monorepo-navigator
v1.0.0Monorepo Navigator
⭐ 0· 260·4 current·4 all-time
byAlireza Rezvani@alirezarezvani
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (monorepo tooling) matches the content: Turborepo, Nx, pnpm, changesets, dependency-graph generation, migration steps, CI patterns, and CLAUDE.md guidance are all within the stated purpose. The SKILL.md does reference remote-cache tokens (TURBO_TOKEN, TURBO_TEAM) and DATABASE_URL in example configs, which are relevant to CI/remote-cache setup for monorepos; their mention is appropriate for this domain even though the skill metadata does not declare required env vars.
Instruction Scope
The instructions include shell commands and example scripts that will read and write repository files, run Node (execSync), generate files, perform git operations (git clone, git filter-repo, git merge --allow-unrelated-histories), and contact remote services (Vercel/turbo remote cache, GitHub). These are expected for migration and build tooling, but some operations are destructive (git filter-repo rewrites history, merges with allow-unrelated-histories) and should be run only with backups and review. The skill does not instruct the agent to access unrelated system secrets or non-repo system paths.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is downloaded or written by an installer. Example scripts are provided for users to run themselves; the skill does not perform installs automatically.
Credentials
The SKILL.md references environment variables that are reasonable for CI and remote caching (TURBO_TOKEN, TURBO_TEAM, TURBO_API, NODE_ENV, DATABASE_URL). The skill metadata does not declare required env vars, which is acceptable for an instruction-only guide, but users should be aware examples assume those variables may exist and be used by the commands. No unrelated third-party credentials are requested.
Persistence & Privilege
The skill is not always-enabled, is user-invocable, has no install actions, and does not request persistent platform privileges. It does not modify other skills' configs or platform-wide settings.
Assessment
This is a coherent, instruction-only monorepo guide. Before running anything from it: 1) review any commands that rewrite git history (git filter-repo) and make backups (clone, create tags, or mirror the repo) — those commands are destructive if misused; 2) inspect any example scripts that execute shell commands (the Node execSync example) before running them in your workspace; 3) remote cache configuration mentions TURBO_TOKEN / TURBO_TEAM / TURBO_API — only provide tokens or point caches at servers you trust (a malicious or misconfigured cache endpoint could receive build artifacts or metadata); 4) the examples clone from example GitHub URLs — replace with your real remotes and avoid running commands that fetch/merge unknown repos. If you want greater assurance, ask the skill author for a smaller, non-destructive demo or run commands in an isolated sandbox copy of your repo first.Like a lobster shell, security has layers — review code before you run it.
latestvk97d8g5h7175hrj7sbhzbp27k582q2br
License
MIT-0
Free to use, modify, and redistribute. No attribution required.