Adapt open-source code with attribution

Adapts a small stable algorithm when its verified permissive license and limited dependencies make that appropriate.

oss-code-adaptation-attribution

Team members using this skill

AgentBram

See how it helps

When is it useful?

Use when a large package contains one self-contained function your project needs.

What does it help you do?

Checks the exact upstream license, notices and modification obligations.
Records source revision, original attribution and local changes.
Preserves focused tests and avoids copying security-sensitive code needing continuous upstream fixes.

Try asking this

Assess adapting this cycle-detection algorithm and provide provenance, required notices and behavior tests for the extracted code. Retain the upstream revision and notices beside the adapted module. Test a cyclic and acyclic graph and document every intentional deviation from the original.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Open-Source Code Adaptation & Attribution

Sometimes a 15,000-line open-source package contains one 120-line algorithm (e.g., a graph cycle detector, fuzzy matcher, token estimator, or retry backoff scheduler) that is exactly what we need, while the rest of the package brings 40 transitive dependencies and incompatible framework assumptions.

When to Adapt / Vendor Instead of Installing

Recommend adapting a focused subset when all of the following hold:

License is permissive: The source project is explicitly licensed under MIT, ISC, BSD-2-Clause, BSD-3-Clause, 0BSD, or Apache-2.0. (Never copy code from unlicensed, GPL/AGPL, or proprietary repos.)
The target logic is self-contained and stable: The algorithm has clear inputs/outputs and does not require ongoing security patches (unlike TLS, auth, or HTML sanitizers, which should remain managed dependencies).
Adapting eliminates disproportionate baggage: Extracting 100–300 lines avoids pulling in heavy transitive trees, native build steps, or CommonJS/ESM conflicts.

Workflow for Clean, Compliant Adaptation

Verify license and NOTICE requirements:
- Read the upstream LICENSE and NOTICE files at the exact commit being adapted.
- For Apache-2.0, check whether a NOTICE file exists and preserve its required attributions alongside the license terms.
Record explicit provenance in the file header:
- Place a clear header comment at the top of the adapted file containing:
  - Upstream repository name and URL.
  - Exact version tag and commit SHA (Adapted from owner/repo@<commit-sha> (path/to/file)).
  - Original copyright notice and license identifier (SPDX-License-Identifier: MIT).
  - A brief note summarizing what was modified for our codebase (e.g., converted to strict TypeScript, removed Node-specific fs calls).
Port and strengthen tests:
- Port the relevant unit test cases and edge-case fixtures from the upstream repository into our test suite so the adapted logic is verified to the same or higher standard.

Included files 1

SKILL.md