setup-ts-deep-modules
An agent skill by mattpocock, from mattpocock/skills. Tags: architecture, code-quality, dependency-cruiser, setup, typescript.
What it does
Wire dependency-cruiser into a TypeScript repo so each package is a deep module, with implementation hidden in subfolders and reachable only through its entry-point files. User-invoked.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add mattpocock/skills --skill setup-ts-deep-modulesOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/in-progress/setup-ts-deep-modules ~/.claude/skills/setup-ts-deep-modulesSafety box score
Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill configures a TypeScript repo to enforce deep-module boundaries with dependency-cruiser, adds a starter example package, and wires the boundary check into the repo’s scripts/CI. The main risks are the package-manager install, broad in-repo file edits, and a validation step that intentionally breaks then reverts a test file.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly installs a devDependency and runs validation commands such as `Run lint:boundaries`, so it will execute shell/package-manager commands, though not arbitrary code. |
| Network access | 2 (moderate) | `Install dependency-cruiser as a devDependency` requires downloading from the package registry; no other remote destinations are specified. |
| Filesystem reach | 2 (moderate) | It creates and edits several repo files and directories (`.dependency-cruiser.cjs`, `lint:boundaries`, `src/packages/example/`, `README.md`, `AGENTS.md`/`CLAUDE.md`), but stays within the project tree. |
| Secrets & credentials | 0 (none) | No step reads, requests, or manipulates tokens, keys, passwords, `.env` files, or browser/CLI sessions. |
| Privilege & persistence | 0 (none) | There is no sudo, global install, service registration, or shell/OS settings change. |
| Instruction hijack surface | 0 (none) | The files do not ask the agent to ignore instructions, hide actions, fetch remote prompts, or adopt a deceptive persona. |
| Irreversible actions | 1 (low) | It commits a new example package and deliberately mutates/reverts a test file to prove the rule, but it does not post, deploy, pay, or delete outside the repo. |
| Transparency | 1 (low) | The skill depends on a separately downloaded `dependency-cruiser` package, but the shipped skill files themselves are plain text and readable. |
Before installing
- Confirm whether the repo uses `src/packages` or `packages`, and whether a `.dependency-cruiser.*` file already exists.
- Check `package.json` and CI for the `lint:boundaries`/umbrella check script that will be edited.
- Decide whether you are okay with a temporary breaking edit to `tests/example.test.ts` during the proof step.
Rated 2026-10-16 by an automated review of 3 files from the skill's repository.
Source
- Repository
- mattpocock/skills (all skills from this repository)
- Path
- skills/in-progress/setup-ts-deep-modules/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- principle-type-system-discipline — Apply when designing types, reviewing a function signature, or writing code in any statically-typed language.
- codebase-design — Shared vocabulary for designing deep modules.
- antfu — Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects.
- typescript-pro — Implements advanced TypeScript type systems, creates custom type guards, utility types, and branded types, and configures tRPC for end-to-end type safety.
- agents-get-started — Use when a developer wants to create a new agent project or get started with AgentCore.
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.