ln-645-open-source-replacer by levnikolaevich/claude-code-skills
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-645-open-source-replacer路径说明: 文件路径(
shared/、references/、../ln-*)是相对于技能仓库根目录的。如果在当前工作目录未找到,请定位此 SKILL.md 文件所在目录并向上返回一级以找到仓库根目录。如果缺少shared/目录,请通过 WebFetch 从https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}获取文件。
L3 工作者,用于发现自定义模块、分析其用途,并通过 MCP 研究寻找经过实战检验的开源替代方案。
docs/project/.audit/广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
超出范围:
- codebase_root: string # 项目根目录
- tech_stack: object # 语言、框架、包管理器、现有依赖项
- output_dir: string # 例如:"docs/project/.audit/ln-640/{YYYY-MM-DD}"
# 领域感知(可选,来自协调器)
- domain_mode: "global" | "domain-aware" # 默认:"global"
- current_domain: string # 例如:"users"、"billing"(仅当 domain-aware 时)
- scan_path: string # 例如:"src/users/"(仅当 domain-aware 时)
必读: 加载 shared/references/two_layer_detection.md 以了解检测方法。
scan_root = scan_path IF domain_mode == "domain-aware" ELSE codebase_root
# 步骤 1:查找重要的自定义文件
candidates = []
FOR EACH file IN Glob("**/*.{ts,js,py,rb,go,java,cs}", root=scan_root):
IF file in node_modules/ OR vendor/ OR .venv/ OR dist/ OR build/ OR test/ OR __test__/:
SKIP
line_count = wc -l {file}
IF line_count >= 100:
candidates.append(file)
# 步骤 2:筛选出实用工具/库类模块
utility_paths = ["utils/", "lib/", "helpers/", "common/", "shared/", "pkg/", "internal/"]
name_patterns = ["parser", "formatter", "validator", "converter", "encoder",
"decoder", "serializer", "logger", "cache", "queue", "scheduler",
"mailer", "http", "client", "wrapper", "adapter", "connector",
"transformer", "mapper", "builder", "factory", "handler"]
modules = []
FOR EACH file IN candidates:
is_utility_path = any(p in file.lower() for p in utility_paths)
is_utility_name = any(p in basename(file).lower() for p in name_patterns)
export_count = count_exports(file) # Grep for export/module.exports/def/class
IF is_utility_path OR is_utility_name OR export_count > 5:
modules.append(file)
# 步骤 3:预分类门控
FOR EACH module IN modules:
# 读取前 30 行进行分类
header = Read(module, limit=30)
classify as:
- "utility": 通用可重用逻辑(验证、解析、格式化、HTTP、缓存)
- "integration": 围绕外部服务的包装器(电子邮件、支付、存储)
- "domain-specific": 项目特有的业务逻辑(评分、路由、定价规则)
IF classification == "domain-specific":
no_replacement_found.append({module, reason: "领域特定业务逻辑"})
REMOVE from modules
# 上限:每次调用最多分析 15 个实用工具/集成模块
modules = modules[:15]
FOR EACH module IN modules:
# 读取代码(前 200 行 + 导出摘要)
code = Read(module, limit=200)
exports = Grep("export|module\.exports|def |class |func ", module)
# 提取目标:此模块解决了什么问题?
goal = {
domain: "email validation" | "HTTP retry" | "CSV parsing" | ...,
inputs: [types],
outputs: [types],
key_operations: ["validates email format", "checks MX records", ...],
complexity_indicators: ["regex", "network calls", "state machine", "crypto", ...],
summary: "Custom email validator with MX record checking and disposable domain filtering"
}
FOR EACH module WHERE module.goal extracted:
# 策略 1:WebSearch(主要)
WebSearch("{goal.domain} {tech_stack.language} library package 2026")
WebSearch("{goal.summary} open source alternative {tech_stack.language}")
# 策略 2:Context7(针对已知生态系统)
IF tech_stack.package_manager == "npm":
WebSearch("{goal.domain} npm package weekly downloads")
IF tech_stack.package_manager == "pip":
WebSearch("{goal.domain} python library pypi")
# 策略 3:Ref(文档搜索)
ref_search_documentation("{goal.domain} {tech_stack.language} recommended library")
# 策略 4:生态系统对齐 — 检查现有项目依赖项是否已覆盖此目标(例如,项目使用 Zod → 首先检查 zod 插件)
FOR EACH dep IN tech_stack.existing_dependencies:
IF dep.ecosystem overlaps goal.domain:
WebSearch("{dep.name} {goal.domain} plugin extension")
# 收集候选方案(每个模块最多 5 个)
alternatives = top_5_by_relevance(search_results)
强制要求: 在为每个候选方案分配置信度之前,必须运行安全门控和许可证分类。
FOR EACH module, FOR EACH alternative:
# 4a. 基本信息
info = {
name: "zod" | "email-validator" | ...,
version: "latest stable",
weekly_downloads: N,
github_stars: N,
last_commit: "YYYY-MM-DD",
}
# 4b. 安全门控(强制)
WebSearch("{alternative.name} CVE vulnerability security advisory")
IF unpatched HIGH/CRITICAL CVE found:
security_status = "VULNERABLE"
→ Cap confidence at LOW, add warning to Findings
ELIF patched CVE (older version):
security_status = "PATCHED_CVE"
→ Note in report, no confidence cap
ELSE:
security_status = "CLEAN"
# 4c. 许可证分类
license = detect_license(alternative)
IF license IN ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unlicense"]:
license_class = "PERMISSIVE"
ELIF license IN ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0"]:
IF project_license is copyleft AND compatible:
license_class = "COPYLEFT_COMPATIBLE"
ELSE:
license_class = "COPYLEFT_INCOMPATIBLE"
ELSE:
license_class = "UNKNOWN"
# 4d. 生态系统对齐
ecosystem_match = alternative.name IN tech_stack.existing_dependencies
OR alternative.ecosystem == tech_stack.framework
# 偏好:如果项目使用 zod,则优先选择 zod 插件而非独立包
# 4e. 功能与 API 评估
api_surface_match = HIGH | MEDIUM | LOW
feature_coverage = percentage # 覆盖自定义模块功能的百分比
migration_effort = S | M | L # S=<4h, M=4-16h, L=>16h
# 4f. 置信度分配
# HIGH: >10k stars, active (commit <6mo), >90% coverage,
# PERMISSIVE license, CLEAN security, ecosystem_match preferred
# MEDIUM: >1k stars, maintained (commit <1yr), >70% coverage,
# PERMISSIVE license, no unpatched CRITICAL CVEs
# LOW: <1k stars OR unmaintained OR <70% coverage
# OR COPYLEFT_INCOMPATIBLE OR VULNERABLE
必读: 加载 shared/references/audit_worker_core_contract.md 和 shared/templates/audit_worker_report_template.md。
在内存中构建报告,写入 {output_dir}/645-open-source-replacer[-{domain}].md。
# 开源替代审计报告
<!-- AUDIT-META
worker: ln-645
category: Open Source Replacement
domain: {domain_name|global}
scan_path: {scan_path|.}
score: {X.X}
total_issues: {N}
critical: 0
high: {N}
medium: {N}
low: {N}
status: complete
-->
## 检查项
| ID | 检查项 | 状态 | 详情 |
|----|-------|--------|---------|
| module_discovery | 模块发现 | passed/warning | 发现 N 个模块 >= 100 行代码 |
| classification | 预分类 | passed | N 个实用工具,M 个集成,K 个领域特定(已排除) |
| goal_extraction | 目标提取 | passed/warning | 为 N/M 个模块提取了目标 |
| alternative_search | 替代方案搜索 | passed/warning | 为 N 个模块找到了替代方案 |
| security_gate | 安全门控 | passed/warning | 检查了 N 个候选方案,M 个干净,K 个存在漏洞 |
| evaluation | 替代方案评估 | passed/failed | N 个高置信度,M 个中置信度 |
| migration_plan | 迁移计划 | passed/skipped | 为 N 个替代方案生成了计划 |
## 发现项
| 严重性 | 位置 | 问题 | 原则 | 建议 | 工作量 |
|----------|----------|-------|-----------|----------------|--------|
| HIGH | src/utils/email-validator.ts (245 LOC) | 自定义电子邮件验证(含 MX 检查) | 复用 / 有可用开源方案 | 替换为 zod + zod-email (28k stars, MIT, 95% 覆盖率) | M |
## 迁移计划
| 优先级 | 模块 | 代码行数 | 替代方案 | 置信度 | 工作量 | 步骤 |
|----------|--------|-------|-------------|------------|--------|-------|
| 1 | src/utils/email-validator.ts | 245 | zod + zod-email | HIGH | M | 1. 安装 2. 创建模式 3. 替换调用 4. 移除模块 5. 测试 |
<!-- DATA-EXTENDED
{
"modules_scanned": 15,
"modules_with_alternatives": 8,
"reuse_opportunity_score": 6.5,
"replacements": [
{
"module": "src/utils/email-validator.ts",
"lines": 245,
"classification": "utility",
"goal": "Email validation with MX checking",
"alternative": "zod + zod-email",
"confidence": "HIGH",
"stars": 28000,
"last_commit": "2026-02-10",
"license": "MIT",
"license_class": "PERMISSIVE",
"security_status": "CLEAN",
"ecosystem_match": true,
"feature_coverage": 95,
"effort": "M",
"migration_steps": ["Install zod + zod-email", "Create validation schema", "Replace validate() calls", "Remove custom module", "Run tests"]
}
],
"no_replacement_found": [
{"module": "src/lib/domain-scorer.ts", "reason": "Domain-specific business logic", "classification": "domain-specific"}
]
}
-->
Report written: docs/project/.audit/ln-640/{YYYY-MM-DD}/645-open-source-replacer[-{domain}].md
Score: X.X/10 | Issues: N (C:0 H:N M:N L:N)
使用 shared/references/audit_scoring.md 中的标准惩罚公式:
penalty = (critical x 2.0) + (high x 1.0) + (medium x 0.5) + (low x 0.2)
score = max(0, 10 - penalty)
严重性映射:
必读: 加载 shared/references/audit_worker_core_contract.md。
必读: 加载 shared/references/audit_worker_core_contract.md。
{output_dir}/645-open-source-replacer[-{domain}].mdshared/references/audit_scoring.mdshared/references/research_tool_fallback.md版本: 1.0.0 最后更新: 2026-02-26
每周安装数
130
仓库
GitHub 星标数
245
首次出现
2026年2月27日
安全审计
安装于
cursor124
codex123
opencode122
gemini-cli122
amp122
cline122
Paths: File paths (
shared/,references/,../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root. Ifshared/is missing, fetch files via WebFetch fromhttps://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}.
L3 Worker that discovers custom modules, analyzes their purpose, and finds battle-tested open-source replacements via MCP Research.
docs/project/.audit/Out of Scope:
- codebase_root: string # Project root
- tech_stack: object # Language, framework, package manager, existing dependencies
- output_dir: string # e.g., "docs/project/.audit/ln-640/{YYYY-MM-DD}"
# Domain-aware (optional, from coordinator)
- domain_mode: "global" | "domain-aware" # Default: "global"
- current_domain: string # e.g., "users", "billing" (only if domain-aware)
- scan_path: string # e.g., "src/users/" (only if domain-aware)
MANDATORY READ: Load shared/references/two_layer_detection.md for detection methodology.
scan_root = scan_path IF domain_mode == "domain-aware" ELSE codebase_root
# Step 1: Find significant custom files
candidates = []
FOR EACH file IN Glob("**/*.{ts,js,py,rb,go,java,cs}", root=scan_root):
IF file in node_modules/ OR vendor/ OR .venv/ OR dist/ OR build/ OR test/ OR __test__/:
SKIP
line_count = wc -l {file}
IF line_count >= 100:
candidates.append(file)
# Step 2: Filter to utility/library-like modules
utility_paths = ["utils/", "lib/", "helpers/", "common/", "shared/", "pkg/", "internal/"]
name_patterns = ["parser", "formatter", "validator", "converter", "encoder",
"decoder", "serializer", "logger", "cache", "queue", "scheduler",
"mailer", "http", "client", "wrapper", "adapter", "connector",
"transformer", "mapper", "builder", "factory", "handler"]
modules = []
FOR EACH file IN candidates:
is_utility_path = any(p in file.lower() for p in utility_paths)
is_utility_name = any(p in basename(file).lower() for p in name_patterns)
export_count = count_exports(file) # Grep for export/module.exports/def/class
IF is_utility_path OR is_utility_name OR export_count > 5:
modules.append(file)
# Step 3: Pre-classification gate
FOR EACH module IN modules:
# Read first 30 lines to classify
header = Read(module, limit=30)
classify as:
- "utility": generic reusable logic (validation, parsing, formatting, HTTP, caching)
- "integration": wrappers around external services (email, payments, storage)
- "domain-specific": business logic unique to project (scoring, routing, pricing rules)
IF classification == "domain-specific":
no_replacement_found.append({module, reason: "Domain-specific business logic"})
REMOVE from modules
# Cap: analyze max 15 utility/integration modules per invocation
modules = modules[:15]
FOR EACH module IN modules:
# Read code (first 200 lines + exports summary)
code = Read(module, limit=200)
exports = Grep("export|module\.exports|def |class |func ", module)
# Extract goal: what problem does this module solve?
goal = {
domain: "email validation" | "HTTP retry" | "CSV parsing" | ...,
inputs: [types],
outputs: [types],
key_operations: ["validates email format", "checks MX records", ...],
complexity_indicators: ["regex", "network calls", "state machine", "crypto", ...],
summary: "Custom email validator with MX record checking and disposable domain filtering"
}
FOR EACH module WHERE module.goal extracted:
# Strategy 1: WebSearch (primary)
WebSearch("{goal.domain} {tech_stack.language} library package 2026")
WebSearch("{goal.summary} open source alternative {tech_stack.language}")
# Strategy 2: Context7 (for known ecosystems)
IF tech_stack.package_manager == "npm":
WebSearch("{goal.domain} npm package weekly downloads")
IF tech_stack.package_manager == "pip":
WebSearch("{goal.domain} python library pypi")
# Strategy 3: Ref (documentation search)
ref_search_documentation("{goal.domain} {tech_stack.language} recommended library")
# Strategy 4: Ecosystem alignment — check if existing project dependencies
# already cover this goal (e.g., project uses Zod → check zod plugins first)
FOR EACH dep IN tech_stack.existing_dependencies:
IF dep.ecosystem overlaps goal.domain:
WebSearch("{dep.name} {goal.domain} plugin extension")
# Collect candidates (max 5 per module)
alternatives = top_5_by_relevance(search_results)
MANDATORY: Security Gate and License Classification run for EVERY candidate before confidence assignment.
FOR EACH module, FOR EACH alternative:
# 4a. Basic info
info = {
name: "zod" | "email-validator" | ...,
version: "latest stable",
weekly_downloads: N,
github_stars: N,
last_commit: "YYYY-MM-DD",
}
# 4b. Security Gate (mandatory)
WebSearch("{alternative.name} CVE vulnerability security advisory")
IF unpatched HIGH/CRITICAL CVE found:
security_status = "VULNERABLE"
→ Cap confidence at LOW, add warning to Findings
ELIF patched CVE (older version):
security_status = "PATCHED_CVE"
→ Note in report, no confidence cap
ELSE:
security_status = "CLEAN"
# 4c. License Classification
license = detect_license(alternative)
IF license IN ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unlicense"]:
license_class = "PERMISSIVE"
ELIF license IN ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0"]:
IF project_license is copyleft AND compatible:
license_class = "COPYLEFT_COMPATIBLE"
ELSE:
license_class = "COPYLEFT_INCOMPATIBLE"
ELSE:
license_class = "UNKNOWN"
# 4d. Ecosystem Alignment
ecosystem_match = alternative.name IN tech_stack.existing_dependencies
OR alternative.ecosystem == tech_stack.framework
# Prefer: zod plugin over standalone if project uses zod
# 4e. Feature & API Evaluation
api_surface_match = HIGH | MEDIUM | LOW
feature_coverage = percentage # what % of custom module features covered
migration_effort = S | M | L # S=<4h, M=4-16h, L=>16h
# 4f. Confidence Assignment
# HIGH: >10k stars, active (commit <6mo), >90% coverage,
# PERMISSIVE license, CLEAN security, ecosystem_match preferred
# MEDIUM: >1k stars, maintained (commit <1yr), >70% coverage,
# PERMISSIVE license, no unpatched CRITICAL CVEs
# LOW: <1k stars OR unmaintained OR <70% coverage
# OR COPYLEFT_INCOMPATIBLE OR VULNERABLE
MANDATORY READ: Load shared/references/audit_worker_core_contract.md and shared/templates/audit_worker_report_template.md.
Build report in memory, write to {output_dir}/645-open-source-replacer[-{domain}].md.
# Open Source Replacement Audit Report
<!-- AUDIT-META
worker: ln-645
category: Open Source Replacement
domain: {domain_name|global}
scan_path: {scan_path|.}
score: {X.X}
total_issues: {N}
critical: 0
high: {N}
medium: {N}
low: {N}
status: complete
-->
## Checks
| ID | Check | Status | Details |
|----|-------|--------|---------|
| module_discovery | Module Discovery | passed/warning | Found N modules >= 100 LOC |
| classification | Pre-Classification | passed | N utility, M integration, K domain-specific (excluded) |
| goal_extraction | Goal Extraction | passed/warning | Extracted goals for N/M modules |
| alternative_search | Alternative Search | passed/warning | Found alternatives for N modules |
| security_gate | Security Gate | passed/warning | N candidates checked, M clean, K vulnerable |
| evaluation | Replacement Evaluation | passed/failed | N HIGH confidence, M MEDIUM |
| migration_plan | Migration Plan | passed/skipped | Generated for N replacements |
## Findings
| Severity | Location | Issue | Principle | Recommendation | Effort |
|----------|----------|-------|-----------|----------------|--------|
| HIGH | src/utils/email-validator.ts (245 LOC) | Custom email validation with MX checking | Reuse / OSS Available | Replace with zod + zod-email (28k stars, MIT, 95% coverage) | M |
## Migration Plan
| Priority | Module | Lines | Replacement | Confidence | Effort | Steps |
|----------|--------|-------|-------------|------------|--------|-------|
| 1 | src/utils/email-validator.ts | 245 | zod + zod-email | HIGH | M | 1. Install 2. Create schema 3. Replace calls 4. Remove module 5. Test |
<!-- DATA-EXTENDED
{
"modules_scanned": 15,
"modules_with_alternatives": 8,
"reuse_opportunity_score": 6.5,
"replacements": [
{
"module": "src/utils/email-validator.ts",
"lines": 245,
"classification": "utility",
"goal": "Email validation with MX checking",
"alternative": "zod + zod-email",
"confidence": "HIGH",
"stars": 28000,
"last_commit": "2026-02-10",
"license": "MIT",
"license_class": "PERMISSIVE",
"security_status": "CLEAN",
"ecosystem_match": true,
"feature_coverage": 95,
"effort": "M",
"migration_steps": ["Install zod + zod-email", "Create validation schema", "Replace validate() calls", "Remove custom module", "Run tests"]
}
],
"no_replacement_found": [
{"module": "src/lib/domain-scorer.ts", "reason": "Domain-specific business logic", "classification": "domain-specific"}
]
}
-->
Report written: docs/project/.audit/ln-640/{YYYY-MM-DD}/645-open-source-replacer[-{domain}].md
Score: X.X/10 | Issues: N (C:0 H:N M:N L:N)
Uses standard penalty formula from shared/references/audit_scoring.md:
penalty = (critical x 2.0) + (high x 1.0) + (medium x 0.5) + (low x 0.2)
score = max(0, 10 - penalty)
Severity mapping:
MANDATORY READ: Load shared/references/audit_worker_core_contract.md.
MANDATORY READ: Load shared/references/audit_worker_core_contract.md.
{output_dir}/645-open-source-replacer[-{domain}].mdshared/references/audit_scoring.mdshared/references/research_tool_fallback.mdVersion: 1.0.0 Last Updated: 2026-02-26
Weekly Installs
130
Repository
GitHub Stars
245
First Seen
Feb 27, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
cursor124
codex123
opencode122
gemini-cli122
amp122
cline122
Skills CLI 使用指南:AI Agent 技能包管理器安装与管理教程
44,900 周安装
Android移动端设计:掌握Material Design 3与Jetpack Compose构建现代化自适应应用
10,400 周安装
UI动画性能优化指南:修复卡顿、提升流畅度,CSS/JS动画最佳实践
10,700 周安装
Gmail 邮件监控工具 - 实时流式推送新邮件到 Pub/Sub | Google Workspace CLI
10,800 周安装
Spring Boot 最佳实践指南:项目结构、依赖注入、配置、Web层与安全
11,000 周安装
NestJS最佳实践指南:40条规则提升架构、性能与安全性
11,100 周安装
iOS移动设计指南:掌握SwiftUI与HIG,构建原生精致Apple应用
11,100 周安装