Stop README-shopping. Start scoring the repos you actually trust. Most of us still pick open-source like restaurants. Stars. Nice README. Maybe a glance at the last commit. That friction is real, and it's how vibe-coded slop ends up in the stack. New classroom piece is live: Git Repo Security: Why It Matters, and How We Actually Do It https://www.skool.com/cliefnotes/classroom/c7f102c7?md=43a45577d5cb4096b040770491d87b50 Why this hits us: we pull public git constantly. Agents clone third-party skills. Volunteers don't have an AppSec team. Stars are a weak signal. The article folds OpenSSF / SLSA / CISA-style checks into two portable skills so the discipline gets cheap and repeatable. How you run it (newbie path) 1. Open the article and download the zip. 2. Drop the zip into your harness (Claude Code, Cursor, OpenCode, Grok, etc.). 3. Prompt the agent like a colleague: run repo-scorecard Egonex-AI/Understand-Anything (github username/repo) or run repo-eval Egonex-AI/Understand-Anything ============================================================= Here's what you get from repo-scorecard: Scorecard: Egonex-AI/Understand-Anything Score: 9.50 / 10.00 — healthy, well-run project What's good: • Actively worked on — last update was yesterday. • Very busy recently: 355 commits in the last 90 days. • Many people involved — about 70 different contributors this year (though one person still does most of the commits). • Has a clear license, a README, and a security contact policy. • Has automatic quality checks and tests set up. • Ships tagged releases (8 tags) and keeps a fixed parts-list for its building blocks. Things to know: • No automatic updates for the building blocks it depends on. Score based on publicly visible project activity and housekeeping. It does not include a security scan of the code itself. ==============================================================