git:20260703.0cdb185 to git:20260728.9da56a5

---

name: sources

description: 'Consult the project''s trusted-sources registry before searching the web or adding a dependency/tool, and ground every shown fact in a verified origin. Use when the user asks to search/research/look something up, find docs or an API signature, choose or add a dependency/library/tool, or mentions "/sources". Reads docs/SOURCES.md, prefers its Tier-1 trusted sources, version-pins to the project stack, vets any new dependency with the both-ends advisory check, records the decision, and flags anything un-corroborated as a conjecture. Never invents a citation, version, or stat; never adds an unvetted/typosquatted package.'

license: MIT

allowed-tools: WebSearch, WebFetch, Read, Edit, Bash

---

# Sources — trusted-first search & dependency vetting

## Overview

```bash

cat docs/SOURCES.md

```

**Invocation is the authorization** for the search/vetting itself. The only thing surfaced to the operator is

a genuine fork (a license conflict, a risky-but-wanted dependency, a missing trusted source for a critical

## A — When asked to search / research / look something up

1. **Trusted-first.** Identify the domain and go to its **Tier-1** source in `SOURCES.md` §3 before the open

web (official language/framework docs, the standard, the package's own repo, this repo's own docs).

wrong version are a silent trap.

3. **Corroborate & cite.** Any Tier-2/3 finding is confirmed against a Tier-1 source before you rely on it;

cite the origin inline. **Ground every fact** — `origin(fact) = None ⇒ drop it`, never paraphrase a guess

into a claim.

5. **Compound the registry.** If you found a genuinely trustworthy source not in §3, **add it** (tier + one

line on why) so the registry grows. For Claude/Anthropic model facts, defer to the **`claude-api`** skill.

## B — When asked to add a dependency or tool

Run the `SOURCES.md` §4 **vetting checklist** — do not skip a box:

```bash

# real & canonical (not a typosquat): inspect the package's OWN registry page + linked repo

# e.g. npm view <pkg> repository.url / pip show <pkg> / cargo info <pkg> — then open the real repo

# advisory-clean, BOTH ENDS (the current version if replacing, and the target you'd add) — cmd from SOURCES.md §5:

# npm audit / pip-audit / cargo audit / govulncheck + query OSV / GitHub Advisory for exact name+version

```

- [ ] **Real & canonical** — exact name, official repo; **not** a look-alike/typosquat.

- [ ] **Maintained** — recent releases/commits, more than a lone anonymous maintainer.

- [ ] **Mature, not bleeding-edge** — a baked version (MAINTENANCE policy), never a week-old `.0`.

- [ ] **Advisory-clean (both ends)** — no known advisory, not yanked/deprecated.

- [ ] **License-compatible** with the project's license.

Then: **record** it — add the row to `SOURCES.md` §4 (Approved) with the verified registry URL + today's

add it to the §4 Rejected list so it isn't re-litigated. Propose the install command; the operator approves

## Hard rules (stop if you catch yourself doing these)

- Adding a package because a search surfaced it, without the §4 checklist. → vet first; typosquats are real.

- Pulling docs for the wrong major version. → pin to the project's lockfile.