Open Source Hardening Skills

English | 中文

Open Source Hardening Skills is a skill pack for ARIS / Claude Code that hardens any repository - app, library, CLI tool, or research paper codebase - into a readable, testable, maintainable open-source project.

Pairs naturally with ARIS. ARIS (v0.3+) is a multi-IDE autonomous research ecosystem with 31+ skills supporting Claude Code, Codex CLI, Cursor, Trae, and more. Open Source Hardening Skills is the next step that gets the resulting code ready for public release.

Workflow

[ARIS research pipeline]           [Open Source Hardening Skills pipeline]
  /idea-discovery                    /oss-audit        -> scan for gaps
  /auto-review-loop    ------>       /oss-plan         -> make a checklist
  /paper-writing                     /oss-refactor     -> minimal cleanup
  (code exists)                      /oss-tests        -> add CI-safe tests
                                     /oss-ci           -> block bad PRs
                                     /oss-docs         -> polish docs
                                     /oss-review-loop  -> external quality gate
                                     (repo is release-ready)

Open Source Hardening Skills also works standalone on any existing repository - no ARIS required.

Skills

Install

1. Install and initialize Claude Code

Install Claude Code first, then open it once to finish login and create ~/.claude/:

# macOS / Linux / WSL
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

cd your-project
claude

2. Install the skills

macOS / Linux / WSL (one-liner):

curl -fsSL https://raw.githubusercontent.com/zeyuzhangzyz/open-source-hardening-skills/main/install.sh | bash

Or clone and run manually:

git clone https://github.com/zeyuzhangzyz/open-source-hardening-skills.git
cd open-source-hardening-skills
bash install.sh

Windows PowerShell (one-liner):

irm https://raw.githubusercontent.com/zeyuzhangzyz/open-source-hardening-skills/main/install.ps1 | iex

Or clone and run manually:

git clone https://github.com/zeyuzhangzyz/open-source-hardening-skills.git
cd open-source-hardening-skills
.\install.ps1

The install scripts are idempotent: re-running them updates the skills to the latest version. They only replace this pack's own oss-* skill directories and never touch other skills you may have installed.

3. Optional: set up Codex for review skills

/oss-review and /oss-review-loop call the external reviewer via the official Codex MCP tools (mcp__codex__codex, mcp__codex__codex-reply). The other 8 skills work without it.

npm install -g @openai/codex
codex setup   # set model to gpt-5.4 when prompted
claude mcp add codex -s user -- codex mcp-server

Tip: ARIS v0.3+ also ships alternative review bridges (Claude, Gemini, any OpenAI-compatible API). If you already have one configured, /oss-review will use whichever Codex MCP endpoint is available.

4. Run in your target repository

/oss-hardening .

After a full run, the pipeline generates these artifacts in your repo root:

OSS_AUDIT.md             <- gap analysis across 7 dimensions
OSS_PLAN.md              <- PR-ready checklist with acceptance criteria
OSS_REFACTOR.md          <- summary of structural changes applied
OSS_TEST_STRATEGY.md     <- test framework, commands, and mock strategy
OSS_CI.md                <- CI workflow documentation
OSS_DOCS.md              <- documentation improvement checklist
OSS_REVIEW_LOOP.md       <- iterative review log with scores per round
OSS_HARDENING_STATUS.md  <- final verdict, score, and next steps

Use with ARIS

Open Source Hardening Skills installs to the same ~/.claude/skills/ directory as ARIS and works alongside ARIS skills without conflicts. Compatible with ARIS v0.3+ and ARIS-Code CLI.

# After an ARIS research run, harden the resulting code:
/oss-hardening .

Repository Layout

skills/              ARIS-compatible skill files (one subdirectory per skill)
  oss-audit/SKILL.md
  oss-plan/SKILL.md
  ...
tests/               skill validation tests

Project Standards

• SECURITY.md describes how to report vulnerabilities privately.
• CHANGELOG.md tracks release-facing changes.
• CONTRIBUTING.md explains how to edit skills and validate the repo locally.
• .github/workflows/ci.yml runs the validation suite on every push and pull request.

Contributing

See CONTRIBUTING.md. For the quick version: edit skills/<name>/SKILL.md, then run the validation suite from the repository root:

python -m unittest discover -s tests -v

Open a PR when done. Each skill directory name must match the name field in the frontmatter.

Acknowledgements

• ARIS - multi-IDE autonomous research ecosystem (31+ skills, Claude Code / Codex CLI / Cursor / Trae) that this project is designed to complement; the skill layout follows ARIS conventions directly.
• Claude Code - Anthropic's CLI, the execution backbone.

License

MIT. See LICENSE.