Analyzes GitHub repo dependencies across npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet for GitHub Sponsors opportunities. Verifies funding links and includes OSSF Scorecard health data in reports.
From awesome-copilotnpx claudepluginhub ctr26/dotfiles --plugin awesome-copilotThis skill uses the workspace's default tool permissions.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Uses ctx7 CLI to fetch current library docs, manage AI coding skills (install/search/generate), and configure Context7 MCP for AI editors.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Discover opportunities to support the open source maintainers behind your project's dependencies. Accepts a GitHub owner/repo (e.g. /sponsor expressjs/express), uses the deps.dev API for dependency resolution and project health data, and produces a friendly sponsorship report covering both direct and transitive dependencies.
When the user types /sponsor {owner/repo} or provides a repository in owner/repo format:
owner and repo.GetDependencies (one call).GetVersion for each dep → relatedProjects gives GitHub repo.GetProject for unique repos → OSSF Scorecard.funding field, FUNDING.yml, web search fallback.Use get_file_contents to fetch the manifest from the target repo. Determine the ecosystem and extract the package name + latest version:
| File | Ecosystem | Package name from | Version from |
|---|---|---|---|
package.json | NPM | name field | version field |
requirements.txt | PYPI | list of package names | use latest (omit version in deps.dev call) |
pyproject.toml | PYPI | [project.dependencies] | use latest |
Cargo.toml | CARGO | [package] name | [package] version |
go.mod | GO | module path | extract from go.mod |
Gemfile | RUBYGEMS | gem names | use latest |
pom.xml | MAVEN | groupId:artifactId | version |
This is the key step. Use web_fetch to call the deps.dev API:
https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{PACKAGE}/versions/{VERSION}:dependencies
For example:
https://api.deps.dev/v3/systems/npm/packages/express/versions/5.2.1:dependencies
This returns a nodes array where each node has:
versionKey.name — package nameversionKey.version — resolved versionrelation — "SELF", "DIRECT", or "INDIRECT"This single call gives you the entire dependency tree — both direct and transitive — with exact resolved versions. No need to parse lockfiles.
Package names containing special characters must be percent-encoded:
@colors/colors → %40colors%2Fcolors@ as %40, / as %2FIf the repo doesn't publish a package (e.g., it's an app not a library), fall back to reading package.json dependencies directly and calling deps.dev GetVersion for each.
For each dependency from the tree, call deps.dev GetVersion:
https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{NAME}/versions/{VERSION}
From the response, extract:
relatedProjects → look for relationType: "SOURCE_REPO" → projectKey.id gives github.com/{owner}/{repo}links → look for label: "SOURCE_REPO" → url fieldThis works across all ecosystems — npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet — with the same field structure.
For each unique GitHub repo, call deps.dev GetProject:
https://api.deps.dev/v3/projects/github.com%2F{owner}%2F{repo}
From the response, extract:
scorecard.checks → find the "Maintained" check → score (0–10)starsCount — popularity indicatorlicense — project licenseopenIssuesCount — activity indicatorUse the Maintained score to label project health:
For each unique GitHub repo, check for funding information using three sources in order:
funding field (npm ecosystem only)Use web_fetch on https://registry.npmjs.org/{package-name}/latest and check for a funding field:
"https://github.com/sponsors/sindresorhus" → use as URL{"type": "opencollective", "url": "https://opencollective.com/express"} → use url.github/FUNDING.yml (repo-level, then org-level fallback)Step 5b-i — Per-repo check:
Use get_file_contents to fetch {owner}/{repo} path .github/FUNDING.yml.
Step 5b-ii — Org/user-level fallback:
If 5b-i returned 404 (no FUNDING.yml in the repo itself), check the owner's default community health repo:
Use get_file_contents to fetch {owner}/.github path FUNDING.yml.
GitHub supports a default community health files convention: a .github repository at the user/org level provides defaults for all repos that lack their own. For example, isaacs/.github/FUNDING.yml applies to all isaacs/* repos.
Only look up each unique {owner}/.github repo once — reuse the result for all repos under that owner. Process in batches of 10 owners at a time.
Parse the YAML (same for both 5b-i and 5b-ii):
github: [username] → https://github.com/sponsors/{username}open_collective: slug → https://opencollective.com/{slug}ko_fi: username → https://ko-fi.com/{username}patreon: username → https://patreon.com/{username}tidelift: platform/package → https://tidelift.com/subscription/pkg/{platform-package}custom: [urls] → use as-isFor the top 10 unfunded dependencies (by number of transitive dependents), use web_search:
"{package name}" github sponsors OR open collective OR funding
Skip packages known to be corporate-maintained (React/Meta, TypeScript/Microsoft, @types/DefinitelyTyped).
{owner}/.github check per unique owner — reuse the result for all their repos.Before including ANY funding link, verify it exists.
Use web_fetch on each funding URL:
Verify in batches of 5 at a time. Never present unverified links.
Minimize intermediate output during data gathering. Do NOT announce each batch ("Batch 3 of 7…", "Now checking funding…"). Instead:
## 💜 Sponsor Finder Report
**Repository:** {owner}/{repo} · {ecosystem} · {package}@{version}
**Scanned:** {date} · {total} deps ({direct} direct + {transitive} transitive)
---
### 🎯 Ways to Give Back
Sponsoring just {N} people/orgs supports {sponsorable} of your {total} dependencies — a great way to invest in the open source your project depends on.
1. **💜 @{user}** — {N} direct + {M} transitive deps · ⭐ Maintained
{dep1}, {dep2}, {dep3}, ...
https://github.com/sponsors/{user}
2. **🟠 Open Collective: {name}** — {N} direct + {M} transitive deps · ⭐ Maintained
{dep1}, {dep2}, {dep3}, ...
https://opencollective.com/{name}
3. **💜 @{user2}** — {N} direct dep · 💤 Low activity
{dep1}
https://github.com/sponsors/{user2}
---
### 📊 Coverage
- **{sponsorable}/{total}** dependencies have funding options ({percentage}%)
- **{destinations}** unique funding destinations
- **{unfunded_direct}** direct deps don't have funding set up yet ({top_names}, ...)
- All links verified ✅
get_file_contents returns 404 for the repo → inform user repo may not exist or is private.get_file_contents), web_fetch, and web_search — never clone or shell out..github repo only once.