skills.rest
vellum-ai
vellum-aiOFFICIAL
Explore all skills by this author →
Website𝕏@vellum_aiGitHub

vellum-boundary-guard

Validates package import, HTTP, IPC, and security boundaries in Vellum Assistant architecture.

1.2k|166|Updated Feb 7, 2026
Search Tags:#Refactoring#Security#Monorepo#ipc#ARCHITECTURE#import boundaries#Code review
One-click install
npx skills add https://github.com/vellum-ai/vellum-assistant --skill vellum-boundary-guard
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vellum-boundary-guard
Source: https://github.com/vellum-ai/vellum-assistant/tree/main/.cursor/skills/vellum-boundary-guard
Command: npx skills add https://github.com/vellum-ai/vellum-assistant --skill vellum-boundary-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents architectural drift in the Vellum Assistant codebase by catching cross-package imports, misplaced endpoints, and security ownership violations before they are merged.

Core Features & Use Cases

  • Import Boundary Enforcement: Blocks relative imports between assistant/, gateway/, skills/, and meta/ packages, directing shared logic into packages/.
  • HTTP and IPC Routing Rules: Ensures public inbound endpoints live in gateway/ and CLI-to-assistant interactions use Unix socket IPC.
  • Security Ownership Checks: Verifies that gateway owns trust rules, CES owns credentials, and clients never read from ~/.vellum.
  • Use Case: When reviewing a pull request that adds a new route or moves code between packages, run this Skill to identify boundary violations and get a recommendation for the smallest boundary-preserving fix.

Quick Start

Review my current changes for any package boundary violations between assistant, gateway, and skills.

Frequently Asked Questions about vellum-boundary-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check for package boundary violations in a monorepo?▼

Search changed imports and new route registrations, then identify any package-crossing dependency. Decide whether the code belongs in a package-local module, a shared packages/ module, IPC, HTTP through the gateway, or a skill contract.

How to enforce import boundaries between packages in a codebase?▼

Define explicit rules such as blocking relative imports between assistant/ and gateway/, then verify them with guard tests. For tests needing behavior from another package, mock the boundary instead of importing real handlers.

Where should new HTTP endpoints live in the Vellum Assistant architecture?▼

Public inbound HTTP endpoints belong in the gateway/ package. Events from assistant runtime code should use the assistant event hub rather than new HTTP endpoints when possible.

Can skills import code directly from other packages?▼

No. First-party skills run as separate processes and must communicate through supported contracts. Direct relative imports bypass skill isolation and violate the boundary rules.

What are the security ownership boundaries in Vellum Assistant?▼

The gateway owns trust rules and security files, CES owns credential files, and the assistant must not read gateway-owned directories. Clients must not read from ~/.vellum, and secrets must never be stored in workspace files.

Related Skills

Explore More Software Engineering Skills→
lgerard314lgerard314

architecture-guard

Enforce monorepo rules and detect cross-service boundary violations.

Official
Advanced
LevironexeLevironexe
1

Next.js App Router

Standardize Next.js App Router project structure into app, components, lib, and actions directories.

Community
Advanced
monam2monam2

Lint & TypeCheck

Run ESLint and TypeScript checks to identify code quality issues.

Community
Intermediate
pax-kpax-k
3

architecture-boundary-enforcer

Enforce and document architecture boundaries using dependency-cruiser, ESLint, import-linter, and custom scripts.

Community
Advanced