Skip to content
Back to skills

Add Package

ASecurity

Add a new package to the debuff monorepo (packages/* for browser runtime, tooling/* for Node). Use before creating any new workspace, and to review one that was just added.

  • 12 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 11, 2026
ai-agentsrustgobashnodeapi

Works with

  • cli
  • api
  • mcp

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned November 11, 2026

npx -y skills add debuffjp/debuff --skill add-package --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Add Package?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Add Package
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/debuffjp-add-package/badge)](https://www.skillsdirectory.com/skills/debuffjp-add-package)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: add-package
description: Add a new package to the debuff monorepo (packages/* for browser runtime, tooling/* for Node). Use before creating any new workspace, and to review one that was just added.
---

# Adding a package

A new package is a new public promise: a name on npm, a line in the docs and something to keep tree-shakeable. Check first that it can't be a module in an existing package.

## 1. Decide where it goes

| Folder | For | Rules |
| --- | --- | --- |
| `packages/<name>` | Browser runtime | No Node APIs. `"sideEffects": false`. Dev-only code only inside `import.meta.env.DEV` or in `@debuffjp/dev`. |
| `tooling/<name>` | Node CLI, MCP, scaffolder | Node APIs are fine. |

Runtime dependencies need a trade-off note in the PR (AGENTS.md). Prefer writing the small piece yourself; if you must depend, wrap it in one module of ours that every caller goes through, so replacing it later touches one file.

If the package changes an architectural decision (a new layer, a new peer relationship), write an ADR in `docs/adr/` first.

## 2. Scaffold it

Copy the shape of `packages/juice` (the plainest runtime package):

- `package.json`: name `@debuffjp/<name>`, the shared `keywords`, `license`, `homepage`, `bugs`, `funding`, `repository.directory`, `"type": "module"`, `exports` with `types` before `default`, `files: ["dist", "README.md"]`, `scripts.build: "tsc -b"`, `publishConfig.access: "public"`. Start at the current version of the other `@debuffjp/*` packages: changesets keeps them `fixed` together.
- Other debuff packages it needs at runtime are `peerDependencies` (see `docs/architecture.md`), not `dependencies`.
- `tsconfig.json` extending `../../tsconfig.base.json` with `rootDir: src`, `outDir: dist`.
- `src/index.ts` as the only entry unless there is a reason for subpath exports.
- `test/*.test.ts`. The root `vitest.config.ts` picks up `packages/*/test` and `tooling/*/test` already.
- `README.md`: one-line summary, install, a short example, link to debuff.jp.

## 3. Register it

Each of these is a place that lists packages by hand:

- [ ] Root `tsconfig.json` `references`.
- [ ] Package table in the root `README.md`.
- [ ] The runtime package list in `docs/architecture.md` (runtime packages only).
- [ ] `D:/docs-live/typedoc.json` `entryPoints` for runtime packages.

A standalone spin-off with its own name (myaku, plonkjs, keiko) skips the last two. It gets its own section on debuff.jp instead, and its README row says "Standalone".
- [ ] Templates that should use it: their `package.json` (then `npm install` at the root).
- [ ] The agent skill `plugins/debuff/skills/debuff/SKILL.md` (and its copy under `plugins/openai/`), if game authors should reach for the package.

## 4. Check it

```bash
npm install
npm run check
```

`lint:packages` runs publint and attw on every non-private package, so a broken `exports` map fails here, not on npm. Report the template's brotli size from the build output if a template now imports the package.

Add a changeset (`npx changeset`) describing the package for users.

## 5. First publish

A brand-new name can't have a trusted publisher until it exists on npm. The first version is published locally; see `docs/releasing.md`. That's the maintainer's step: say it's needed, don't run it.

## 6. Document it

Follow the `write-docs` skill: a debuff.jp page in English and Japanese, and the docs ship before the release.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

View all in ai-agents →

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.