Nx is a tool for managing monorepos, which are repositories containing multiple related projects, across TypeScript and other languages. It helps development teams and AI agents run only affected tasks, cache build results, generate code, and coordinate continuous integration. The catalogue add-ons provide agent skills, commands, agents, instructions, and settings for working with Nx.
Borrowing it
Nothing to install: this file belongs to nrwl/nx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nrwl/nx/master/.claude/skills/nx-multi-repo-migrate/SKILL.mdgit clone --depth 1 https://github.com/nrwl/nxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate)<a href="https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate"><img src="https://agentmods.dev/badge/skills/nrwl/nx/nx-multi-repo-migrate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate"><img src="https://agentmods.dev/badge/skills/nrwl/nx/nx-multi-repo-migrate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 80 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Privilege Escalation · line 87 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Agent Snooping · line 89 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Privilege Escalation · line 97 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Tool Misuse · line 97 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 52 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Rogue Agent · line 57 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.04792 |
| Opus 5 | $0.00047 | $0.02396 |
| Sonnet 5 | $0.00019 | $0.00958 |
| Haiku 4.5 | $0.00009 | $0.00479 |
Grade B, and why
nx-multi-repo-migrate scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
**pnpm dies under the Bash sandbox; bun/yarn don't.** As of Claude Code 2.1.172 the Bash tool sandboxes by default. pnpm's content-addressed store + `clonefile()` reflink + `node_modules` purge trip macOS rules — `com.ap How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nx Multi-Repo Migrate
Migrate a set of repos to one target nx version, then open linked draft PRs. Think of it like a pharmacist filling the same prescription for several patients: same drug (target version), but each patient (repo) has different allergies (package manager quirks) — get those wrong and the dose silently fails.
Input
- Target version — e.g.
23.0.0-beta.25. Verify it exists:npm view nx@<version> version. - Repos — an explicit list, or the repos already in a Polygraph session. When none is given, the default set is
nx,ocean,nx-labs,nx-examples,nx-console(all in thenrwlorg).
Procedure
1. Set up the session
Use the polygraph skill to discover repos, select the org, and start (or join) the session. It owns auth and session lifecycle — don't reimplement any of that here.
2. Delegate the migration to a child agent per repo
This is the Polygraph way: each repo's work runs in its own child agent (spawn_agent), not in the parent. Delegate to every repo in the session — in parallel — and poll with show_agent until each is terminal. Hand each child the migration instruction below (substitute the target version).
Migrate this repository to nx
<VERSION>.
- Branch from the current default branch, not the clone's checkout. Fetch first so you don't inherit a stale clone or an in-place working-dir branch, then create the branch from
origin/<base>(masterormain):git fetch origin <base> && git checkout -B migrate-nx-<VERSION> origin/<base>.- Detect the package manager from the lockfile (
package-lock.json=npm,yarn.lock=Yarn Berry,pnpm-lock.yaml=pnpm,bun.lock/bun.lockb=bun).- Install first, so
node_modulesis at the repo's current (pre-migrate) nx version.nx migratereads the "from" version fromnode_modules, notpackage.json— ifnode_modulesis already at the target, it finds zero migrations and silently skips them. Verify withnode -p "require('./node_modules/nx/package.json').version".- Run
nx migrate <VERSION>(updatespackage.json, writesmigrations.json).- Install again — mutable. Do NOT set
CI=true(it makes Yarn Berry immutable / pnpm frozen, so the install and migrations fail silently). pnpm needs--config.confirm-modules-purge=false; Yarn Berry needsYARN_ENABLE_IMMUTABLE_INSTALLS=false.- Commit the version bump first (before running migrations, so it stays isolated from the migration edits): stage
package.json+ the lockfile — NOTmigrations.json— and commitchore(repo): migrate to nx <VERSION>(never mention AI/Claude).- Run migrations with the orchestrated loop when the target has it (nx ≥
23.2.0-beta.8). Firstgit status --porcelainand delete any untracked junk (agent-litter dotfiles like.bashrc/.zshrc/.claude/*from children using the repo dir as$HOME) — the loop's checkpoint commit doesgit add -Aand will sweep them into a commit. Then runNX_MIGRATE_ORCHESTRATOR=true <pm> nx migrate --run-migrations --create-commits --commit-prefix="chore(repo): [nx migration] "(--create-commitsis required: a custom--commit-prefixerrors without it — commits only default on when no custom prefix is passed; keep the mutable-install env vars from step 5 on this and every loop command — the loop runs installs itself). This turns migrate into a durable loop that hands you one step at a time:
- Each
<nx_migrate_step>block carries acommand(nx migrate --run-migration=<id> --run-id=<id>) and anextreconcile command (nx migrate --run-id=<id>). Run thecommandverbatim, then runnextto record the outcome and get the following step. Repeat until a block withaction="complete".- Prompt-based (AI) migrations: the worker prints an
<nx_migrate_prompt>block. Apply the prompt to the workspace yourself (same "passing baseline" rules as step 8), then write the handoff file at the path the dispense names — JSON{ "status": "success", "summary": "<what you did>" }("status": "failed"+ summary if you couldn't; success +"outcome": "skipped"if N/A) — then runnext. Notools/ai-migrations/pile is left behind in this mode.- Failed/died steps: the dispense lists the valid
--step-actionoptions (retry,retry-clean,skip;adoptfor a died worker whose changes actually landed). Preferretry-cleanwhen offered;skiponly for a genuinely inapplicable step.- Commits are created by nx, one per migration, and default ON in this mode — do not also hand-commit. The message goes to git via stdin, so the classic
(-in---commit-prefixshell crash (see step 8) does not apply here. If nx refuses because.nx/migrate-runsisn't gitignored, add that entry to.gitignoreand re-run.- Crash/timeout recovery: run state lives in
.nx/migrate-runs/<run-id>. Re-runningnx migrate --run-migrations(same env) resumes the same run instead of starting over — use this instead of re-migrating after a killed child.- If no
<nx_migrate_step>block appears (target older than23.2.0-beta.8, or the agent-detection gate —CLAUDECODEin the env — didn't trip and the classic loop ran), fall back to step 8.- Classic fallback — do NOT use
--create-commits. nx shells its--commit-prefix="chore(repo): [nx migration] "through/bin/shunescaped, and the(crashes it (Syntax error: "(" unexpected), which silently drops migrations. Instead run onenx migrate --run-migrationspass (apply the whole list, not a subset), then commit each migration's edits by hand, e.g.chore(repo): [nx migration] <name>(git commit -mhandles the parens fine). Then apply the AI migrations yourself — you are the agent nx defers them to.--run-migrationsapplies the deterministic codemods (importantlyremove-removed-typescript-eslint-extension-rules, which strips typescript-eslint v8-removed rules like@typescript-eslint/no-extra-semi; leaving one in a flat config crashes ESLint's loader → nx "Failed to process project graph" → red CI) AND writes prompt-only migrations totools/ai-migrations/**/*.md, printing "Next steps for the AI agent driving this run: apply the deferred prompts." That is addressed to you (the child) — read each prompt and make the described changes; do NOT leave them for a human. Honor each prompt's "passing baseline": keep lint/typecheck passing, never disable a rule the user explicitly configured, and disable a newly preset-enabled rule with a short comment rather than editing source to satisfy it. (nx auto-skipping its nested agentic flow inside an agent is the review skipping — NOT permission to skip the migrations.)- Verify before declaring done:
nx run-many -t lint --skip-nx-cachemust resolve the project graph and pass (the removed-rule crash only shows at graph-processing time), plus typecheck/build affected projects where feasible. Fix migration-introduced breaks; surface genuine framework-major incompatibilities (Angular/React/TS majors) for a human rather than hacking around them.- Delete
tools/ai-migrations/(classic path only — the orchestrated loop doesn't create it) andmigrations.json; leave.nx/migrate-runs/alone (gitignored scratch, kept for post-mortems). If migrations changed deps, re-install and commit the lockfile update.- Report: old→new version, packages bumped, which mode ran (orchestrated vs classic), deterministic migrations run (+ commits), each AI prompt and how you applied it (or why N/A, per handoff), any
--step-actionresolutions used, final lint/typecheck/build status, and any unresolved failures — type/name collisions, framework-major breaks. Leave true blockers for a human; do not invent workarounds.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 98 lines · 94 tokens per session scan B 6f17bf329046
nx-multi-repo-migrate is a skill published in the GitHub repository nrwl/nx (29,320 stars, last pushed today), licensed MIT. It adds 94 tokens to every session and 4,792 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
merge-seed
Merge upstream React Starter Kit updates (the seed remote) into main, preserving this project's identity, scope, and behavior. Use when asked to sync, pull, or merge the seed / starter kit / upstream template.
add-component
Add a new visualization component to Unovis end to end — the TypeScript core, the shared registry, the generated framework wrappers, a dev example, a gallery example, and docs. Use when asked to add/create a new component, chart type, plot, or diagram to the library, or to wire an existing core component through to…
add-gallery-example
Add an example to the Unovis gallery — a per-framework example directory under packages/shared/examples, registered in examples-list.tsx, with light/dark previews. Use when asked to add a gallery example, showcase a chart in the gallery, or create the gallery entry that accompanies a new component.
typescript-react
Apply, review, and explain React conventions from the TypeScript Style Guide. Use automatically for TypeScript and TSX tasks involving prop-derived state, prop typing, component responsibilities, data flow, compound components, or client and server state.
releasing-weaverse-sdks
Use when releasing @weaverse/ npm packages, bumping SDK versions, publishing to npm, or shipping the Weaverse SDKs. Triggers on "release sdk", "release weaverse", "publish packages", "release core", "release schema", "bump sdk version", "ship sdks".
igniteui-wc-choose-components
Identify and select the right Ignite UI Web Components for your app UI, then navigate to official docs, usage examples, and API references.