oss-contributor-onboarding skill (samber): audit and fix the path to a first merged pull request

• Asks twelve questions one at a time; questions 1 to 7 gate the work.

  Questions 4 to 6 (hours per week, deadline, one wave or lasting path) re-rank the fixes and can delete the structured program.

  Interview

• Prints mechanical facts about the first-contribution path.

  Community-health files and their precedence, a keyword probe of CONTRIBUTING for ten topics, setup files and lockfiles, workflows using secrets or pull_request_target, and git history (authors, one-commit-only rate, absence factor, new authors per year). It writes a temporary author-email file in /tmp and deletes it at the end.

  Runs code · scripts/contributor-path-audit.sh <repo-root>

• Runs a cold run of the written steps from a clean state and keeps a friction log.

  The scorecard reference says to use a fresh container, a new user account or a machine that never built the project, run the written steps literally, and rerun until nothing new appears.

  Runs code · Step 2 - Walk the path yourself

• Picks a reproducibility tier: bootstrap command, pinned toolchain or container definition.

  It also asks for every CI gate to be runnable locally and a credential-free lane for fork pull requests.

  Write · Step 3 - Fix the environment first

• Rewrites candidate issues with seven parts, including a verify command and a mentor.

  It sizes each issue at roughly one evening and keeps at least three unclaimed valid issues.

  Step 4 - Stock the first-issue queue

• Drafts the file section by section and keeps one copy where the forge shows it.

  Every command in the file must be one it ran in step 2 or 3.

  Write · Step 5 - Write CONTRIBUTING

• Designs eight habits, including acknowledging on a separate clock from reviewing.

  Scope answered in the first comment, a fixed review order, blocking versus optional labels, a fast kind decline, credit at merge and an invitation to the second contribution.

  Step 6 - Review and recognition loop

• Decides on a bot, a structured program or an onboarding event, then re-scores.

  Pass means all four blocking checks and 12 of 16 scored points. The re-check repeats quarterly, installed as a recurring task if the environment supports scheduled routines.

  Step 7 and 8 - Shortcuts, then re-score

Watch out for

• It runs your project's setup and test commands

  The cold run follows your README and CONTRIBUTING literally in a clean environment and records failures. Our advice: use a container or a new user account and read each command before it runs. github.com

• The audit script touches /tmp and reads author emails

  The script writes commit author emails to a temporary file named .cpa_authors.<pid> in /tmp and removes it with rm -f at the end. It prints counts, not the emails. github.com

• It can install a recurring re-check

  Step 8 says to install the quarterly re-check as a recurring task where the environment supports scheduled routines. Our advice: say no if you do not want a scheduled job. github.com

• The Claude app route is left out of the install box

  The skill reads and runs things in a repository on your machine, so the install box has no Claude app upload tab for it. github.com

• It may keep notes in devrel-context.md

  SKILL.md tells the agent to store a few details about the current task or project, and to use a file called devrel-context.md when its memory lives in a file. Our advice: open that file before you commit or share the folder. github.com

• The plugin route installs the whole collection

  The README's plugin and extension routes add every skill in the repo; its git tree holds 93. The repo has no hooks, agents, commands or MCP server files, and 14 of its skills bundle a script. Our advice: use the skills CLI command for this skill if you want only it. github.com

Security advisories