configuration completeness, git history) and produces a PASS/FAIL report, with up to three automatic fix-and-rescan retries. - Release Packaging: Generates CLAUDE.md, an executable setup.sh, README.md, LICENSE, CONTRIBUTING.md, and GitHub issue templates, then optionally publishes via the gh CLI only after explicit user approval. - Use Case: You have a private SaaS repo you want to open source. Run the fork command, review the sanitization report, and publish a clean public repository with complete documentation in one workflow. ## Quick Start Ask the AI to open source this project by running /opensource fork on your project directory and choosing an MIT license.

Frequently Asked Questions about opensource-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely open source a private project?▼

Run the fork command, which copies the project to a staging directory, strips secrets and credentials, verifies cleanliness with a sanitizer, and generates packaging files. Publishing to GitHub only happens after your explicit approval.

How to remove secrets from a repo before making it public?▼

The forker stage strips all secrets and credentials, replaces internal references with placeholders, and generates a .env.example file. The sanitizer then re-scans for secrets, PII, and dangerous files like .env, *.pem, and credentials.json to confirm nothing remains.

What happens if the sanitization scan fails?▼

A FAIL verdict shows all findings and asks whether to fix and re-scan or abort. Fixes are applied automatically with up to three retry attempts; after three failures, findings are presented for manual correction.

Does the pipeline push to GitHub automatically?▼

No. Publishing requires explicit user approval. After the final review, the pipeline uses gh repo create with the --public flag only when you confirm, and it never skips the sanitizer safety gate.

Can I run only the sanitizer or packager without the full pipeline?▼

Yes. The verify command runs the sanitizer independently on any path, and the package command runs the packager alone after asking for a license and description. The list and status commands show staged project progress.