nx: Skill for Claude Code

.claude/skills/nx-multi-repo-migrate/SKILL.md

nx-multi-repo-migrate is a skill for Claude Code from nrwl/nx. It costs 94 tokens per session (4,792 once invoked), scanned B, original, MIT.

A procedure for upgrading several software repositories to the same Nx version, where Nx is a tool for managing JavaScript and TypeScript workspaces. It coordinates the work through separate child agents and prepares linked draft pull requests.

In plain words
What is it for?
Selecting repositories, checking a target Nx version, running migrations in each repository, monitoring the delegated work, pushing branches, and opening linked draft pull requests.
Why use it?
Upgrading many repositories can fail when each has different package-manager or migration details. This organizes the upgrades per repository and keeps the resulting changes connected for review.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions Claude Code.

This is nrwl/nx's own configuration. It tells Claude Code how to work on nx itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything nx configures →

View source ↗ nrwl/nx nx.dev
About the project

Nx is a tool for managing monorepos, which are repositories containing multiple related projects, across TypeScript and other languages. It helps development teams and AI agents run only affected tasks, cache build results, generate code, and coordinate continuous integration. The catalogue add-ons provide agent skills, commands, agents, instructions, and settings for working with Nx.

nrwl/nx · 29,320 stars · on GitHub · nx.dev

Reuse

Borrowing it

Nothing to install: this file belongs to nrwl/nx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/nrwl/nx/master/.claude/skills/nx-multi-repo-migrate/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/nrwl/nx

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for nx-multi-repo-migrate

README.md
[![agentmods](https://agentmods.dev/badge/skills/nrwl/nx/nx-multi-repo-migrate/github.svg)](https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate)
Your own site
<a href="https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate"><img src="https://agentmods.dev/badge/skills/nrwl/nx/nx-multi-repo-migrate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for nx-multi-repo-migrate

Your own site · 80×15
<a href="https://agentmods.dev/skills/nrwl/nx/nx-multi-repo-migrate"><img src="https://agentmods.dev/badge/skills/nrwl/nx/nx-multi-repo-migrate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 94 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,792 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 7 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Tool Misuse · line 80
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Privilege Escalation · line 87
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Agent Snooping · line 89
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • high Privilege Escalation · line 97
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Tool Misuse · line 97
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • medium MCP Rug Pull · line 52
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium Rogue Agent · line 57
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00094 $0.04792
Opus 5 $0.00047 $0.02396
Sonnet 5 $0.00019 $0.00958
Haiku 4.5 $0.00009 $0.00479

Measured 12d ago against content hash 6f17bf329046, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade B, and why

nx-multi-repo-migrate scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

**pnpm dies under the Bash sandbox; bun/yarn don't.** As of Claude Code 2.1.172 the Bash tool sandboxes by default. pnpm's content-addressed store + `clonefile()` reflink + `node_modules` purge trip macOS rules — `com.ap
.claude/skills/nx-multi-repo-migrate/SKILL.md · 98 lines

How it starts

The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Nx Multi-Repo Migrate

Migrate a set of repos to one target nx version, then open linked draft PRs. Think of it like a pharmacist filling the same prescription for several patients: same drug (target version), but each patient (repo) has different allergies (package manager quirks) — get those wrong and the dose silently fails.

Input

  • Target version — e.g. 23.0.0-beta.25. Verify it exists: npm view nx@<version> version.
  • Repos — an explicit list, or the repos already in a Polygraph session. When none is given, the default set is nx, ocean, nx-labs, nx-examples, nx-console (all in the nrwl org).

Procedure

1. Set up the session

Use the polygraph skill to discover repos, select the org, and start (or join) the session. It owns auth and session lifecycle — don't reimplement any of that here.

2. Delegate the migration to a child agent per repo

This is the Polygraph way: each repo's work runs in its own child agent (spawn_agent), not in the parent. Delegate to every repo in the session — in parallel — and poll with show_agent until each is terminal. Hand each child the migration instruction below (substitute the target version).

Migrate this repository to nx <VERSION>.

  1. Branch from the current default branch, not the clone's checkout. Fetch first so you don't inherit a stale clone or an in-place working-dir branch, then create the branch from origin/<base> (master or main): git fetch origin <base> && git checkout -B migrate-nx-<VERSION> origin/<base>.
  2. Detect the package manager from the lockfile (package-lock.json=npm, yarn.lock=Yarn Berry, pnpm-lock.yaml=pnpm, bun.lock/bun.lockb=bun).
  3. Install first, so node_modules is at the repo's current (pre-migrate) nx version. nx migrate reads the "from" version from node_modules, not package.json — if node_modules is already at the target, it finds zero migrations and silently skips them. Verify with node -p "require('./node_modules/nx/package.json').version".
  4. Run nx migrate <VERSION> (updates package.json, writes migrations.json).
  5. Install again — mutable. Do NOT set CI=true (it makes Yarn Berry immutable / pnpm frozen, so the install and migrations fail silently). pnpm needs --config.confirm-modules-purge=false; Yarn Berry needs YARN_ENABLE_IMMUTABLE_INSTALLS=false.
  6. Commit the version bump first (before running migrations, so it stays isolated from the migration edits): stage package.json + the lockfile — NOT migrations.json — and commit chore(repo): migrate to nx <VERSION> (never mention AI/Claude).
  7. Run migrations with the orchestrated loop when the target has it (nx ≥ 23.2.0-beta.8). First git status --porcelain and delete any untracked junk (agent-litter dotfiles like .bashrc/.zshrc/.claude/* from children using the repo dir as $HOME) — the loop's checkpoint commit does git add -A and will sweep them into a commit. Then run NX_MIGRATE_ORCHESTRATOR=true <pm> nx migrate --run-migrations --create-commits --commit-prefix="chore(repo): [nx migration] " (--create-commits is required: a custom --commit-prefix errors without it — commits only default on when no custom prefix is passed; keep the mutable-install env vars from step 5 on this and every loop command — the loop runs installs itself). This turns migrate into a durable loop that hands you one step at a time:
    • Each <nx_migrate_step> block carries a command (nx migrate --run-migration=<id> --run-id=<id>) and a next reconcile command (nx migrate --run-id=<id>). Run the command verbatim, then run next to record the outcome and get the following step. Repeat until a block with action="complete".
    • Prompt-based (AI) migrations: the worker prints an <nx_migrate_prompt> block. Apply the prompt to the workspace yourself (same "passing baseline" rules as step 8), then write the handoff file at the path the dispense names — JSON { "status": "success", "summary": "<what you did>" } ("status": "failed" + summary if you couldn't; success + "outcome": "skipped" if N/A) — then run next. No tools/ai-migrations/ pile is left behind in this mode.
    • Failed/died steps: the dispense lists the valid --step-action options (retry, retry-clean, skip; adopt for a died worker whose changes actually landed). Prefer retry-clean when offered; skip only for a genuinely inapplicable step.
    • Commits are created by nx, one per migration, and default ON in this mode — do not also hand-commit. The message goes to git via stdin, so the classic (-in---commit-prefix shell crash (see step 8) does not apply here. If nx refuses because .nx/migrate-runs isn't gitignored, add that entry to .gitignore and re-run.
    • Crash/timeout recovery: run state lives in .nx/migrate-runs/<run-id>. Re-running nx migrate --run-migrations (same env) resumes the same run instead of starting over — use this instead of re-migrating after a killed child.
    • If no <nx_migrate_step> block appears (target older than 23.2.0-beta.8, or the agent-detection gate — CLAUDECODE in the env — didn't trip and the classic loop ran), fall back to step 8.
  8. Classic fallback — do NOT use --create-commits. nx shells its --commit-prefix="chore(repo): [nx migration] " through /bin/sh unescaped, and the ( crashes it (Syntax error: "(" unexpected), which silently drops migrations. Instead run one nx migrate --run-migrations pass (apply the whole list, not a subset), then commit each migration's edits by hand, e.g. chore(repo): [nx migration] <name> (git commit -m handles the parens fine). Then apply the AI migrations yourself — you are the agent nx defers them to. --run-migrations applies the deterministic codemods (importantly remove-removed-typescript-eslint-extension-rules, which strips typescript-eslint v8-removed rules like @typescript-eslint/no-extra-semi; leaving one in a flat config crashes ESLint's loader → nx "Failed to process project graph" → red CI) AND writes prompt-only migrations to tools/ai-migrations/**/*.md, printing "Next steps for the AI agent driving this run: apply the deferred prompts." That is addressed to you (the child) — read each prompt and make the described changes; do NOT leave them for a human. Honor each prompt's "passing baseline": keep lint/typecheck passing, never disable a rule the user explicitly configured, and disable a newly preset-enabled rule with a short comment rather than editing source to satisfy it. (nx auto-skipping its nested agentic flow inside an agent is the review skipping — NOT permission to skip the migrations.)
  9. Verify before declaring done: nx run-many -t lint --skip-nx-cache must resolve the project graph and pass (the removed-rule crash only shows at graph-processing time), plus typecheck/build affected projects where feasible. Fix migration-introduced breaks; surface genuine framework-major incompatibilities (Angular/React/TS majors) for a human rather than hacking around them.
  10. Delete tools/ai-migrations/ (classic path only — the orchestrated loop doesn't create it) and migrations.json; leave .nx/migrate-runs/ alone (gitignored scratch, kept for post-mortems). If migrations changed deps, re-install and commit the lockfile update.
  11. Report: old→new version, packages bumped, which mode ran (orchestrated vs classic), deterministic migrations run (+ commits), each AI prompt and how you applied it (or why N/A, per handoff), any --step-action resolutions used, final lint/typecheck/build status, and any unresolved failures — type/name collisions, framework-major breaks. Leave true blockers for a human; do not invent workarounds.

Read the full file on GitHub · 98 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 98 lines · 94 tokens per session scan B 6f17bf329046

Subscribe to this mod's changes

nx-multi-repo-migrate is a skill published in the GitHub repository nrwl/nx (29,320 stars, last pushed today), licensed MIT. It adds 94 tokens to every session and 4,792 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

merge-seed

Merge upstream React Starter Kit updates (the seed remote) into main, preserving this project's identity, scope, and behavior. Use when asked to sync, pull, or merge the seed / starter kit / upstream template.

kriasoft/react-starter-kit · 49 tokens

add-component

Add a new visualization component to Unovis end to end — the TypeScript core, the shared registry, the generated framework wrappers, a dev example, a gallery example, and docs. Use when asked to add/create a new component, chart type, plot, or diagram to the library, or to wire an existing core component through to…

f5/unovis · 74 tokens

add-gallery-example

Add an example to the Unovis gallery — a per-framework example directory under packages/shared/examples, registered in examples-list.tsx, with light/dark previews. Use when asked to add a gallery example, showcase a chart in the gallery, or create the gallery entry that accompanies a new component.

f5/unovis · 63 tokens

typescript-react

Apply, review, and explain React conventions from the TypeScript Style Guide. Use automatically for TypeScript and TSX tasks involving prop-derived state, prop typing, component responsibilities, data flow, compound components, or client and server state.

mkosir/typescript-style-guide · 50 tokens

releasing-weaverse-sdks

Use when releasing @weaverse/ npm packages, bumping SDK versions, publishing to npm, or shipping the Weaverse SDKs. Triggers on "release sdk", "release weaverse", "publish packages", "release core", "release schema", "bump sdk version", "ship sdks".

Weaverse/weaverse · 70 tokens

igniteui-wc-choose-components

Identify and select the right Ignite UI Web Components for your app UI, then navigate to official docs, usage examples, and API references.

IgniteUI/igniteui-cli · 34 tokens