rzyfront/mobile-dev
skills/mobile-dev/SKILL.md
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
$ install --global
skillsauthnpx skillsauth add rzyfront/vendix mobile-devInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 5:11 AM52.1s1 file scanned
SKILL.md
- name:
- mobile-dev
- description:
- >
- Trigger:
- When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
- license:
- MIT
- author:
- rzyfront
- version:
- 1.0
- scope:
- [root]
- allowed-tools:
- Read, Edit, Write, Glob, Grep, Bash
Mobile Dev
Purpose
This skill governs all development within the mobile app (apps/mobile). Its primary purpose is to enforce strict boundaries: never edit files outside apps/mobile, even when referencing patterns from other projects for alignment.
The mobile app is an Expo/React Native project. It can reference frontend (apps/frontend) components/styles for UI alignment and backend (apps/backend) DTOs/interfaces for API contract alignment, but must never modify those files.
Core Rules
RULE 1: Exclusive Mobile Scope (BLOCKING)
ALL edits, creations, and modifications are exclusively within apps/mobile/.
ALLOWED:
apps/mobile/src/...
apps/mobile/app/...
apps/mobile/assets/...
apps/mobile/package.json
apps/mobile/tsconfig.json
apps/mobile/*.config.js
FORBIDDEN:
apps/backend/src/... ← Read only
apps/frontend/src/... ← Read only
libs/shared-types/src/... ← Read only
Any file outside apps/mobile/
RULE 2: Read-Only Access to Other Projects
The mobile project may read files from other projects for reference:
| Source | Purpose | Allowed |
|--------|---------|---------|
| apps/frontend/src/... | UI patterns, component structure, styling conventions | ✅ Read only |
| apps/backend/src/... | DTOs, API contracts, TypeScript interfaces | ✅ Read only |
| libs/shared-types/... | Shared enums, types, constants | ✅ Read only |
| apps/backend/prisma/... | Data models for understanding API entities | ✅ Read only |
| Any file outside apps/mobile/ | Reference only | ✅ Read only |
NEVER edit, modify, or write to any file outside apps/mobile/.
RULE 3: Dependency Isolation
All mobile-specific dependencies must be declared in apps/mobile/package.json only.
ALLOWED:
npm install <pkg> --prefix apps/mobile
# or edit apps/mobile/package.json directly
FORBIDDEN:
npm install <pkg> at root ← Breaks monorepo isolation
Editing root package.json ← Belongs to vendix-monorepo-workspaces
Adding deps to apps/frontend/ ← Not mobile's concern
Adding deps to apps/backend/ ← Not mobile's concern
RULE 4: Interface Alignment Without Modification
When aligning mobile interfaces with backend DTOs or frontend patterns:
- Read the backend DTO from
apps/backend/...to understand the API contract. - Create an equivalent TypeScript interface inside
apps/mobile/src/.... - Transform/adapt the data as needed for React Native.
- Never import directly from backend source files (no cross-app runtime imports).
CORRECT (read backend, create mobile version):
// Read: apps/backend/src/domains/product/dto/product.dto.ts
// Create: apps/mobile/src/app/products/interfaces/product.interface.ts
export interface Product {
id: string;
name: string;
price: number;
}
FORBIDDEN (direct import from backend):
import { ProductDto } from '../../../../backend/...'; // ✗ NO
RULE 5: No Shared Project Edits
Do not modify libs/shared-types/ or any shared library as part of mobile development. If a type needs to be shared, it must be defined independently in apps/mobile/src/ or requested as a separate cross-project change.
RULE 6: API Consumption Pattern
Mobile app consumes the same backend API as the frontend. When implementing API calls:
- Read the backend endpoint and DTO to understand request/response shapes.
- Create mobile service functions that call the API and transform responses.
- Do not copy backend validation or business logic — keep it in the backend.
Related Skills
vendix-core- Repository architecture and app boundary understandingvendix-monorepo-workspaces- Monorepo dependency and package managementvendix-backend-api- Understanding backend API endpoint patternsvendix-frontend-component- Reference for UI component patterns
Related Skills
rzyfront/vendix-subscription-gate
development
VerifiedTrustedCommunity
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-saas-billing
testing
VerifiedTrustedCommunity
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-redis-quota
development
VerifiedTrustedCommunity
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-product-variants
data-ai
VerifiedTrustedCommunity
Product and service variant rules for Vendix: variants as sellable options, inventory-independent availability, service variant booking overrides, and ecommerce/POS/cart behavior. Trigger: When creating, editing, validating, or selling product variants, service variants, products without stock, or any flow where variant availability must not be confused with inventory.
5SKILL.mdUpdated May 16, 2026