Skills nx-workspace

📦

nx-workspace

Name: nx-workspace
Author: nrwl

Content revision r1 Medium Risk ⚙️ External commands

Explore and Diagnose Nx Workspaces

Nx monorepos hide resolved targets, dependencies, and affected projects behind layered configuration. This skill uses Nx JSON output and command-line filters to produce precise workspace answers.

Supports: Claude Codex Code(CC)

📊 66 Adequate

Maintain this Skill? Claim it 📊 66 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "nx-workspace" from https://skillstore.io/skills/nrwl-nx-workspace.md and its manifest at https://skillstore.io/api/skills/nrwl-nx-workspace/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/nrwl-nx-workspace.md Signed manifest GET /api/skills/nrwl-nx-workspace/manifest Signed lockfile GET /api/skills/nrwl-nx-workspace/lockfile

Test it

Using "nx-workspace". List applications and show which ones provide a build target.

Expected outcome:

Applications: storefront, admin, and api. storefront and admin provide build targets; api exposes serve and test only.

Using "nx-workspace". What depends on shared-ui?

Expected outcome:

Direct dependents: storefront and admin. No other project has a direct dependency on shared-ui.

Using "nx-workspace". Why does api:lint fail with missing configuration?

Expected outcome:

The resolved api configuration has build, serve, and test targets, but no lint target. Add or infer lint configuration before running api:lint.

Security Audit

Medium Risk

v1 • 8/27/2026 Open versioned report

All 47 external-command findings are false positives caused by Markdown backticks and fenced examples, not Ruby or shell command substitution. Both sensitive-file findings are jq `.key` projections, not certificate or private-key access. Semantic review found that `nx sync` and `nx reset` can alter workspace or cache state despite the read-only claim.

Files scanned

315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:8 SKILL.md:283-285

Read-only Claim Conflicts With State-changing Commands

The skill declares read-only exploration, then recommends nx sync and nx reset. These commands can change workspace files or clear local Nx state.

The contradiction is explicit. Nx sync and nx reset are operational commands rather than read-only inspection.

Risk Factors

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/nrwl-nx-workspace/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/nrwl-nx-workspace/security.svg)](https://skillstore.io/skills/nrwl-nx-workspace?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/nrwl-nx-workspace?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nrwl-nx-workspace/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/nrwl-nx-workspace.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

nrwl. (2026). nx-workspace security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/nrwl-nx-workspace/audits/1

BibTeX citation

@techreport{nrwl-nrwl-nx-workspace-2026,
  author = {nrwl},
  title = {nx-workspace security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/nrwl-nx-workspace/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nx-workspace security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "nrwl"
date-released: "2026-08-27"
url: "https://skillstore.io/skills/nrwl-nx-workspace/audits/1"
identifiers:
  - type: other
    value: "skillstore:nrwl-nx-workspace:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Map an unfamiliar monorepo

List applications and libraries, inspect their tags, and trace dependencies before making a change.

Audit target configuration

Compare resolved build, test, and lint targets across projects without relying on partial project files.

Scope continuous integration

Identify affected projects for a branch or commit range and confirm each required target exists.

Try These Prompts

List workspace projects

List every project in this Nx workspace. Group applications and libraries, then note each project with a build target.

Inspect one project

Inspect the resolved configuration for [project]. Summarize its root, tags, targets, executors, inputs, and outputs.

Trace dependencies

Show what [project] depends on and which projects depend on it. Use the Nx project graph and summarize dependency types.

Diagnose an affected target

Find projects affected between [base] and [head]. Verify their [target] configuration and explain any missing or inconsistent targets.

Best Practices

Use Nx JSON output for project, target, and graph questions.
Inspect resolved project configuration instead of relying only on project.json.
Review repository trust and pending changes before running any state-changing command.

Avoid

Do not count or parse complex terminal output manually when structured output exists.
Do not assume every project exposes standard build, test, or lint targets.
Do not run nx sync or nx reset as read-only diagnostics without explicit approval.

Frequently Asked Questions

Does this skill change source files?

Most exploration commands are read-only. The documented nx sync command can update workspace files, so review and approve it separately.

Does it require a global Nx installation?

No. It can use npx, pnpx, or yarn according to the workspace package manager and lockfile.

Why inspect resolved project configuration?

Nx plugins can infer targets that project.json does not contain. The resolved configuration includes those inferred targets.

Can it find affected projects?

Yes. It supports automatic bases, explicit branches, commit ranges, uncommitted changes, and untracked files.

Can it explain project dependencies?

Yes. It uses printed project graph data to identify dependencies and reverse dependents.

What tools improve structured analysis?

Nx JSON output is primary. jq supports filtering, selection, counting, and extraction from that output.

Developer Details

Author

nrwl

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/nrwl/nx-ai-agents-config/tree/aa363e4a85f11d836c21e5d1e7f6c333caab2590/skills/nx-workspace

Ref

f6cdb76d1aa56a8781522efba21cd0d656ccc802

Maintenance freshness

8/28/2026

Usage

1 downloads · 0 views

File structure

📁 references/

📄 AFFECTED.md

📄 SKILL.md