Menu
Audit import dependencies in packages/game to verify they comply with the layered architecture rules
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/dkolba/bruff --skill verify-layersThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Write cutting-edge and modern native CSS. Apply this skill whenever writing, reviewing, or refactoring CSS for components, layouts, design systems, or theming, even if the user doesn't say "modern CSS" explicitly. Covers a self-contained design-token scale (color, size, shadow, ease, type), cascade layers (@layer), @scope for component isolation (donut scopes, :scope specificity, scoping proximity), container queries, :has(), OKLCH/color-mix, native nesting, subgrid, fluid typography via clamp(), scroll-driven animations, logical properties, and concrete native replacements for SCSS mixins, maps, and variables.
Apply this skill whenever the task involves web security: writing or auditing HTTP security headers, configuring CSP, CORS, HSTS, or Permissions-Policy, sanitising untrusted HTML (Sanitizer API / DOMPurify), implementing Trusted Types to prevent DOM-XSS, setting up the Reporting API to capture CSP/COEP/deprecation violations, hardening cookies (SameSite, HttpOnly, Secure, Partitioned), implementing WebAuthn / Credential Management, using Web Crypto for client-side cryptography, or auditing code for XSS, CSRF, clickjacking, MIME-sniffing, mixed content, or cross-origin data leakage. Triggers on keywords: XSS, CSRF, CSP, CORS, HSTS, SameSite, innerHTML, eval, Trusted Types, Sanitizer, ReportingObserver, WebAuthn, cross-origin, clickjacking, Content-Security-Policy, Referrer-Policy, Permissions-Policy, subresource integrity, cookie security, secure context, same-origin, mixed content.
Patterns for invoking the GitHub CLI (gh) from agents. Covers structured output, pagination, repo targeting, search vs list, gh api fallback.
Showing SKILL.md
Based on SOC occupation classification
| name | verify-layers |
| description | Audit import dependencies in packages/game to verify they comply with the layered architecture rules |
Use when you want to audit or enforce the layered architecture dependency rules before committing.
core/ — zero imports (fully dependency-free)
state/ — imports core/ only
input/ — imports core/ + state/ only
render/ — imports core/ + state/ only
effects/ — shell wiring over core/state/input/render plus allowed workspace utilities
No circular dependencies. No upward dependencies (e.g. core/ must never import from state/).
@bruff/utils imports are allowed from any layer for shared pure helpers and types. log() from @bruff/utils is shell-only: it may be imported by effects/ or the entry point, but not by core/, state/, input/, or render/. @bruff/utils/dom imports are browser-shell utilities and are allowed only from effects/ or tests for effects-layer code. Production code should not call console.* directly; console forwarding is handled by the logging event bus sink.
Search packages/game/lib/ (and sub-directories) for import violations:
# Check that core files import nothing from the project
grep -rn "from \"\.\." packages/game/lib/core/
# Check inner layers for upward imports
rg 'from "\\.\\.' packages/game/lib/state packages/game/lib/render packages/game/lib/input
# Check for circular dependencies using madge (if available)
npx madge --circular packages/game/lib/
For each violation found, report:
core/ imports from any project pathstate/ imports from input/, render/, or effects/core/, state/, input/, or render/ imports log from @bruff/utilscore/, state/, input/, or render/ imports from @bruff/utils/domrender/project-render-commands.ts projects GameState to RenderCommand values without DOM or Canvas accesseffects/execute-render-command.tseffects/clock.ts is the only production file that reads performance.now()window.__bruffTestApi is attached only behind the __BRUFF_TEST_MODE__ / isTestMode() gateconsole.* outside the event-bus console sink@bruff/utils root imports are universal helpers or shell-approved log() importseffects/, entry point)