AI Agents OSS Helper

Commands & workflows reference

GitHub Install Releases

The OSS Helper gives AI coding agents guidelines for contributing to open source projects. With a skill-capable agent, invoke a command directly (e.g. /oss-fix-issue) or just describe what you want. See the README for installation and rule setup.

Commands 37

Grouped by the skill that provides them. Arguments shown in the examples are illustrative.

oss-issues 9

Issue management for open source projects.

/oss-fix-issue

Takes an issue from the project's tracker through to a pull request: parses the reference, branches with the project's naming convention, implements the fix (delegating to a coding agent when one is available), and opens the PR.

/oss-fix-issue 42
/oss-fix-issue https://github.com/org/repo/issues/42
/oss-fix-issue 42 sign=none build=full

oss-issues · fix-issue.md

/oss-analyze-issue

Investigates an issue without changing code: reproduces the problem, locates the relevant code, and reports the findings and a suggested approach.

/oss-analyze-issue 42
/oss-analyze-issue https://github.com/org/repo/issues/42

oss-issues · analyze-issue.md

/oss-create-issue

Creates a new issue in the project's tracker (GitHub or Jira), gathering the title, type and details and confirming before filing.

/oss-create-issue
/oss-create-issue flaky timeout in the connection-pool test

oss-issues · create-issue.md

/oss-list-issues

Lists the issues currently assigned to you in the project's tracker.

/oss-list-issues

oss-issues · list-issues.md

/oss-find-task

Finds an issue to contribute to, matched to an experience level through the project's task labels (e.g. good first issue, help wanted).

/oss-find-task
/oss-find-task beginner

oss-issues · find-task.md

/oss-fix-backlog-task

Fixes a task tracked in a Backlog.md file (requires the Backlog MCP server). The backlog repository path is mandatory and is never assumed.

/oss-fix-backlog-task TASK-001 repo=../my-backlog

oss-issues · fix-backlog-task.md

/oss-triage-issue

Maintainer-side triage of a filed issue: assesses validity, scope and labels and recommends next steps.

/oss-triage-issue 42

oss-issues · oss-triage-issue.md

/oss-create-multi-repo-issue

Creates linked issues across several repositories for a change that spans more than one repo, cross-referencing them.

/oss-create-multi-repo-issue

oss-issues · oss-create-multi-repo-issue.md

/oss-fix-multi-repo-issue

Fixes an issue whose work spans multiple repositories, coordinating branches and PRs across them from one canonical issue.

/oss-fix-multi-repo-issue org/repo#42

oss-issues · oss-fix-multi-repo-issue.md

oss-review 8

Pull request management for open source projects.

/oss-review-pr

Reviews a pull request against the project's rules and contribution standards, reporting findings constructively.

/oss-review-pr 138
/oss-review-pr https://github.com/org/repo/pull/138

oss-review · review-pr.md

/oss-address-review

Addresses the review feedback on one of your pull requests, applying the changes and replying to the comments.

/oss-address-review 138

oss-review · address-review.md

/oss-review-prs

Reviews a batch of the repository's open PRs in one pass, summarising each.

/oss-review-prs

oss-review · oss-review-prs.md

/oss-pr-status

Reports a PR's CI checks, review state and merge readiness; defaults to the PR for the current branch when none is given.

/oss-pr-status 138
/oss-pr-status

oss-review · pr-status.md

/oss-list-pr-status

Lists all your open PRs with a CI / review / merge-readiness summary for each.

/oss-list-pr-status

oss-review · list-pr-status.md

/oss-list-prs

Lists all open PRs in the repository for browsing and review selection.

/oss-list-prs

oss-review · list-prs.md

/oss-merge-pr

Merges a PR after verifying CI is green, discussions are resolved and approvals are met; squash-merges and deletes the branch.

/oss-merge-pr 138

oss-review · merge-pr.md

/oss-backport-pr

Cherry-picks a merged PR onto a maintenance/release branch. The target branch is required; the remote defaults to origin.

/oss-backport-pr 138 branch=1.x
/oss-backport-pr 138 branch=1.x remote=upstream

oss-review · backport-pr.md

oss-ci 4

CI/CD and code quality for open source projects.

/oss-fix-ci-errors

Downloads a failed CI run's reports, identifies the errors and fixes them; defaults to the latest failed run when no run id is given.

/oss-fix-ci-errors
/oss-fix-ci-errors 1234567890

oss-ci · fix-ci-errors.md

/oss-fix-sonarcloud

Fixes SonarCloud issues for a given rule using the project's component key; can target a specific branch.

/oss-fix-sonarcloud java:S1118
/oss-fix-sonarcloud S1192 branch=fix/sonar

oss-ci · fix-sonarcloud.md

/oss-fix-github-alert

Fixes a GitHub security or quality alert of a given type: code-scanning, dependabot or secret-scanning.

/oss-fix-github-alert dependabot
/oss-fix-github-alert code-scanning limit=5

oss-ci · fix-github-alert.md

/oss-quick-fix

Applies a quick fix with no tracked issue (CI tweak, docs, dependency bump, ...), using the quick-fix branch and commit convention.

/oss-quick-fix bump actions/checkout to v6
/oss-quick-fix fix a typo in the README

oss-ci · quick-fix.md

oss-security 7

Security management for open source projects.

/oss-triage-security-report

Triages an inbound security vulnerability report: assesses validity and scope and recommends a verdict.

/oss-triage-security-report ./report.txt

oss-security · triage-security-report.md

/oss-security-case

Drives one security report end to end (triage, reporter reply, CVE reservation, sanitized issue, fix, backports and CVE draft), stopping at every maintainer gate. Runs as a Claude Code workflow (see Workflows below).

/oss-security-case xml-entities report=./report.txt
/oss-security-case xml-entities verdict=VALID approve=issue

oss-security · security-case.md

/oss-analyze-third-party-cve

Analyses the project's exposure to a CVE in a third-party dependency: checks the affected version ranges and maps the vulnerable APIs to actual project usage.

/oss-analyze-third-party-cve CVE-2025-12345

oss-security · analyze-third-party-cve.md

/oss-draft-cve

Drafts a project-specific CVE advisory page plus the matching CVE Record Format JSON, mirroring a template. The CVE id and template are required.

/oss-draft-cve CVE-2026-12345 template=./advisory-template.md
/oss-draft-cve CVE-2026-12345 template=<url> fix_pr=138

oss-security · draft-cve.md

/oss-create-security-advisory

Opens a private GitHub security advisory (GHSA) to report a vulnerability, guiding through the required fields.

/oss-create-security-advisory

oss-security · create-security-advisory.md

/oss-update-gh-advisory-db

Populates GitHub Advisory Database entries for the project's already-published CVEs.

/oss-update-gh-advisory-db
/oss-update-gh-advisory-db CVE-2025-12345

oss-security · update-gh-advisory-db.md

/oss-security-scan

Scans the codebase for security vulnerabilities and reports findings; can be narrowed to a path.

/oss-security-scan
/oss-security-scan src/main/java

oss-security · oss-security-scan.md

oss-project 6

Project setup and workspace management for open source projects.

/oss-add-project

Adds a new project to the OSS Helper by generating its rule files from a name and a short description.

/oss-add-project wanaku a Java MCP router built on Quarkus

oss-project · add-project.md

/oss-install-info

Installs a project's rule files from the known-projects repository for the current repo.

/oss-install-info

oss-project · install-info.md

/oss-create-rules

Generates project rule files by auto-inspecting a repository (build tool, conventions, trackers).

/oss-create-rules org/repo
/oss-create-rules https://github.com/org/repo

oss-project · oss-create-rules.md

/oss-update-knowledge

Updates a project's rule files from a URL (such as a CONTRIBUTING page) or a free-text description of its conventions.

/oss-update-knowledge https://github.com/org/repo/blob/main/CONTRIBUTING.md
/oss-update-knowledge squash-merge only, build with Maven

oss-project · update-knowledge.md

/oss-workspace-init

Initialises a multi-repo workspace so the helper can operate across several related repositories.

/oss-workspace-init

oss-project · oss-workspace-init.md

/oss-workspace-status

Reports the status of every repository in the workspace (branch, local changes, sync state).

/oss-workspace-status

oss-project · oss-workspace-status.md

oss-qe 3

Quality engineering and test management for open source projects.

/oss-qe-create-test-plan

Creates a test plan for a project feature or component, written to <name>.md; optional guidance scopes it.

/oss-qe-create-test-plan operator-basic-tests
/oss-qe-create-test-plan connector-smoke focus on error paths

oss-qe · oss-qe-create-test-plan.md

/oss-qe-verify

Executes an existing test plan and tracks results; accepts a plan name or a file path, plus optional phase guidance.

/oss-qe-verify operator-basic-tests
/oss-qe-verify ./plans/connector-smoke.md

oss-qe · oss-qe-verify.md

/oss-qe-module-audit

Deep-audits a module family for bugs, antipatterns, inconsistencies, missing features and new ideas.

/oss-qe-module-audit camel-kafka
/oss-qe-module-audit the connector modules

oss-qe · oss-qe-module-audit.md

Workflows

Multi-step orchestrations (Claude Code); other agents follow the same guideline by hand.

/oss-security-case

OSS Helper: advance one security report through triage, reporter reply, CVE reservation, sanitized issue, fix, backports and CVE draft, stopping at every maintainer gate

/oss-security-case xml-entities report=./report.txt
/oss-security-case xml-entities verdict=VALID approve=issue,pr
/oss-security-case xml-entities status

When to use: Invoked by the /oss-security-case command (oss-security skill, security-case.md). New report: args.case plus args.report (a file) or args.threads (mail-archive thread ids). Existing case: args.case plus the maintainer decisions or approvals. args.mode "plan" tests the routing without agents; "status" only refreshes STATUS.md.

Phases

  1. Load — resolve the project rules and operator config, read the case, refresh PR, issue and CVE facts
  2. Triage — triage-security-report.md, then a two-lens verdict challenge
  3. Drafts — reporter reply, CVE reservation fields, sanitized issue; nothing is sent
  4. Act — approved issue, final reply, fix-issue.md in a worktree, approved PR
  5. Backport — backport-pr.md per supported line once the main PR merges, plus the upgrade-note sync
  6. CVE — draft-cve.md once the CVE is reserved and the fixed versions are released
  7. Persist — node files, decisions.json, STATUS.md, mail-archive state