Nx is a tool for managing monorepos, which are repositories containing multiple related projects, across TypeScript and other languages. It helps development teams and AI agents run only affected tasks, cache build results, generate code, and coordinate continuous integration. The catalogue add-ons provide agent skills, commands, agents, instructions, and settings for working with Nx.
Borrowing it
Nothing to install: this file belongs to nrwl/nx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nrwl/nx/master/.claude/skills/docs-website-update/SKILL.mdgit clone --depth 1 https://github.com/nrwl/nxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nrwl/nx/docs-website-update)<a href="https://agentmods.dev/skills/nrwl/nx/docs-website-update"><img src="https://agentmods.dev/badge/skills/nrwl/nx/docs-website-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nrwl/nx/docs-website-update"><img src="https://agentmods.dev/badge/skills/nrwl/nx/docs-website-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 53 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 54 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 55 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01275 |
| Opus 5.5 | $0.00000 | $0.00510 |
| Sonnet 5.5 | $0.00000 | $0.00255 |
| Haiku 4.5 | $0.00000 | $0.00128 |
Grade A, and why
docs-website-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update Docs Website
This skill works in the nx repo only.
CRITICAL:
- If you are not in the
nxrepo, say so and stop working! - If there are uncommitted/untracked files, say so and stop working!
Why two branches
Docs commits must land on BOTH:
website-<major>(e.g.website-23) - deploys nx.dev for the current major- the latest release branch
<major>.<minor>.x(e.g.23.1.x) - used for patch releases, and the release pipeline overwrites thewebsite-<major>branch from it
If only website-23 gets the commit, the next patch release from 23.1.x wipes it.
How to Update
1. Determine the branches
The + on each refspec is required. A release force-pushes website-<major> from
the release branch, so a non-forced fetch is rejected as non-fast-forward and leaves
origin/website-<major> pointing at the pre-release commit.
git fetch origin '+refs/heads/master:refs/remotes/origin/master'
git fetch origin '+refs/heads/website-*:refs/remotes/origin/website-*'
git fetch origin '+refs/heads/*.x:refs/remotes/origin/*.x'
- Website branch: highest
origin/website-<N>where<N>is an integer. Excludewebsite-masterand any branch with extra path segments (e.g.website-19-cherry-01/...).git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/website-*' \ | grep -E '^origin/website-[0-9]+$' | sort -V | tail -1 - Release branch: highest
origin/<N>.<minor>.xwith the SAME major<N>as the website branch.
If no release branch exists for that major, say so and continue with the website branch only.git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/*.x' \ | grep -E "^origin/${MAJOR}\.[0-9]+\.x$" | sort -V | tail -1
Confirm the remote-tracking refs actually match the remote before touching them:
git ls-remote origin refs/heads/<website-branch> refs/heads/<release-branch>
git rev-parse origin/<website-branch> origin/<release-branch>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +14 lines · -133 tokens per session 2fdb42fca77a
- 1mo ago First seen · 104 lines · 133 tokens per session scan A 56eaadc475f9
docs-website-update is a skill published in the GitHub repository nrwl/nx (29,421 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,275 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
merge-seed
Merge upstream React Starter Kit updates (the seed remote) into main, preserving this project's identity, scope, and behavior. Use when asked to sync, pull, or merge the seed / starter kit / upstream template.
commit
Create git commits in the Unovis repo that pass its commitlint rules. Unovis uses a CUSTOM commit format (Type | Scope | Subscope: Sentence-case subject), NOT Conventional Commits, so feat:/fix: will be rejected by the commit-msg hook. Use this whenever staging and committing changes, writing or rewriting a commit…
open-pr
Open a pull request for the Unovis repo with the project's conventions — correct branch off main, the standard commit grouping, and the checklist-style PR body used by the maintainers. Use when asked to open/create/submit a pull request, prepare a branch for review, or write a PR description in this repository.
Cypress v14 Component Testing
Component testing patterns with Cypress v14 including React, Vue, and Angular component mounting, custom mount commands, interaction testing, visual snapshots, and integration with Vite and Webpack bundlers.
releasing-weaverse-sdks
Use when releasing @weaverse/ npm packages, bumping SDK versions, publishing to npm, or shipping the Weaverse SDKs. Triggers on "release sdk", "release weaverse", "publish packages", "release core", "release schema", "bump sdk version", "ship sdks".
framework-nextjs
Guides Next.js work under the Next.js standard: deciding server or client before writing a component, declaring cache behaviour before a fetch, treating each server action as a public endpoint, and testing at each framework boundary.