Vendor Bundle Conventions

Name: Vendor Bundle Conventions
Author: samugit83

ASecurity

When editing a vendored third-party bundle, keep the upstream layout

2 stars
0 votes
0 copies
1 view
Added October 17, 2026

ai-agents

Security analysis

A100/100

Scanned October 17, 2026

npx -y skills add samugit83/cortex --skill vendor-bundle-conventions --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Vendor Bundle Conventions?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Vendor Bundle Conventions

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/samugit83-vendor-bundle-conventions/badge)](https://www.skillsdirectory.com/skills/samugit83-vendor-bundle-conventions)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: vendor-bundle-conventions
description: When editing a vendored third-party bundle, keep the upstream layout
paths:
  - "vendor/**"
  - "third_party/**"
---

# Vendored code

A vendored bundle is a copy of somebody else's release, and the next upgrade is
a straight overwrite.

1. Never reformat a vendored file: the diff against upstream is the only thing
   that shows what was changed on purpose.
2. Keep local changes in one patch file beside the bundle, never inline.
3. Record the upstream version in the bundle's own marker file, so an upgrade
   can tell what it is replacing.