360 Secure SkillHub
360 安全技能中心

find-reuse

面向显式复用调研请求,先读取请求与适配器契约,检测仓库清单和导入,再在适用的代码托管与包注册表检索候选项;对比需求匹配、集成成本、来源、许可证、维护、采用及安全证据,输出只读 Markdown 报告,缺少工具或认证时标记覆盖缺口。

shkarupa-alex
热度 0.00
最近更新 2026-10-19 06:55:52
分类:搜索依赖:代码执行 / 读写文件 / 第三方 API应用场景:研究 / 报告撰写 / 推荐

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add shkarupa-alex/meta-o/find-reuse
Metadata
name
find-reuse
description
Produce a portable, read-only evidence report about whether to reuse, extend, or build. Run only for an explicit reuse-research request; do not trigger for ordinary package questions.
license
MIT
metadata
{"source_tree":"d4a266eb3e6a2f21eac43154571b7df95d8d2b1b"}

Find reusable solutions

This skill is a portable report producer. It knows no caller-specific paths, feature lifecycle, destination document or commit policy. It never writes repository files, installs tools, logs in, or asks for credential values.

Read Request and report contracts and Source adapter contract completely before searching.

Input

Accept only a Markdown request whose YAML block declares contract: find-reuse.request.v1. Reject an absent or unknown contract before searching. Preserve every business requirement id and priority.

Search

  1. Detect applicable surfaces from the request, repository remotes, manifests, lockfiles and imports. A named private source remains applicable when auth is missing.
  2. Probe each required tool and exact capability before use. Give OS-aware install or login help when unavailable, but do not install or authenticate.
  3. Run commands as argument arrays. Never interpolate a query into a shell string. Record errors as coverage gaps, not empty results.
  4. Perform required discovery on every applicable surface, then enrich each finalist from its source host and registry when both exist.
  5. Merge identities only with authoritative package metadata or repository-owned evidence. Keep forks, mirrors and monorepo members distinct.
  6. Compare requirements, integration cost, provenance, license, maintenance, adoption and security evidence. Preserve source, observation time and metric window; never compare popularity numbers across ecosystems as one scale.

For a new component without a fixed ecosystem, search GitHub and GitLab plus registries for the two most suitable allowed stacks and record the rationale.

Output

Return one complete find-reuse.report.v1 Markdown document and nothing that claims repository mutation. Include every required section and every applicable surface, including failures and unknowns.

build is allowed only with coverage: complete. If any required tool, auth, source or enrichment is unavailable, return status: unknown and coverage: partial|blocked. A genuine empty result is evidence only after a successful operation.

This skill does not decide where the report is saved or whether implementation may proceed after unknown; those decisions belong to its caller.