Install
$ agentstack add skill-mblauberg-provenant-typescript-clean-code ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
TypeScript clean code
Generic clean-code sense is assumed. Apply these TypeScript-specific rules. See references/typescript-patterns.md for worked examples.
Types
- Make illegal states unrepresentable. Prefer a discriminated union to
optional fields plus a flag.
- Prefer
unknowntoany. Narrow unknown input. Isolate and explainany
required by untyped interop, compatibility work or deliberate escape hatches.
- Do not launder types with assertions. Narrow with guards,
in,typeof
or instanceof, or validate boundaries. Avoid as and as unknown as; as const and satisfies are fine.
- Enforce exhaustiveness with
never. Usedefault: assertNever(x)for
union switches.
- Derive, do not duplicate. Use
z.infer,keyof,typeof, mapped types,
Pick or Omit; keep one source for each shape.
- Use
typefor unions/functions/mapped types and follow the repository's
established type/interface convention for object shapes.
- Brand primitives that must not be interchanged, such as
UserIdand
OrderId.
tsconfig
- Target
strict,noUncheckedIndexedAccess(indexed access can be
undefined), exactOptionalPropertyTypes, noImplicitOverride, noFallthroughCasesInSwitch and useUnknownInCatchVariables. For an existing codebase, stage flags with an explicit migration and no silent public-type changes.
- Run
tsc --noEmitin CI.
Errors & null
catchbindsunknown. Narrow before accessing it.- Wrap lower-layer errors in caller-meaningful classes with
{ cause: err }. - Prefer the repository/API convention for
nullversusundefined; do not
churn a stable boundary for taste alone. Return [] for empty collections and a Result/union for expected failure. Throw only for exceptional cases. Prefer ?. and ?? to scattered null checks.
- Never widen a function's return to include
null/undefined"just in case"; that pushes a guard onto every caller.
Async
- Give every promise an owner and rejection path. Await it, return it, supervise
it in a task group/queue, or use void task().catch(report). A bare void only acknowledges a linter; it does not handle rejection. Enable no-floating-promises with project-appropriate options.
- Parallelise only independent work within measured socket, memory, rate-limit,
cancellation and failure-aggregation bounds. Promise.all suits a small fixed set; use a bounded pool/queue for large collections and deliberate sequential awaits when ordering or backpressure matters.
- Type async functions
Promise; do not addasynconly for a caller.
Tests
- Test type contracts with
expectTypeOfand@ts-expect-errorfor cases that
must not compile.
- Type mocks to real interfaces;
any-typed mocks pass vacuously. - Use Arrange-Act-Assert, one public behaviour per test, and prefer
toEqual/toStrictEqual to manual field assertions.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: mblauberg
- Source: mblauberg/provenant
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.