Columbia-Cloudworks-LLC/trowel
.cursor/skills/trowel/SKILL.md
Use when auditing dependency health, API contract consistency, shared data shapes, or brittle integration seams between modules, services, and packages.
$ install --global
skillsauthnpx skillsauth add Columbia-Cloudworks-LLC/EquipQR trowelInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 10:47 PM10.3s1 file scanned
SKILL.md
- name:
- trowel
- description:
- Use when auditing dependency health, API contract consistency, shared data shapes, or brittle integration seams between modules, services, and packages.
Trowel
Symbolism
The trowel spreads the cement that unites separate parts into one sound building.
Purpose
Audit the bonds between modules, services, dependencies, and APIs so the codebase remains cohesive instead of fragile.
This skill focuses on dependency health, contract consistency, and integration points that are likely to crack under change.
Invocation
/trowel/trowel <optional-scope-path>
Operating Rules
- Inspect both dependency declarations and real integration seams.
- Distinguish stale or risky dependencies from harmless version lag.
- Compare frontend and backend contracts where data crosses boundaries.
- Favor fixes that reduce brittleness and duplication at the seam.
- Explain integration risk in terms of breakage modes, not only version numbers.
Workflow
Copy this checklist and track it while running:
Trowel Progress
- [ ] 1) Confirm scope and major integration seams
- [ ] 2) Review dependency declarations and usage patterns
- [ ] 3) Compare API and data-shape contracts across boundaries
- [ ] 4) Identify brittle or inconsistent integration points
- [ ] 5) Propose cohesion fixes
1) Confirm scope and major integration seams
Identify where the target area connects to other modules, services, packages, APIs, or generated artifacts.
2) Review dependency declarations and usage patterns
Check for:
- unused or suspicious dependencies
- overlapping libraries solving the same problem
- outdated packages that create real compatibility or security risk
- scripts or tooling references that no longer match actual usage
3) Compare API and data-shape contracts across boundaries
Verify that the producer and consumer agree on field names, types, nullability, states, and error shapes.
4) Identify brittle or inconsistent integration points
Flag seams that rely on undocumented assumptions, duplicated mapping logic, or manual synchronization across layers.
5) Propose cohesion fixes
Recommend changes that make the integration sturdier: shared types, adapter cleanup, dependency pruning, contract tests, or clearer ownership.
Output Contract
- Dependency and Integration Snapshot
- Contract Mismatches or Risky Dependencies
- Cohesion Plan
- Immediate vs Deferred Fixes
- Next Step
Guardrails
- Do not recommend upgrades solely because a newer version exists.
- Do not treat generated code drift as a dependency issue without checking the source contract.
- Do not collapse distinct integration concerns into one vague "refactor."
- Do not ignore migration cost when suggesting dependency changes.
Related Skills
Columbia-Cloudworks-LLC/react-best-practices
development
VerifiedTrustedCommunity
React performance optimization guidelines from Vercel Engineering, with EquipQR-specific mappings (Vite + React Router + TanStack Query). Use when writing, reviewing, or refactoring React code in this repo, especially around waterfalls, bundle size, and re-renders.
1SKILL.mdUpdated Apr 16, 2026
Columbia-Cloudworks-LLC/postgres-best-practices
testing
VerifiedTrustedCommunity
Postgres performance optimization and best practices from Supabase, adapted to EquipQR's Supabase (Postgres + RLS) workflow. Use when editing SQL, migrations, indexes, or RLS policies.
1SKILL.mdUpdated Apr 16, 2026
Columbia-Cloudworks-LLC/brand-guidelines
development
VerifiedTrustedCommunity
Applies EquipQR's brand colors and design-system tokens to any artifact that should match EquipQR's look-and-feel. Use it when brand colors, style guidelines, visual formatting, or EquipQR design standards apply.
1SKILL.mdUpdated Apr 16, 2026
Columbia-Cloudworks-LLC/trestle
development
VerifiedTrustedCommunity
Use when aligning current repository state with roadmap priorities, reconciling GitHub issues or organization project items with what exists in the codebase, or deriving next steps across code, docs, and EquipQR work tracking.
1SKILL.mdUpdated Apr 16, 2026