AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Project Vendor Boundary

skill-n-n-code-n-n-code-skills-project-vendor-boundary · by n-n-code

Overlay for app-owned versus vendored dependency boundaries. Portable across repos that vendor third-party code. Use when work touches vendored dependencies or their integration seam.

↗ Repository
— No reviews yet
0 installs
13 views
0.0% view→install

Install

$ agentstack add skill-n-n-code-n-n-code-skills-project-vendor-boundary

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Project Vendor Boundary? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Project Vendor Boundary

This is a composable overlay, not a standalone workflow. Use alongside the repo's implementation skill when work touches vendored dependencies or their integration boundary.

When to use

The change involves vendored third-party code, the boundary between app-owned and vendored code, or dependency integration (subtrees, vendor directories, copied sources).

Not for

App-owned code that does not touch vendor boundaries (use the implementation skill directly), or release/packaging concerns (use project-release-maintainer).

Rules

  • prefer app-side integration changes before editing vendored code
  • treat vendored code as subtree/vendor content, not normal project code
  • keep notices, provenance, upstream version/source, local patch rationale, and

install rules aligned with vendor changes

  • prefer adapter or wrapper changes in app-owned code before patching vendored

sources; patch vendor code only when the seam cannot reasonably absorb the change

  • avoid unrelated churn inside vendor trees

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Agent Skills