[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE7TET3S1CWTRVQ34FPFD6":3,"skill-same:01M6AE7TET3S1CWTRVQ34FPFD6":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6AE7TET3S1CWTRVQ34FPFD6","sponsor-finder",null,"Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search. Verifies every link. Shows direct and transitive dependencies with OSSF Scorecard health data. Invoke with \u002Fsponsor followed by a GitHub owner\u002Frepo (e.g. \"\u002Fsponsor expressjs\u002Fexpress\").","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsponsor-finder\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,9],"sponsor finder","api","invoke","funding","which","scorecard","health data","expressjs","express","across","files","dependency","direct","web search","deps","go","maven","data","repository","pypi","metadata","search","npm","dev","nuget","web","2026-11-10 10:12:30",false,"---\nname: sponsor-finder\ndescription: Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search. Verifies every link. Shows direct and transitive dependencies with OSSF Scorecard health data. Invoke with \u002Fsponsor followed by a GitHub owner\u002Frepo (e.g. \"\u002Fsponsor expressjs\u002Fexpress\").\n---\n\n# Sponsor Finder\n\nDiscover opportunities to support the open source maintainers behind your project's dependencies. Accepts a GitHub `owner\u002Frepo` (e.g. `\u002Fsponsor expressjs\u002Fexpress`), uses the deps.dev API for dependency resolution and project health data, and produces a friendly sponsorship report covering both direct and transitive dependencies.\n\n## Your Workflow\n\nWhen the user types `\u002Fsponsor {owner\u002Frepo}` or provides a repository in `owner\u002Frepo` format:\n\n1. **Parse the input** — Extract `owner` and `repo`.\n2. **Detect the ecosystem** — Fetch manifest to determine package name + version.\n3. **Get full dependency tree** — deps.dev `GetDependencies` (one call).\n4. **Resolve repos** — deps.dev `GetVersion` for each dep → `relatedProjects` gives GitHub repo.\n5. **Get project health** — deps.dev `GetProject` for unique repos → OSSF Scorecard.\n6. **Find funding links** — npm `funding` field, FUNDING.yml, web search fallback.\n7. **Verify every link** — fetch each URL to confirm it's live.\n8. **Group and report** — by funding destination, sorted by impact.\n\n---\n\n## Step 1: Detect Ecosystem and Package\n\nUse `get_file_contents` to fetch the manifest from the target repo. Determine the ecosystem and extract the package name + latest version:\n\n| File | Ecosystem | Package name from | Version from |\n|------|-----------|-------------------|--------------|\n| `package.json` | NPM | `name` field | `version` field |\n| `requirements.txt` | PYPI | list of package names | use latest (omit version in deps.dev call) |\n| `pyproject.toml` | PYPI | `[project.dependencies]` | use latest |\n| `Cargo.toml` | CARGO | `[package] name` | `[package] version` |\n| `go.mod` | GO | `module` path | extract from go.mod |\n| `Gemfile` | RUBYGEMS | gem names | use latest |\n| `pom.xml` | MAVEN | `groupId:artifactId` | `version` |\n\n---\n\n## Step 2: Get Full Dependency Tree (deps.dev)\n\n**This is the key step.** Use `web_fetch` to call the deps.dev API:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002F{ECOSYSTEM}\u002Fpackages\u002F{PACKAGE}\u002Fversions\u002F{VERSION}:dependencies\n```\n\nFor example:\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002Fnpm\u002Fpackages\u002Fexpress\u002Fversions\u002F5.2.1:dependencies\n```\n\nThis returns a `nodes` array where each node has:\n- `versionKey.name` — package name\n- `versionKey.version` — resolved version\n- `relation` — `\"SELF\"`, `\"DIRECT\"`, or `\"INDIRECT\"`\n\n**This single call gives you the entire dependency tree** — both direct and transitive — with exact resolved versions. No need to parse lockfiles.\n\n### URL encoding\nPackage names containing special characters must be percent-encoded:\n- `@colors\u002Fcolors` → `%40colors%2Fcolors`\n- Encode `@` as `%40`, `\u002F` as `%2F`\n\n### For repos without a single root package\nIf the repo doesn't publish a package (e.g., it's an app not a library), fall back to reading `package.json` dependencies directly and calling deps.dev `GetVersion` for each.\n\n---\n\n## Step 3: Resolve Each Dependency to a GitHub Repo (deps.dev)\n\nFor each dependency from the tree, call deps.dev `GetVersion`:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002F{ECOSYSTEM}\u002Fpackages\u002F{NAME}\u002Fversions\u002F{VERSION}\n```\n\nFrom the response, extract:\n- **`relatedProjects`** → look for `relationType: \"SOURCE_REPO\"` → `projectKey.id` gives `github.com\u002F{owner}\u002F{repo}`\n- **`links`** → look for `label: \"SOURCE_REPO\"` → `url` field\n\nThis works across **all ecosystems** — npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet — with the same field structure.\n\n### Efficiency rules\n- Process in batches of **10 at a time**.\n- Deduplicate — multiple packages may map to the same repo.\n- Skip deps where no GitHub project is found (count as \"unresolvable\").\n\n---\n\n## Step 4: Get Project Health Data (deps.dev)\n\nFor each unique GitHub repo, call deps.dev `GetProject`:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fprojects\u002Fgithub.com%2F{owner}%2F{repo}\n```\n\nFrom the response, extract:\n- **`scorecard.checks`** → find the `\"Maintained\"` check → `score` (0–10)\n- **`starsCount`** — popularity indicator\n- **`license`** — project license\n- **`openIssuesCount`** — activity indicator\n\nUse the Maintained score to label project health:\n- Score 7–10 → ⭐ Actively maintained\n- Score 4–6 → ⚠️ Partially maintained\n- Score 0–3 → ? Possibly unmaintained\n\n### Efficiency rules\n- Only fetch for **unique repos** (not per-package).\n- Process in batches of **10 at a time**.\n- This step is optional — skip if rate-limited and note in output.\n\n---\n\n## Step 5: Find Funding Links\n\nFor each unique GitHub repo, check for funding information using three sources in order:\n\n### 5a: npm `funding` field (npm ecosystem only)\nUse `web_fetch` on `https:\u002F\u002Fregistry.npmjs.org\u002F{package-name}\u002Flatest` and check for a `funding` field:\n- **String:** `\"https:\u002F\u002Fgithub.com\u002Fsponsors\u002Fsindresorhus\"` → use as URL\n- **Object:** `{\"type\": \"opencollective\", \"url\": \"https:\u002F\u002Fopencollective.com\u002Fexpress\"}` → use `url`\n- **Array:** collect all URLs\n\n### 5b: `.github\u002FFUNDING.yml` (repo-level, then org-level fallback)\n\n**Step 5b-i — Per-repo check:**\nUse `get_file_contents` to fetch `{owner}\u002F{repo}` path `.github\u002FFUNDING.yml`.\n\n**Step 5b-ii — Org\u002Fuser-level fallback:**\nIf 5b-i returned 404 (no FUNDING.yml in the repo itself), check the owner's default community health repo:\nUse `get_file_contents` to fetch `{owner}\u002F.github` path `FUNDING.yml`.\n\nGitHub supports a [default community health files](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcommunities\u002Fsetting-up-your-project-for-healthy-contributions\u002Fcreating-a-default-community-health-file) convention: a `.github` repository at the user\u002Forg level provides defaults for all repos that lack their own. For example, `isaacs\u002F.github\u002FFUNDING.yml` applies to all `isaacs\u002F*` repos.\n\nOnly look up each unique `{owner}\u002F.github` repo **once** — reuse the result for all repos under that owner. Process in batches of **10 owners at a time**.\n\nParse the YAML (same for both 5b-i and 5b-ii):\n- `github: [username]` → `https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{username}`\n- `open_collective: slug` → `https:\u002F\u002Fopencollective.com\u002F{slug}`\n- `ko_fi: username` → `https:\u002F\u002Fko-fi.com\u002F{username}`\n- `patreon: username` → `https:\u002F\u002Fpatreon.com\u002F{username}`\n- `tidelift: platform\u002Fpackage` → `https:\u002F\u002Ftidelift.com\u002Fsubscription\u002Fpkg\u002F{platform-package}`\n- `custom: [urls]` → use as-is\n\n### 5c: Web search fallback\nFor the **top 10 unfunded dependencies** (by number of transitive dependents), use `web_search`:\n```\n\"{package name}\" github sponsors OR open collective OR funding\n```\nSkip packages known to be corporate-maintained (React\u002FMeta, TypeScript\u002FMicrosoft, @types\u002FDefinitelyTyped).\n\n### Efficiency rules\n- **Check 5a and 5b for all deps.** Only use 5c for top unfunded ones.\n- Skip npm registry calls for non-npm ecosystems.\n- Deduplicate repos — check each repo only once.\n- **One `{owner}\u002F.github` check per unique owner** — reuse the result for all their repos.\n- Process org-level lookups in batches of **10 owners at a time**.\n\n---\n\n## Step 6: Verify Every Link (CRITICAL)\n\n**Before including ANY funding link, verify it exists.**\n\nUse `web_fetch` on each funding URL:\n- **Valid page** → ✅ Include\n- **404 \u002F \"not found\" \u002F \"not enrolled\"** → ❌ Exclude\n- **Redirect to valid page** → ✅ Include final URL\n\nVerify in batches of **5 at a time**. Never present unverified links.\n\n---\n\n## Step 7: Output the Report\n\n### Output discipline\n\n**Minimize intermediate output during data gathering.** Do NOT announce each batch (\"Batch 3 of 7…\", \"Now checking funding…\"). Instead:\n- Show **one brief status line** when starting each major phase (e.g., \"Resolving 67 dependencies…\", \"Checking funding links…\")\n- **Collect ALL data before producing the report.** Never drip-feed partial tables.\n- Output the final report as a **single cohesive block** at the end.\n\n### Report template\n\n```\n## ? Sponsor Finder Report\n\n**Repository:** {owner}\u002F{repo} · {ecosystem} · {package}@{version}\n**Scanned:** {date} · {total} deps ({direct} direct + {transitive} transitive)\n\n---\n\n### ? Ways to Give Back\n\nSponsoring just {N} people\u002Forgs supports {sponsorable} of your {total} dependencies — a great way to invest in the open source your project depends on.\n\n1. **? @{user}** — {N} direct + {M} transitive deps · ⭐ Maintained\n   {dep1}, {dep2}, {dep3}, ...\n   https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{user}\n\n2. **? Open Collective: {name}** — {N} direct + {M} transitive deps · ⭐ Maintained\n   {dep1}, {dep2}, {dep3}, ...\n   https:\u002F\u002Fopencollective.com\u002F{name}\n\n3. **? @{user2}** — {N} direct dep · ? Low activity\n   {dep1}\n   https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{user2}\n\n---\n\n### ? Coverage\n\n- **{sponsorable}\u002F{total}** dependencies have funding options ({percentage}%)\n- **{destinations}** unique funding destinations\n- **{unfunded_direct}** direct deps don't have funding set up yet ({top_names}, ...)\n- All links verified ✅\n```\n\n### Report format rules\n\n- **Lead with \"? Ways to Give Back\"** — this is the primary output. Numbered list, sorted by total deps covered (descending).\n- **Bare URLs on their own line** — not wrapped in markdown link syntax. This ensures they're clickable in any terminal emulator.\n- **Inline dep names** — list the covered dependency names in a comma-separated line under each sponsor, so the user sees exactly what they're funding.\n- **Health indicator inline** — show ⭐\u002F⚠️\u002F? next to each destination, not in a separate table column.\n- **One \"? Coverage\" section** — compact stats. No separate \"Verified Funding Links\" table, no \"No Funding Found\" table.\n- **Unfunded deps as a brief note** — just the count + top names. Frame as \"don't have funding set up yet\" rather than highlighting a gap. Never shame projects for not having funding — many maintainers prefer other forms of contribution.\n- ? GitHub Sponsors, ? Open Collective, ☕ Ko-fi, ? Other\n- Prioritize GitHub Sponsors links when multiple funding sources exist for the same maintainer.\n\n---\n\n## Error Handling\n\n- If deps.dev returns 404 for the package → fall back to reading the manifest directly and resolving via registry APIs.\n- If deps.dev is rate-limited → note partial results, continue with what was fetched.\n- If `get_file_contents` returns 404 for the repo → inform user repo may not exist or is private.\n- If link verification fails → exclude the link silently.\n- Always produce a report even if partial — never fail silently.\n\n---\n\n## Critical Rules\n\n1. **NEVER present unverified links.** Fetch every URL before showing it. 5 verified links > 20 guessed links.\n2. **NEVER guess from training knowledge.** Always check — funding pages change over time.\n3. **Always be encouraging, never shaming.** Frame results positively — celebrate what IS funded, and treat unfunded deps as an opportunity, not a failing. Not every project needs or wants financial sponsorship.\n4. **Lead with action.** The \"? Ways to Give Back\" section is the primary output — bare clickable URLs, grouped by destination.\n5. **Use deps.dev as primary resolver.** Fall back to registry APIs only if deps.dev is unavailable.\n6. **Always use GitHub MCP tools** (`get_file_contents`), `web_fetch`, and `web_search` — never clone or shell out.\n7. **Be efficient.** Batch API calls, deduplicate repos, check each owner's `.github` repo only once.\n8. **Focus on GitHub Sponsors.** Most actionable platform — show others but prioritize GitHub.\n9. **Deduplicate by maintainer.** Group to show real impact of sponsoring one person.\n10. **Show the actionable minimum.** Tell users the fewest sponsorships to support the most deps.\n11. **Minimize intermediate output.** Don't announce each batch. Collect all data, then output one cohesive report.\n","# Sponsor Finder\n\nDiscover opportunities to support the open source maintainers behind your project's dependencies. Accepts a GitHub `owner\u002Frepo` (e.g. `\u002Fsponsor expressjs\u002Fexpress`), uses the deps.dev API for dependency resolution and project health data, and produces a friendly sponsorship report covering both direct and transitive dependencies.\n\n## Your Workflow\n\nWhen the user types `\u002Fsponsor {owner\u002Frepo}` or provides a repository in `owner\u002Frepo` format:\n\n1. **Parse the input** — Extract `owner` and `repo`.\n2. **Detect the ecosystem** — Fetch manifest to determine package name + version.\n3. **Get full dependency tree** — deps.dev `GetDependencies` (one call).\n4. **Resolve repos** — deps.dev `GetVersion` for each dep → `relatedProjects` gives GitHub repo.\n5. **Get project health** — deps.dev `GetProject` for unique repos → OSSF Scorecard.\n6. **Find funding links** — npm `funding` field, FUNDING.yml, web search fallback.\n7. **Verify every link** — fetch each URL to confirm it's live.\n8. **Group and report** — by funding destination, sorted by impact.\n\n---\n\n## Step 1: Detect Ecosystem and Package\n\nUse `get_file_contents` to fetch the manifest from the target repo. Determine the ecosystem and extract the package name + latest version:\n\n| File | Ecosystem | Package name from | Version from |\n|------|-----------|-------------------|--------------|\n| `package.json` | NPM | `name` field | `version` field |\n| `requirements.txt` | PYPI | list of package names | use latest (omit version in deps.dev call) |\n| `pyproject.toml` | PYPI | `[project.dependencies]` | use latest |\n| `Cargo.toml` | CARGO | `[package] name` | `[package] version` |\n| `go.mod` | GO | `module` path | extract from go.mod |\n| `Gemfile` | RUBYGEMS | gem names | use latest |\n| `pom.xml` | MAVEN | `groupId:artifactId` | `version` |\n\n---\n\n## Step 2: Get Full Dependency Tree (deps.dev)\n\n**This is the key step.** Use `web_fetch` to call the deps.dev API:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002F{ECOSYSTEM}\u002Fpackages\u002F{PACKAGE}\u002Fversions\u002F{VERSION}:dependencies\n```\n\nFor example:\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002Fnpm\u002Fpackages\u002Fexpress\u002Fversions\u002F5.2.1:dependencies\n```\n\nThis returns a `nodes` array where each node has:\n- `versionKey.name` — package name\n- `versionKey.version` — resolved version\n- `relation` — `\"SELF\"`, `\"DIRECT\"`, or `\"INDIRECT\"`\n\n**This single call gives you the entire dependency tree** — both direct and transitive — with exact resolved versions. No need to parse lockfiles.\n\n### URL encoding\nPackage names containing special characters must be percent-encoded:\n- `@colors\u002Fcolors` → `%40colors%2Fcolors`\n- Encode `@` as `%40`, `\u002F` as `%2F`\n\n### For repos without a single root package\nIf the repo doesn't publish a package (e.g., it's an app not a library), fall back to reading `package.json` dependencies directly and calling deps.dev `GetVersion` for each.\n\n---\n\n## Step 3: Resolve Each Dependency to a GitHub Repo (deps.dev)\n\nFor each dependency from the tree, call deps.dev `GetVersion`:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fsystems\u002F{ECOSYSTEM}\u002Fpackages\u002F{NAME}\u002Fversions\u002F{VERSION}\n```\n\nFrom the response, extract:\n- **`relatedProjects`** → look for `relationType: \"SOURCE_REPO\"` → `projectKey.id` gives `github.com\u002F{owner}\u002F{repo}`\n- **`links`** → look for `label: \"SOURCE_REPO\"` → `url` field\n\nThis works across **all ecosystems** — npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet — with the same field structure.\n\n### Efficiency rules\n- Process in batches of **10 at a time**.\n- Deduplicate — multiple packages may map to the same repo.\n- Skip deps where no GitHub project is found (count as \"unresolvable\").\n\n---\n\n## Step 4: Get Project Health Data (deps.dev)\n\nFor each unique GitHub repo, call deps.dev `GetProject`:\n\n```\nhttps:\u002F\u002Fapi.deps.dev\u002Fv3\u002Fprojects\u002Fgithub.com%2F{owner}%2F{repo}\n```\n\nFrom the response, extract:\n- **`scorecard.checks`** → find the `\"Maintained\"` check → `score` (0–10)\n- **`starsCount`** — popularity indicator\n- **`license`** — project license\n- **`openIssuesCount`** — activity indicator\n\nUse the Maintained score to label project health:\n- Score 7–10 → ⭐ Actively maintained\n- Score 4–6 → ⚠️ Partially maintained\n- Score 0–3 → ? Possibly unmaintained\n\n### Efficiency rules\n- Only fetch for **unique repos** (not per-package).\n- Process in batches of **10 at a time**.\n- This step is optional — skip if rate-limited and note in output.\n\n---\n\n## Step 5: Find Funding Links\n\nFor each unique GitHub repo, check for funding information using three sources in order:\n\n### 5a: npm `funding` field (npm ecosystem only)\nUse `web_fetch` on `https:\u002F\u002Fregistry.npmjs.org\u002F{package-name}\u002Flatest` and check for a `funding` field:\n- **String:** `\"https:\u002F\u002Fgithub.com\u002Fsponsors\u002Fsindresorhus\"` → use as URL\n- **Object:** `{\"type\": \"opencollective\", \"url\": \"https:\u002F\u002Fopencollective.com\u002Fexpress\"}` → use `url`\n- **Array:** collect all URLs\n\n### 5b: `.github\u002FFUNDING.yml` (repo-level, then org-level fallback)\n\n**Step 5b-i — Per-repo check:**\nUse `get_file_contents` to fetch `{owner}\u002F{repo}` path `.github\u002FFUNDING.yml`.\n\n**Step 5b-ii — Org\u002Fuser-level fallback:**\nIf 5b-i returned 404 (no FUNDING.yml in the repo itself), check the owner's default community health repo:\nUse `get_file_contents` to fetch `{owner}\u002F.github` path `FUNDING.yml`.\n\nGitHub supports a [default community health files](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcommunities\u002Fsetting-up-your-project-for-healthy-contributions\u002Fcreating-a-default-community-health-file) convention: a `.github` repository at the user\u002Forg level provides defaults for all repos that lack their own. For example, `isaacs\u002F.github\u002FFUNDING.yml` applies to all `isaacs\u002F*` repos.\n\nOnly look up each unique `{owner}\u002F.github` repo **once** — reuse the result for all repos under that owner. Process in batches of **10 owners at a time**.\n\nParse the YAML (same for both 5b-i and 5b-ii):\n- `github: [username]` → `https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{username}`\n- `open_collective: slug` → `https:\u002F\u002Fopencollective.com\u002F{slug}`\n- `ko_fi: username` → `https:\u002F\u002Fko-fi.com\u002F{username}`\n- `patreon: username` → `https:\u002F\u002Fpatreon.com\u002F{username}`\n- `tidelift: platform\u002Fpackage` → `https:\u002F\u002Ftidelift.com\u002Fsubscription\u002Fpkg\u002F{platform-package}`\n- `custom: [urls]` → use as-is\n\n### 5c: Web search fallback\nFor the **top 10 unfunded dependencies** (by number of transitive dependents), use `web_search`:\n```\n\"{package name}\" github sponsors OR open collective OR funding\n```\nSkip packages known to be corporate-maintained (React\u002FMeta, TypeScript\u002FMicrosoft, @types\u002FDefinitelyTyped).\n\n### Efficiency rules\n- **Check 5a and 5b for all deps.** Only use 5c for top unfunded ones.\n- Skip npm registry calls for non-npm ecosystems.\n- Deduplicate repos — check each repo only once.\n- **One `{owner}\u002F.github` check per unique owner** — reuse the result for all their repos.\n- Process org-level lookups in batches of **10 owners at a time**.\n\n---\n\n## Step 6: Verify Every Link (CRITICAL)\n\n**Before including ANY funding link, verify it exists.**\n\nUse `web_fetch` on each funding URL:\n- **Valid page** → ✅ Include\n- **404 \u002F \"not found\" \u002F \"not enrolled\"** → ❌ Exclude\n- **Redirect to valid page** → ✅ Include final URL\n\nVerify in batches of **5 at a time**. Never present unverified links.\n\n---\n\n## Step 7: Output the Report\n\n### Output discipline\n\n**Minimize intermediate output during data gathering.** Do NOT announce each batch (\"Batch 3 of 7…\", \"Now checking funding…\"). Instead:\n- Show **one brief status line** when starting each major phase (e.g., \"Resolving 67 dependencies…\", \"Checking funding links…\")\n- **Collect ALL data before producing the report.** Never drip-feed partial tables.\n- Output the final report as a **single cohesive block** at the end.\n\n### Report template\n\n```\n## ? Sponsor Finder Report\n\n**Repository:** {owner}\u002F{repo} · {ecosystem} · {package}@{version}\n**Scanned:** {date} · {total} deps ({direct} direct + {transitive} transitive)\n\n---\n\n### ? Ways to Give Back\n\nSponsoring just {N} people\u002Forgs supports {sponsorable} of your {total} dependencies — a great way to invest in the open source your project depends on.\n\n1. **? @{user}** — {N} direct + {M} transitive deps · ⭐ Maintained\n   {dep1}, {dep2}, {dep3}, ...\n   https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{user}\n\n2. **? Open Collective: {name}** — {N} direct + {M} transitive deps · ⭐ Maintained\n   {dep1}, {dep2}, {dep3}, ...\n   https:\u002F\u002Fopencollective.com\u002F{name}\n\n3. **? @{user2}** — {N} direct dep · ? Low activity\n   {dep1}\n   https:\u002F\u002Fgithub.com\u002Fsponsors\u002F{user2}\n\n---\n\n### ? Coverage\n\n- **{sponsorable}\u002F{total}** dependencies have funding options ({percentage}%)\n- **{destinations}** unique funding destinations\n- **{unfunded_direct}** direct deps don't have funding set up yet ({top_names}, ...)\n- All links verified ✅\n```\n\n### Report format rules\n\n- **Lead with \"? Ways to Give Back\"** — this is the primary output. Numbered list, sorted by total deps covered (descending).\n- **Bare URLs on their own line** — not wrapped in markdown link syntax. This ensures they're clickable in any terminal emulator.\n- **Inline dep names** — list the covered dependency names in a comma-separated line under each sponsor, so the user sees exactly what they're funding.\n- **Health indicator inline** — show ⭐\u002F⚠️\u002F? next to each destination, not in a separate table column.\n- **One \"? Coverage\" section** — compact stats. No separate \"Verified Funding Links\" table, no \"No Funding Found\" table.\n- **Unfunded deps as a brief note** — just the count + top names. Frame as \"don't have funding set up yet\" rather than highlighting a gap. Never shame projects for not having funding — many maintainers prefer other forms of contribution.\n- ? GitHub Sponsors, ? Open Collective, ☕ Ko-fi, ? Other\n- Prioritize GitHub Sponsors links when multiple funding sources exist for the same maintainer.\n\n---\n\n## Error Handling\n\n- If deps.dev returns 404 for the package → fall back to reading the manifest directly and resolving via registry APIs.\n- If deps.dev is rate-limited → note partial results, continue with what was fetched.\n- If `get_file_contents` returns 404 for the repo → inform user repo may not exist or is private.\n- If link verification fails → exclude the link silently.\n- Always produce a report even if partial — never fail silently.\n\n---\n\n## Critical Rules\n\n1. **NEVER present unverified links.** Fetch every URL before showing it. 5 verified links > 20 guessed links.\n2. **NEVER guess from training knowledge.** Always check — funding pages change over time.\n3. **Always be encouraging, never shaming.** Frame results positively — celebrate what IS funded, and treat unfunded deps as an opportunity, not a failing. Not every project needs or wants financial sponsorship.\n4. **Lead with action.** The \"? Ways to Give Back\" section is the primary output — bare clickable URLs, grouped by destination.\n5. **Use deps.dev as primary resolver.** Fall back to registry APIs only if deps.dev is unavailable.\n6. **Always use GitHub MCP tools** (`get_file_contents`), `web_fetch`, and `web_search` — never clone or shell out.\n7. **Be efficient.** Batch API calls, deduplicate repos, check each owner's `.github` repo only once.\n8. **Focus on GitHub Sponsors.** Most actionable platform — show others but prioritize GitHub.\n9. **Deduplicate by maintainer.** Group to show real impact of sponsoring one person.\n10. **Show the actionable minimum.** Tell users the fewest sponsorships to support the most deps.\n11. **Minimize intermediate output.** Don't announce each batch. Collect all data, then output one cohesive report.\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Fsponsor-finder",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add github\u002Fawesome-copilot --skill sponsor-finder",{"tool":66,"command":67},"bunx","bunx skills add github\u002Fawesome-copilot --skill sponsor-finder",{"tool":69,"command":70},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill sponsor-finder","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsponsor-finder\u002FSKILL.md",true,[],[75,110,138,168,200,217],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":89,"publishedAt":45},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[81,86],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":87,"categoryName":88,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000023","Skill与智能体开发",[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109],"supabase","rls","supabase rls","supabase rls policies","project","when","review","change","read","write","security","isolation","tables","as","tests","prove","use","users","functions","with",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":45},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[116],{"categoryNo":87,"categoryName":88,"taxonomyType":84,"taxonomyTypeDesc":85},[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"distribution","skill distribution audit","audit","SET","deterministic","installer","for","discovery","comparison","helper","manifest","version","collection","drift","output","investigate","duplicate","template","release","reconcile",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":150,"publishedAt":45},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[151,152,153,154,155,156,124,94,157,158,159,160,161,162,163,106,164,165,166,167],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging","workflows",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":172,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":45},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},[180,40,20,181,182,183,184,185,186,187,188,189,190,191,192,95,193,194,195,196,197,124,198,199],"winmd api search","windows","desktop","file access","enumeration","ui","ml","file","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":204,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":213,"publishedAt":45},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[208,209,212],{"categoryNo":176,"categoryName":177,"taxonomyType":84,"taxonomyTypeDesc":85},{"categoryNo":210,"categoryName":211,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":87,"categoryName":88,"taxonomyType":84,"taxonomyTypeDesc":85},[214,121,187,215,216],"resemble detect","https","identity",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":204,"licenseFileUrl":221,"sourceHtmlUrl":222,"categories":223,"keywords":228,"publishedAt":45},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[224,227],{"categoryNo":225,"categoryName":226,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":87,"categoryName":88,"taxonomyType":84,"taxonomyTypeDesc":85},[229,230,231,232,152,96,9,120,233,234,215,235,236,237,238,239,240,241,242,243,244,245,104,246,247,248,249],"playbook","quality playbook","quality","code review","tdd","run","report","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]