monorepo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited monorepo (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--tool=TOOL — force a specific monorepo tool: turborepo, nx, pnpm, yarn--migrate — migrate from multi-repo or single-package to monorepo structure--packages=LIST — comma-separated list of package directories to include (e.g., apps/web,apps/api,packages/shared)--remote-cache — set up remote caching (Vercel for Turborepo, Nx Cloud for Nx)--from=REPOS — comma-separated git repos to merge into monorepo (for multi-repo migration)If no arguments, detect existing setup and optimize it, or scaffold a new monorepo if none exists.
============================================================ PHASE 1 — DETECT CURRENT STATE ============================================================
Determine if the project is already a monorepo, a single package, or multi-repo:
Monorepo Indicators:
turbo.json → existing Turborepo setupnx.json → existing Nx setuppnpm-workspace.yaml → pnpm workspaceslerna.json → Lerna (legacy, suggest migration)package.json with "workspaces" field → npm/yarn workspacespackage.json files in subdirectoriesSingle Package Indicators:
package.json at root, no workspace configpyproject.toml at rootgo.mod at rootCargo.toml at root (check for [workspace] section)Detect Existing Structure:
apps/, packages/, libs/, services/, modules/ directoriestsconfig.json project references, vite.config.*, webpack.config.*Record: current state (monorepo/single/multi), tool (if any), packages found, language.
============================================================ PHASE 2 — SELECT MONOREPO TOOL ============================================================
If no tool is specified, select based on detected stack:
Turborepo (recommended for most Node.js/TypeScript projects):
Nx (recommended for large/enterprise projects):
pnpm workspaces (recommended for lightweight needs):
Cargo workspaces (for Rust):
[workspace] in root Cargo.tomlGo workspaces (for Go):
go.work file (Go 1.22+)============================================================ PHASE 3 — SCAFFOLD OR MIGRATE ============================================================
3.1 — If starting fresh (no existing monorepo):
Create the directory structure:
.
├── apps/
│ ├── web/ # Frontend application
│ └── api/ # Backend application
├── packages/
│ ├── shared/ # Shared types, utils, constants
│ ├── ui/ # Shared UI components (if frontend)
│ ├── config/ # Shared configs (eslint, tsconfig, tailwind)
│ └── db/ # Database client and migrations (if applicable)
├── turbo.json # or nx.json
├── package.json # Root workspace config
├── pnpm-workspace.yaml # if using pnpm
└── tsconfig.json # Root tsconfig with project referencesAdjust based on --packages if provided.
3.2 — If migrating from single package (`--migrate`):
apps/ and packages/ directoriesapps/{name}/packages/shared/:3.3 — If migrating from multi-repo (`--from=REPOS`):
--from list:apps/{repo-name}/ or packages/{repo-name}/package.jsonpackages/shared/packages/config/============================================================ PHASE 4 — CONFIGURE WORKSPACE ============================================================
4.1 — Package Manager Workspace Config:
For pnpm (create pnpm-workspace.yaml):
packages:
- 'apps/*'
- 'packages/*'For npm/yarn (add to root package.json):
{
"workspaces": ["apps/*", "packages/*"]
}4.2 — Shared Package Setup:
For each package in packages/:
package.json with "name": "@{scope}/{package-name}""main" and "types" entry points"private": true if not publishedtsconfig.json extending root config with "composite": trueFor apps referencing shared packages:
"@{scope}/shared": "workspace:*"tsconfig.json to include project reference: "references": [{ "path": "../packages/shared" }]4.3 — Root TypeScript Config (if TypeScript):
Create root tsconfig.json:
{
"compilerOptions": {
"composite": true,
"declaration": true,
"declarationMap": true,
"incremental": true
},
"references": [
{ "path": "apps/web" },
{ "path": "apps/api" },
{ "path": "packages/shared" }
]
}============================================================ PHASE 5 — CONFIGURE BUILD PIPELINE ============================================================
5.1 — Turborepo Config (if selected):
Create turbo.json:
{
"$schema": "https://turbo.build/schema.json",
"globalDependencies": ["**/.env.*local"],
"tasks": {
"build": {
"dependsOn": ["^build"],
"outputs": ["dist/**", ".next/**", "build/**"]
},
"lint": {
"dependsOn": ["^build"]
},
"typecheck": {
"dependsOn": ["^build"]
},
"test": {
"dependsOn": ["^build"]
},
"dev": {
"cache": false,
"persistent": true
}
}
}Add scripts to root package.json:
{
"scripts": {
"build": "turbo run build",
"dev": "turbo run dev",
"lint": "turbo run lint",
"test": "turbo run test",
"typecheck": "turbo run typecheck"
}
}5.2 — Nx Config (if selected):
Create nx.json:
{
"$schema": "https://raw.githubusercontent.com/nrwl/nx/master/packages/nx/schemas/nx-schema.json",
"targetDefaults": {
"build": {
"dependsOn": ["^build"],
"cache": true
},
"lint": { "cache": true },
"test": { "cache": true }
},
"defaultBase": "main",
"namedInputs": {
"default": ["{projectRoot}/**/*", "sharedGlobals"],
"sharedGlobals": ["{workspaceRoot}/tsconfig.base.json"],
"production": ["default", "!{projectRoot}/**/*.spec.ts"]
}
}Create project.json in each package/app with targets.
5.3 — Caching:
Local caching is enabled by default for both Turborepo and Nx.
For remote caching (if --remote-cache):
npx turbo login && npx turbo link (Vercel Remote Cache)turbo.json with "remoteCache": { "signature": true }npx nx connect (Nx Cloud)nx-cloud.env with access token============================================================ PHASE 6 — CONFIGURE CI ============================================================
Create or update .github/workflows/ci.yml for affected-only builds:
Turborepo CI:
name: CI
on:
pull_request:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm turbo run lint typecheck test build --filter=...[HEAD~1]Nx CI:
- run: npx nx affected --target=lint --base=origin/main
- run: npx nx affected --target=test --base=origin/main
- run: npx nx affected --target=build --base=origin/main============================================================ PHASE 7 — VERIFY SETUP ============================================================
pnpm install (or npm/yarn equivalent)pnpm turbo run build (or npx nx run-many --target=build)pnpm turbo run build --dry or npx nx graphFix any issues found during verification.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print a summary:
## Monorepo Setup Complete
### Tool: {Turborepo | Nx | pnpm workspaces}
### Package Manager: {pnpm | npm | yarn}
### Workspace Structure
- apps/web — {description}
- apps/api — {description}
- packages/shared — {description}
- packages/config — {description}
### Task Pipeline
- build: depends on ^build, cached, outputs: dist/**
- lint: cached
- test: cached
- dev: not cached, persistent
### Caching
- Local: enabled ({cache directory})
- Remote: {configured with Vercel/Nx Cloud | not configured}
### CI Configuration
- .github/workflows/ci.yml — affected-only builds on PRs
### Files Created/Modified
- {list of files}============================================================ NEXT STEPS ============================================================
pnpm dev to start all apps in development modepackages/, add package.json, run pnpm install/release --monorepo to set up versioning with changesets/linter to set up shared lint config in packages/config/--remote-cache flag============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /monorepo — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
* version ranges for workspace dependencies — use workspace:* (pnpm) or * (npm/yarn)--remote-cache flag — it requires authentication~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.