Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add devcxl/mattpocock-skills-zh --skill setup-ts-deep-modulesgit clone --depth 1 https://github.com/devcxl/mattpocock-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/setup-ts-deep-modules)<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/setup-ts-deep-modules"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/setup-ts-deep-modules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/setup-ts-deep-modules"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/setup-ts-deep-modules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.02140 |
| Opus 5 | $0.00024 | $0.01070 |
| Sonnet 5 | $0.00010 | $0.00428 |
| Haiku 4.5 | $0.00005 | $0.00214 |
Grade A, and why
setup-ts-deep-modules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
设置 TS 深度模块
让此仓库中的每个 package 都成为一个深度模块：小接口背后隐藏大量行为。一个 package 的公开表面是其入口点：package 根目录下的文件：而其子文件夹中的所有内容都是隐藏的。本技能安装 dependency-cruiser 与让入口点成为唯一通路的规则，然后验证规则确实起作用。
关于相关词汇（深度模块、接口、接缝、depth），请调用 Skill 工具并传入 "codebase-design"：在后续内容中使用它的术语。
它强制形成的结构
src/packages/
<name>/
index.ts ← 一个入口点（公开）。外部从这里导入。
client.ts ← 另一个入口点。Package 可以暴露多个。
lib/ ← 实现：对外部隐藏，内部可以自由相互导入。
tests/ ← 与实现并列的测试与 fixtures（一个子文件夹，所以是私有的）。
公开表面是 package 的根文件，而不是某个指定的 index.ts。按惯例实现放在 lib/，测试放在 tests/，让每个 package 都拥有相同的"两个子文件夹"结构。不过规则本身是普适的：任何子文件夹里的任何文件都是私有的，所以你永远不需要为了新增文件夹而扩展配置。
四条规则，全部为 error：
- 入口点边界：package 外部的代码（应用代码或其他 package）只能导入该 package 的入口点（即其根文件），绝不能导入其子文件夹中的任何内容。
- 包内自由：package 自己的文件可以自由地相互导入。
- 测试通过入口点：
<pkg>/tests/下的文件可以导入任何 package 的入口点以及它自己的tests/fixtures，但不能导入任何 package 的子文件夹内部内容（包括它自己的）。跨 package 的集成测试可以，但深路径导入不行。 - 无循环依赖：不允许存在依赖循环。
入口点，而非桶文件（barrel）。 由于公开表面是每个根文件，所以一个 package 可以暴露多个小型入口点（index.ts、client.ts、server.ts），而不是把一切都集中塞进一个巨大的 index.ts。不要用桶文件来再导出整棵子树；保持入口点小而精，把实现藏在子文件夹里。
分层（哪些 package 可以依赖哪些 package）是另一回事，本仓库把它以注释桩（commented stub）的形式留在配置里供填充。
流程
1. 探测环境
- 包管理器：
pnpm-lock.yaml→ pnpm；yarn.lock→ yarn；bun.lockb→ bun；否则 npm。后续所有命令都使用该包管理器（pnpm/yarn/npm run/bunx）。 - packages 根目录：如果存在
src/则使用src/packages，否则使用packages。如果仓库已经有明显不同的约定，请与用户确认。 - 已有配置：检查是否存在
.dependency-cruiser.*文件。若已有，不要覆盖：把四条规则与 options 合并进去，并告知用户你新增了什么。
**完成条件：**包管理器、packages 根目录、是否有已有配置：这三项都已确认。
2. 安装 dependency-cruiser
使用上面探测到的包管理器，把 dependency-cruiser 安装为 devDependency。
完成条件：dependency-cruiser 已出现在 devDependencies 中。
3. 写入配置
将 dependency-cruiser.config.cjs 复制到仓库根目录，命名为 .dependency-cruiser.cjs。把 PACKAGES_ROOT 设置为步骤 1 探测到的根目录。规则是基于路径深度且与扩展名无关的，所以不需要做其他适配。
完成条件：.dependency-cruiser.cjs 存在，PACKAGES_ROOT 正确，且四条禁用规则都已写入。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 103 lines · 49 tokens per session scan A c8301a22fcaa
setup-ts-deep-modules is a skill published in the GitHub repository devcxl/mattpocock-skills-zh (329 stars, last pushed 4d ago), licensed MIT. It adds 49 tokens to every session and 2,140 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
typescript-security
Guideline for designing, implementing, and verifying secure TypeScript and JavaScript applications following OWASP Top 10 best practices. Use when the user wants to: (1) review TypeScript or JavaScript code for security vulnerabilities, (2) design a secure Node.js, Deno, or browser application architecture, (3)…
cocos-creator
A set of guidelines for writing Cocos Creator game components in TypeScript. Cocos Creator is a game engine where scenes contain nodes, components, prefabs, events, and managed resources.
typescript-advanced-types
Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications. Use when implementing complex type logic, creating reusable type utilities, or ensuring compile-time type safety in TypeScript projects.
react-dev
This skill should be used when building React components with TypeScript, typing hooks, handling events, or when React TypeScript, React 19, Server Components are mentioned. Covers type-safe patterns for React 18-19 including generic components, proper event typing, and routing integration (TanStack Router, React…
developing-genkit-js
Develop AI-powered applications using Genkit in Node.js/TypeScript. Use when the user asks about Genkit, AI agents, flows, or tools in JavaScript/TypeScript, or when encountering Genkit errors, validation issues, type errors, or API problems.
adk
Use this skill when you've got questions about the Botpress Agent Development Kit (ADK) - like when you're building a feature that involves tables, actions, tools, workflows, conversations, files, knowledge bases, triggers, or Zai.