liriliri/vendor-dep
plugins/skills/vendor-dep/SKILL.md
Extract a npm dependency into the shared vendor bundle
$ install --global
skillsauthnpx skillsauth add liriliri/tinker vendor-depInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 17, 2026, 6:13 AM53.5s1 file scanned
SKILL.md
- name:
- vendor-dep
- description:
- Extract a npm dependency into the shared vendor bundle
- argument-hint:
- <package-name> <global-camel-name> <plugin-name> [plugin-name2 ...]
Vendor Dep
Extract a plugin's npm dependency into the shared vendor/ bundle so it can be reused across plugins.
Arguments
package-name: the npm package name (e.g.html-to-image)global-camel-name: camelCase name forglobalThisand IIFE export (e.g.htmlToImage)plugin-name: one or more plugin folder names that use this dependency (e.g.tinker-code-image tinker-photo-collage)
The vendor entry file name and build mode/script name are derived from global-camel-name lowercased (e.g. htmltoimage).
Steps
1. Derive names
lowerName=global-camel-namelowercased (e.g.htmlToImage→htmltoimage)pluginVendorName=PluginVendor+ PascalCase ofglobal-camel-name(e.g.PluginVendorHtmlToImage)
2. Create vendor entry file
First check how the plugin imports the package:
- Named exports (
import { foo } from '...'orimport * as foo from '...'): useimport * - Default export (
import Foo from '...'): use default import
Create vendor/<lowerName>.ts:
Named exports:
import * as <global-camel-name> from '<package-name>'
import { expose } from './util'
expose('<global-camel-name>', <global-camel-name>)
export { <global-camel-name> }
Default export:
import <global-camel-name> from '<package-name>'
import { expose } from './util'
expose('<global-camel-name>', <global-camel-name>)
export default <global-camel-name>
3. Update vendor/vite.config.ts
Add to globals map:
'<package-name>': '<global-camel-name>',
Add build target (before the final return createConfig('react', ...)):
if (target === '<lowerName>') {
return createConfig('<lowerName>', '<pluginVendorName>')
}
4. Update vendor/package.json
Add to devDependencies:
"<package-name>": "<version>"
Use the same version string currently in the plugin's package.json. Renderer libraries must always be installed as devDependencies, never dependencies.
Add build script:
"build:<lowerName>": "vite build --config vite.config.ts --mode <lowerName>"
Append to build script chain:
&& npm run build:<lowerName>
5. Remove from each plugin's package.json
For each <plugin-name>, remove <package-name> from devDependencies. If devDependencies becomes empty, keep the key with an empty object {}.
6. Add vendor script to each plugin's index.html
For each <plugin-name>, add the following <script> tag in <head> after existing vendor scripts:
<script src="/vendor/<lowerName>.js"></script>
Related Skills
liriliri/debug
tools
VerifiedTrustedCommunity
Debug Tinker plugins with agent-browser. Use when the user needs to open, inspect, interact with, restart, or close a plugin in the running Tinker Electron app.
135SKILL.mdUpdated May 23, 2026
liriliri/lint
tools
VerifiedTrustedCommunity
Check code against Tinker plugin coding standards
135SKILL.mdUpdated Apr 15, 2026
liriliri/new
tools
VerifiedTrustedCommunity
Create a new Tinker plugin from the template
132SKILL.mdUpdated May 23, 2026
liriliri/simplify
development
VerifiedTrustedCommunity
Review changed code for reuse, quality, and efficiency, then fix any issues found.
132SKILL.mdUpdated Apr 17, 2026