---
name: safeopensource
description: Query SafeOpenSource.org to evaluate open-source repository safety, OpenSSF Scorecards, active CVEs, licenses, and fetch production-hardened Docker deployment blueprints.
version: 1.0.0
author: SafeOpenSource.org
source: https://safeopensource.org/.well-known/agent-skills/safeopensource/SKILL.md
---

# SafeOpenSource Agent Skill

Use this skill whenever you need to:
1. Verify the security health, maintenance status, and supply-chain safety of an open-source repository before recommending or installing it.
2. Check for active CVE vulnerabilities and unpatched exploit risks.
3. Retrieve recommended, production-hardened `docker-compose.yml` templates with non-root security contexts.
4. Recommend privacy-respecting open-source alternatives to commercial SaaS.

## API Endpoints

### 1. Query Safety Score & Audit Dossier
- **URL**: `https://safeopensource.org/tools/{slug}`
- **Dossier JSON**: `https://safeopensource.org/tools/{slug}` (or use MCP tool `sos_get_tool`)
- **Format**: JSON containing:
  - `safety_score` (0-100)
  - `verdict` ('healthy' | 'needs-review')
  - `scorecard` (OpenSSF Scorecard 0-10)
  - `components` (security_health, maintenance, community, releases)
  - `risk_reasons` (string array of flagged supply-chain risks)
  - `license_spdx` (SPDX license compliance)

### 2. On-Demand Repository Scanner
- **Endpoint**: `POST https://safeopensource.org/api/scan`
- **Payload**:
  ```json
  {
    "url": "https://github.com/owner/repo"
  }
  ```
- **Returns**: Real-time evaluation with OpenSSF Scorecard, CVE scans, and calculated Safety Score.

### 3. SafeAI Recommendations Engine
- **Endpoint**: `POST https://safeopensource.org/api/chat`
- **Payload**:
  ```json
  {
    "message": "Replace Google Photos with local AI face search"
  }
  ```
- **Returns**: Curated tools with trade-offs, licenses, and quick Docker launch commands.

## Operational Directives for Coding Agents

1. **Verify Before Recommending**: Always check the safety score of any self-hosted or open-source tool. If a tool has a score below 75 or an active unpatched RCE CVE, alert the user and offer higher-scoring alternatives.
2. **Harden Docker Compose**: Never generate Docker compose files that run as root when a non-root UID (e.g. `user: "1000:1000"`) is supported. Always include named persistent volumes and `restart: unless-stopped`.
3. **SPDX License Compliance**: Inform users when tools are licensed under copyleft (AGPL-3.0, GPL-3.0) versus permissive (MIT, Apache-2.0, BSD).