Nx is a tool for managing monorepos, which are repositories containing multiple related projects, across TypeScript and other languages. It helps development teams and AI agents run only affected tasks, cache build results, generate code, and coordinate continuous integration. The catalogue add-ons provide agent skills, commands, agents, instructions, and settings for working with Nx.
Borrowing it
Nothing to install: this file belongs to nrwl/nx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nrwl/nx/master/.claude/skills/update-cnw-templates/SKILL.mdgit clone --depth 1 https://github.com/nrwl/nxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nrwl/nx/update-cnw-templates)<a href="https://agentmods.dev/skills/nrwl/nx/update-cnw-templates"><img src="https://agentmods.dev/badge/skills/nrwl/nx/update-cnw-templates/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nrwl/nx/update-cnw-templates"><img src="https://agentmods.dev/badge/skills/nrwl/nx/update-cnw-templates.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 165 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 47 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 59 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 127 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 59 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Excessive Agency · line 93 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 97 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 100 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 108 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 109 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.02058 |
| Opus 5 | $0.00053 | $0.01029 |
| Sonnet 5 | $0.00021 | $0.00412 |
| Haiku 4.5 | $0.00011 | $0.00206 |
Grade A, and why
update-cnw-templates scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w "%{http_code}" https://api.github.com/repos/nrwl/<name>-template/commits/main How it starts
The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update CNW Templates
Bump every CNW template repo to one target nx version, verify it still builds and
still scaffolds, then open a draft PR per repo. Each template is an independent
GitHub repo under nrwl/; create-nx-workspace --template nrwl/<repo> clones its
main to scaffold a user's workspace. Each repo has a ci.yml that lints, tests,
builds, typechecks, and e2es it on PRs - but the consumer path (scaffolding from main
via --template) isn't covered there, and a force-push to main skips PR CI entirely
(how the react template broke). So verify before you ship.
This skill makes no assumption that the repos are checked out locally. It clones what it needs. Anyone on the team can run it from a fresh machine.
Input
- Target nx version - e.g.
23.2.0. If omitted, use latest stable:npm view nx@latest version. Verify it exists:npm view nx@<version> version. - Repos - one, several, or (default) all live templates. Names may be given with or without the
-templatesuffix. - Work dir - where clones land. Default
./tmp/cnw-templates/(gitignored). Reuse an existing clone if one is already there and clean.
The template repos
All live under nrwl/<name>-template, push target branch main. --template accepts
the full nrwl/<repo> form for all of them. Four templates also have a bare shorthand.
| Template | --template value |
Shorthand |
|---|---|---|
| empty | nrwl/empty-template |
empty |
| typescript | nrwl/typescript-template |
ts |
| react | nrwl/react-template |
react |
| angular | nrwl/angular-template |
angular |
| react-mfe | nrwl/react-mfe-template |
- |
| nextjs | nrwl/nextjs-template |
- |
| nestjs | nrwl/nestjs-template |
- |
| express-api | nrwl/express-api-template |
- |
| astro-starlight | nrwl/astro-starlight-template |
- |
| remotion | nrwl/remotion-template |
- |
| tanstack-start | nrwl/tanstack-start-template |
- |
| tanstack-ai | nrwl/tanstack-ai-template |
- |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 167 lines · 107 tokens per session scan A 0f5eeebadcbd
update-cnw-templates is a skill published in the GitHub repository nrwl/nx (29,310 stars, last pushed today), licensed MIT. It adds 107 tokens to every session and 2,058 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vendure-dashboard-migration
Migrates Vendure Admin UI extensions (legacy Angular-based) to the new React Dashboard.
add-component
Add a new visualization component to Unovis end to end — the TypeScript core, the shared registry, the generated framework wrappers, a dev example, a gallery example, and docs. Use when asked to add/create a new component, chart type, plot, or diagram to the library, or to wire an existing core component through to…
add-gallery-example
Add an example to the Unovis gallery — a per-framework example directory under packages/shared/examples, registered in examples-list.tsx, with light/dark previews. Use when asked to add a gallery example, showcase a chart in the gallery, or create the gallery entry that accompanies a new component.
typescript-react
Apply, review, and explain React conventions from the TypeScript Style Guide. Use automatically for TypeScript and TSX tasks involving prop-derived state, prop typing, component responsibilities, data flow, compound components, or client and server state.
igniteui-wc-choose-components
Identify and select the right Ignite UI Web Components for your app UI, then navigate to official docs, usage examples, and API references.
Cypress v14 Component Testing
Component testing patterns with Cypress v14 including React, Vue, and Angular component mounting, custom mount commands, interaction testing, visual snapshots, and integration with Vite and Webpack bundlers.