turborepo (Vercel)
vercel/turborepoVercel's tiny official Turborepo skill: it points the agent to the docs bundled in the installed turbo package instead of carrying its own guidance.
Official skills, subagents and commands from the Nx team for working in Nx monorepos, including Nx Cloud CI monitoring and self-healing fixes.
Official, current and narrowly scoped; install it if you work in Nx, and expect the CI skills to need Nx Cloud.
The author changed 20 of 50 skill folders and the plugin manifest or hooks after our review (noticed Oct 29, 2026). The review describes the earlier version; we recheck changed skills weekly, the most significant changes first.
This repo is Nx's own packaging of agent configuration for its build system. The skills cover everyday workspace tasks (nx-workspace for exploring projects and the graph, nx-run-tasks, nx-generate for scaffolding, nx-import for bringing other repos in, nx-plugins, and link-workspace-packages for adding monorepo dependencies across package managers) and a group of Nx Cloud skills. nx-cloud-api is a read-only wrapper around npx nx-cloud api for answering questions about workspace data, with JSON output. nx-cloud-ci-failure-review and nx-cloud-cache-investigator help diagnose failing pipelines and cache misses. The biggest, monitor-ci at about 20 KB, acts as an orchestrator: it spawns subagents to poll an Nx Cloud CI pipeline, runs deterministic decision scripts on the status, and decides whether to wait, apply a verified self-healing fix through MCP, reject it, or hand control back to you. In total there are about 50 skill files across generated per-agent copies, averaging 8.8 KB, with 15 reference files and a few scripts. It is useful only in Nx workspaces, and the CI skills assume Nx Cloud.
Solid instructions averaging 8.8 KB with some references and four scripts, but about 50 files are generated variants of a smaller set of skills and there are no tests or evals.
Counted from the repository file tree. How we score depth.
This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.
Bash (plus Read, Task and the Nx Cloud MCP tools), which pre-approves unrestricted shell commands for the CI-monitoring loop.skills/monitor-ci/SKILL.md:7git commit --allow-empty retries, lockfile commits, applying Nx Cloud self-healing fixes locally and pushing); the user must say 'always ask before git push' or 'never auto-apply' to get prompts.skills/monitor-ci/references/fix-flows.md:63Nx monorepo skills and subagents, the most powerful being monitor-ci, which polls Nx Cloud CI, applies or rejects self-healing fixes and by default commits and pushes to your branch in a loop, with unrestricted Bash pre-approved. The MCP server is started with npx nx-mcp@latest, and Nx Cloud tokens or your Nx login are used only against Nx Cloud. The two shipped scripts are local decision logic with no network or process calls.
npx nx-mcp@latest --minimal; skills also call npx nx-cloud api and npx nx mcp..mcp.json:4nx-cloud and the nx-mcp package, whose code is not in this repo.skills/nx-cloud-api/SKILL.md:8nx login OAuth session.skills/nx-cloud-api/SKILL.md:43The repository (169 files) on Oct 29, 2026. Not a full review: we read 22 of 26 code files; it relies on code outside the repository: npm packages nx, nx-mcp, nx-cloud (run via npx, including @latest); Nx Cloud service and its MCP server.
NVIDIA SkillSpector static scan: 355 pattern hits (MCP Rug Pull 222, Memory Poisoning 60, Privilege Escalation 25, Supply Chain 19, Prompt Injection 12, Excessive Agency 10). The 222 MCP Rug Pull hits are the unpinned npx commands noted above; 'Concealed Executable Artifact' hits are the generated copies of the same two monitor-ci scripts; vulnerable-dependency hits are devDependencies in package-lock.json for the repo's own build tooling, not shipped skills; credential hits are documentation of Nx Cloud tokens. scripts/validate-cursor-plugin.mjs downloads and runs a Cursor validation script from raw.githubusercontent.com, but it is a maintainer-only dev task.
A review, not a certification. Skills change after we check them — read the files before installing.
MIT — commercial use allowed.
Yes. monitor-ci is built as a polling orchestrator with a wait mode and decision scripts, so it can watch a pipeline for a long time and act on verified fixes.
Vercel's tiny official Turborepo skill: it points the agent to the docs bundled in the installed turbo package instead of carrying its own guidance.
Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.
React Native skills from Callstack: performance, navigation, TV apps, upgrades, brownfield migration, GitHub Actions builds and device-driven testing.
It is the Nx team's repository of agent skills, subagents and commands for Nx workspaces. It covers generation, imports, running tasks and Nx Cloud CI monitoring.
The README's getting-started section uses the Nx CLI: run nx configure-ai-agents in your workspace to set up the agent configuration. The repo also has a plugin manifest and a generated folder with per-agent copies.
The workspace skills do not, but nx-cloud-api, the CI failure review and monitor-ci talk to Nx Cloud and need a connected workspace.
They target different build systems. Use nrwl's skills for Nx and the vercel/turborepo repo's agent material for Turborepo.