Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c0d5c57

Browse files
kiyeonjeon21claude
kiyeonjeon21
and
claude
committed
Add standard OSS repo files
- CODE_OF_CONDUCT.md — Contributor Covenant 2.1 adoption - SECURITY.md — private GHSA advisory flow + scope - .github/workflows/ci.yml — typecheck + build on push / PR, Node 20 & 22 - .github/ISSUE_TEMPLATE/skill_request.md — separate from connector_request; scoped to "MCP server I want a skill for" Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
1 parent db85246 commit c0d5c57

4 files changed

Lines changed: 143 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/skill_request.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
name: Skill request
3+
about: Propose a skill for a specific MCP server (Notion, Linear, Slack, Gmail, ...)
4+
labels: skill
5+
---
6+
7+
## MCP server
8+
9+
<!-- Name + install command of the MCP server. Link to its repo if possible. -->
10+
11+
Example: `@anthropic/notion-mcp` — `npx -y @anthropic/notion-mcp`
12+
13+
## What the skill should extract
14+
15+
<!-- Which MCP tools get called, and how their results map to graph shape. -->
16+
17+
- Tools to call:
18+
- `list_databases` → ?
19+
- `query_database` → one event per page?
20+
- Entities to emit:
21+
- `person` for page authors?
22+
- `concept` for tags?
23+
- Relations:
24+
- `involves` from page event → author person?
25+
26+
## Auth model
27+
28+
- [ ] Public / keyless
29+
- [ ] API key (single env var)
30+
- [ ] OAuth flow (requires `requiredEnv` + external login)
31+
- [ ] Local export file
32+
33+
## Willing to contribute?
34+
35+
- [ ] I can write the skill
36+
- [ ] I can test against real data once someone else writes it
37+
- [ ] Just filing the request
38+
39+
## Related
40+
41+
<!-- Existing skill files in examples/skills/ that would inform this one,
42+
or issues with similar shape. -->

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
jobs:
9+
build:
10+
runs-on: ubuntu-latest
11+
strategy:
12+
matrix:
13+
node: [20, 22]
14+
steps:
15+
- uses: actions/checkout@v4
16+
- uses: actions/setup-node@v4
17+
with:
18+
node-version: ${{ matrix.node }}
19+
cache: npm
20+
- run: npm ci
21+
- run: npm run typecheck
22+
- run: npm run build
23+
- name: CLI smoke test
24+
run: |
25+
node dist/index.js --version
26+
node dist/index.js --help

‎CODE_OF_CONDUCT.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Code of Conduct
2+
3+
## Our pledge
4+
5+
We pledge to make participation in the contextix community a welcoming, harassment-free experience for everyone — regardless of experience level, background, identity, or expression.
6+
7+
## Our standards
8+
9+
Behavior that helps:
10+
- Assume good intent when reading others' words
11+
- Keep critique on the idea / code, not the person
12+
- Accept constructive feedback gracefully
13+
- Ask questions in public channels — someone else probably has the same one
14+
- Credit others' work
15+
16+
Behavior that doesn't belong here:
17+
- Personal attacks, insults, or political / identity-based hostility
18+
- Public or private harassment
19+
- Publishing others' private information without explicit consent
20+
- Sexualized language or imagery
21+
- Conduct which could reasonably be considered inappropriate in a professional setting
22+
23+
## Scope
24+
25+
This applies to all project spaces — repo, issues, pull requests, Discussions, any official Discord/Slack — and to public spaces when an individual is representing contextix.
26+
27+
## Enforcement
28+
29+
Report abusive, harassing, or otherwise unacceptable behavior to the maintainers at the email listed on the [npm package](https://www.npmjs.com/package/contextix) or by opening a private GitHub security advisory. All reports are reviewed and investigated promptly and confidentially.
30+
31+
Maintainers who do not follow or enforce this code in good faith may face temporary or permanent consequences as determined by other maintainers.
32+
33+
## Attribution
34+
35+
Adapted from the [Contributor Covenant](https://www.contributor-covenant.org) v2.1.

‎SECURITY.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Security policy
2+
3+
## Supported versions
4+
5+
The latest `0.x.y` release on npm receives security fixes. Older minor versions do not.
6+
7+
## Reporting a vulnerability
8+
9+
Please do **not** open a public issue for security-sensitive reports.
10+
11+
Use GitHub's private security advisory flow:
12+
1. Go to https://github.com/vericontext/contextix/security/advisories/new
13+
2. Describe the issue, the affected version, and a proof-of-concept if you have one
14+
3. Maintainers respond within 7 days
15+
16+
If you can't use GitHub advisories, email the maintainer listed on the [npm package page](https://www.npmjs.com/package/contextix).
17+
18+
## Scope
19+
20+
Security issues of interest:
21+
- **Code execution** — a crafted skill file, source fetch, or MCP server response causes unintended code execution on the host
22+
- **Data exfiltration** — extractor / ingest path leaks `ANTHROPIC_API_KEY` or other env values into emitted graph content, logs, or outbound requests
23+
- **Path traversal** — `ingest markdown` or similar reads outside the intended directory
24+
- **Supply chain** — a dependency update introduces a malicious change
25+
- **Denial of service** — adversarial input to any connector that locks up or exhausts memory on reasonable inputs
26+
27+
Out of scope:
28+
- Bugs in upstream MCP servers (report to their maintainers)
29+
- Misconfigured skill files that leak your own credentials — that's an authoring issue
30+
- Known issues already tracked in public advisories
31+
32+
## Disclosure process
33+
34+
1. You report privately
35+
2. We confirm the issue and assess severity
36+
3. We prepare a fix + a patch release
37+
4. We publish a public GHSA advisory crediting the reporter (opt-in)
38+
5. We push the fixed version to npm
39+
40+
Target timeline: **14 days** from report to fix for high / critical severity; longer for low / informational.

0 commit comments

Comments
 (0)