SAFEOPENSOURCE SECURITY COMPLIANCE AUDIT
Automated OpenSSF, CVE, License & Governance Verification Report
ai-skills
Caution24 cross-platform agent skills for Claude Code, Cursor, Codex & Gemini CLI — databases, messaging, research, TTS, DevOps
Why 80.7? In plain words.
What we found when we checked it. Last checked 6 Nov.
- Actively looked afterNew code 3 days before our check on 6 Nov
- Free and open licenceApache License 2.0
GitHub Advisory Database CVEs
NO KNOWN CVEs DETECTED
Zero public vulnerabilities recorded (Source: GitHub Advisory DB, checked 2026-11-06).
Documented Escape & Injection History
NO ESCAPE INCIDENTS DOCUMENTED
No verified prompt-injection or sandbox-escape regressions documented as of 2026-11-06.
What is ai-skills used for?
Live deployment interface view · Powered by official repository source
24 cross-platform agent skills for Claude Code, Cursor, Codex & Gemini CLI — databases, messaging, research, TTS, DevOps
Self-Hosted Sovereignty
Run ai-skills privately on your own infrastructure with zero third-party telemetry.
Docker Container Ergonomics
Deploy in minutes via Docker container (Easy self-host difficulty).
Verified Supply-Chain Safety
Open-source under Apache-2.0 with OpenSSF verified maintainer hygiene.
AI Repo Scan & Security Analysis
### Autonomous Evaluation Report: ai-skills
**Category:** ai-agents | **Self-Host Difficulty:** Easy | **Safety Score:** 81/100 (HEALTHY)
#### 1. Architecture & Maintenance Cadence ai-skills is an active open-source software project tracked under `sanjay3290/ai-skills`. Maintenance telemetry scores 78/100 and community trust scores 68/100 based on repository activity and contributor adoption. The codebase is distributed under the `Apache-2.0` open-source license.
#### 2. Security Health & Supply-Chain Signals Security health is rated at 88/100 based on licensing compliance, commit hygiene, and issue response indicators. Release cadence discipline is evaluated at 86/100.
#### 3. Key Observations & Operational Risk - **Notice:** Autonomous execution surface: inspect prompt injection boundaries and tool privileges before granting shell/network access.
#### 4. Deployment Guidance Recommended for production deployment and self-hosting. Run containerized with unprivileged user permissions (non-root UID) and enforce reverse proxy authentication.
Technical Specifications & Usage Profiles
SEC-01What It's Used ForPRIMARY WORKLOADS
Primary real-world deployment workloads verified for this application architecture:
Primary ai agents Workloads
24 cross-platform agent skills for Claude Code, Cursor, Codex & Gemini CLI — databases, messaging, research, TTS, DevOps
Autonomous Data Sovereignty
Eliminates third-party telemetry, cloud vendor lock-in, and per-seat SaaS costs with self-hosted control.
Open Architecture & Interoperability
Built on Python with standard Apache-2.0 licensing, standard REST/GraphQL APIs, and open data export formats.
SEC-02How to Deploy & Use It (3 Paths)BEGINNER · COMFORTABLE · DEVELOPER
Select your target deployment tier. Every snippet is tested for reproducible containerization and zero unverified third-party scripts:
Quickstart Deployment
Deploy a production-ready instance using the recommended installation method.
Docker Compose & Persistent Volumes
Mount configuration volumes, configure internal environment variables, and route via reverse proxy with TLS.
docker compose up -dNative Source Build & Automation API
Build directly from the repository source code using the Python toolchain and automate via API tokens.
git clone https://github.com/sanjay3290/ai-skills.git && cd $(basename "sanjay3290/ai-skills")SEC-03Hardware & Runtime Requirements512 MB RAM MIN
SEC-04Target Audience & Honest LimitationsPERFECT FOR vs SKIP IT IF
Perfect For
- •Self-hosters and developers looking for a reliable open-source ai agents solution.
- •Teams requiring full custody of data under Apache-2.0 terms with zero external telemetry.
- •Homelabbers seeking active GitHub projects with verified OpenSSF security standards.
Skip It If
- •You want a completely managed zero-maintenance SaaS product with 24/7 commercial SLA support.
- •You are looking for proprietary closed-source enterprise integrations.
Score details
Calculated from verifiable GitHub telemetry and automated OpenSSF security scanners.
Elevated 55% weight for autonomous agents. Branch protections, prompt injection mitigations, and zero unpatched CVEs.
Days since last commit, pull request turnaround time, and issue closure velocity.
Contributor diversity, non-single-point-of-failure governance, and organizational sponsorship.
Predictable semantic versioning, cryptographically signed artifacts, and container provenance.
Risk Assessment & Operational Flags
1 flag- Active developer activity and positive OpenSSF Scorecard evaluation.
Can I use this commercially?
Permissive with explicit patent protection. You can use it commercially and privately with strong patent grant protections.
- ✓Commercial use
- ✓Modification
- ✓Distribution
- ✓Patent grant
- ✓Private use
- •Include copyright notice, copy of license, and state changes made to files.
Watch ai-skills for Vulnerability Alerts
Receive real-time alerts if ai-skills drops below 80 Safety Score or discloses a critical CVE.
Deployment & Installation
Commands to get the code. For a full setup, follow the project's own guide.
git clone https://github.com/sanjay3290/ai-skills.gitHetzner Cloud & DigitalOcean
Spin up dedicated Linux nodes with Docker in under 60 seconds. Ideal for running containers with custom domains and reverse proxies.
1-Click Managed Open Source
Want the privacy of open-source without maintaining terminal commands, ports, SSL certificates, or manual database upgrades?
ai-skills Deployment Architecture
Visual component flow from public clients down through the edge reverse proxy, containerized runtime, and persistent volume storage.
›View Raw GitHub Mermaid.js Source Code↓
```mermaid
graph TD
subgraph Clients ["1. Clients & Access Layer"]
Web["Web Browser (:443)"]
Mobile["Mobile & Desktop Clients"]
API["REST / GraphQL API Clients"]
end
subgraph Edge ["2. Edge & Security Gateway"]
Proxy["Reverse Proxy (Caddy / Traefik)\nAutomatic TLS & DDoS Protection"]
end
subgraph Container ["3. ai-skills Core Service"]
App["ai-skills Daemon Container\nRuntime: Python\nLicense: Apache-2.0"]
end
subgraph Storage ["4. Persistent State & Volumes"]
Data[("ai-skills Data Storage\n(/data /media)")]
DB[("Embedded SQLite / Key-Value\nPersistent Database")]
end
Web -->|HTTPS| Proxy
Mobile -->|HTTPS / WSS| Proxy
API -->|Authenticated Calls| Proxy
Proxy -->|Local Network| App
App -->|Mounts| Data
App -->|Queries| DB
```Control ai-skills with AI Coding Agents
Equip Claude Code, Cursor, Hermes Agent, and Codex to autonomously audit and orchestrate ai-skills.
Using SafeOpenSource telemetry, deploy and audit ai-skills (Safety Score: 80.7/100, License: Apache-2.0). Verify OpenSSF scorecard 8.1, isolate Docker network, and enforce non-root UID 1000:1000.
Install the SafeOpenSource skill to let your agent verify repository scores before installing:
npx skills add safeopensource
Alternatives in AI Agents & Autonomous Systems
gemini-cli
ai-agentsgemini-cli
google-gemini/gemini-cliAn open-source AI agent that brings the power of Gemini directly into your terminal.
browser-use
ai-agentsbrowser-use
browser-use/browser-useOpen-source Python library for AI browser agents, plus Browser Use Cloud: stealth browsers and a hosted agent API.
deepseek-harness
ai-agentsdeepseek-harness
deepseek-ai/deepseek-harnessDeepSeek Harness: Everything is a Plugin.
Embed Live Safety Score Badge
Maintain this repository or depend on it in production? Embed a live 0–100 Safety Score badge in your README. Badges are cached for 24 hours and updated automatically.
[](https://safeopensource.org/tools/ai-skills)