Skills setup-ts-deep-modules
📦

setup-ts-deep-modules

Content revision r1 Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access

Enforce TypeScript Package Boundaries

Deep imports expose internal TypeScript package code and weaken architecture. This skill installs dependency-cruiser rules, validates failures, and documents stable entry-point boundaries.

Supports: Claude Codex Code(CC)
📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "setup-ts-deep-modules" from https://skillstore.io/skills/mattpocock-setup-ts-deep-modules.md and its manifest at https://skillstore.io/api/skills/mattpocock-setup-ts-deep-modules/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mattpocock-setup-ts-deep-modules.md Signed manifest GET /api/skills/mattpocock-setup-ts-deep-modules/manifest Signed lockfile GET /api/skills/mattpocock-setup-ts-deep-modules/lockfile

Test it

Using "setup-ts-deep-modules". Configure deep modules for a repository using pnpm and packages under src/packages.

Expected outcome:

  • Detected pnpm and the src/packages root.
  • Added dependency-cruiser boundary rules and a lint:boundaries script.
  • Verified a clean pass, an intentional deep-import failure, and a restored pass.

Using "setup-ts-deep-modules". Merge the rules into a repository that already has dependency-cruiser configuration.

Expected outcome:

Preserved existing rules, added four package-boundary checks, retained current resolver options, and reported the merged validation results.

Using "setup-ts-deep-modules". Document the new package convention for contributors and coding agents.

Expected outcome:

Created concise package guidance covering entry points, private folders, tests, cycle checks, and the validation command. Added a pointer from agent instructions.

Security Audit

Medium Risk
v2 • 7/12/2026 Open versioned report

All 48 static findings are false positives caused by JSDoc imports, JavaScript template literals, Markdown formatting, documentation links, and fixed relative TypeScript imports. No prompt injection, data exfiltration, or unsafe path traversal was found. The skill still installs a third-party package and runs repository scripts, creating a legitimate medium execution and supply-chain risk.

2
Files scanned
199
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
SKILL.md:47-51SKILL.md:59-65SKILL.md:79-87
Package Installation and Repository Command Execution
The skill installs a third-party development dependency and runs repository scripts. Package lifecycle hooks and existing umbrella scripts may execute code from the dependency graph.
The instructions explicitly require dependency installation and repeated script execution. This is legitimate setup behavior, but the execution and supply-chain exposure are direct.

Risk Factors

⚡ Contains scripts (2)
dependency-cruiser.config.cjs:26 dependency-cruiser.config.cjs:77
⚙️ External commands (43)
dependency-cruiser.config.cjs:7 dependency-cruiser.config.cjs:24 dependency-cruiser.config.cjs:34 dependency-cruiser.config.cjs:43 dependency-cruiser.config.cjs:46 dependency-cruiser.config.cjs:54 dependency-cruiser.config.cjs:57 dependency-cruiser.config.cjs:65 dependency-cruiser.config.cjs:66 dependency-cruiser.config.cjs:70 dependency-cruiser.config.cjs:84 dependency-cruiser.config.cjs:85 SKILL.md:11 SKILL.md:15-22 SKILL.md:22-24 SKILL.md:24 SKILL.md:26-30 SKILL.md:30 SKILL.md:33 SKILL.md:41 SKILL.md:42 SKILL.md:43-49 SKILL.md:49-51 SKILL.md:51 SKILL.md:55 SKILL.md:57 SKILL.md:61 SKILL.md:62 SKILL.md:63-65 SKILL.md:65-69 SKILL.md:69-71 SKILL.md:71-72 SKILL.md:72 SKILL.md:73 SKILL.md:77-83 SKILL.md:83-84 SKILL.md:84 SKILL.md:91 SKILL.md:93 SKILL.md:95 SKILL.md:99-100 SKILL.md:100 SKILL.md:102
🌐 Network access (1)
SKILL.md:9
📁 Filesystem access (2)
SKILL.md:73 SKILL.md:84
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/mattpocock-setup-ts-deep-modules/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mattpocock-setup-ts-deep-modules/security.svg)](https://skillstore.io/skills/mattpocock-setup-ts-deep-modules?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mattpocock-setup-ts-deep-modules?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mattpocock-setup-ts-deep-modules/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mattpocock-setup-ts-deep-modules.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

mattpocock. (2026). setup-ts-deep-modules security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mattpocock-setup-ts-deep-modules/audits/2

BibTeX citation

@techreport{mattpocock-mattpocock-setup-ts-deep-modules-2026, author = {mattpocock}, title = {setup-ts-deep-modules security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/mattpocock-setup-ts-deep-modules/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup-ts-deep-modules security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "mattpocock" date-released: "2026-07-12" url: "https://skillstore.io/skills/mattpocock-setup-ts-deep-modules/audits/2" identifiers: - type: other value: "skillstore:mattpocock-setup-ts-deep-modules:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Protect Monorepo Package Internals

Add enforceable entry-point boundaries across TypeScript packages while allowing internal implementation freedom.

Standardize a Growing Codebase

Create a repeatable package layout, validation command, and contributor documentation for a growing repository.

Prevent Fragile Deep Imports

Make tests and application code consume public package interfaces instead of private implementation files.

Try These Prompts

Set Up Deep Modules 
Configure deep module boundaries in this TypeScript repository. Detect the package manager, confirm the packages root, and preserve existing configuration.
Add Boundary Checks 
Install dependency-cruiser and add entry-point boundary checks to the current validation script. Show every changed file and command result.
Merge Existing Configuration 
Merge deep module rules into the existing dependency-cruiser configuration. Keep current rules, adapt the packages root, and verify all checks.
Validate Complex Package Boundaries 
Audit this TypeScript package structure, enforce entry-point access, test an intentional deep import failure, restore the repository, and document remaining exceptions.

Best Practices

  • Review the detected package manager, packages root, and existing configuration before applying changes.
  • Keep public entry points small and place implementation details in package subfolders.
  • Verify one passing check, one intentional failing deep import, and one restored passing check.

Avoid

  • Do not overwrite an existing dependency-cruiser configuration.
  • Do not expose entire implementation trees through large barrel files.
  • Do not finish while the intentional deep-import violation still passes.

Frequently Asked Questions

What is a deep module in this skill?
A deep module exposes a small public surface through package-root files while keeping implementation files inside private subfolders.
Does every package need one index file?
No. Each root file can be a focused entry point, such as index, client, or server.
Which package managers are supported?
The workflow detects pnpm, Yarn, Bun, or npm from repository lockfiles.
Will existing dependency-cruiser rules be replaced?
No. The skill instructs the agent to merge its rules and preserve the existing configuration.
Does the skill enforce package layering?
No. It provides a commented layering example, but repository-specific dependency directions remain for maintainers to define.
How does the skill prove the rules work?
It runs a clean check, adds an intentional deep import that must fail, removes it, and confirms the check passes again.

Developer Details

Author

mattpocock

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/mattpocock/skills/tree/main/skills/in-progress/setup-ts-deep-modules/

Ref

c47a0d6818048b11e035c26cf0a679adb938020c

Maintenance freshness

7/18/2026

Usage

0 downloads · 0 views

File structure

📄 dependency-cruiser.config.cjs

📄 SKILL.md