A library of 20 skills for shipping apps without footguns.
Overview
A library of 20 skills for shipping apps without footguns. Covers the stuff that breaks in production: exposed API keys, missing auth, no rate limits on LLM calls, JWTs in localStorage, SQL string concatenation, no migrations strategy, no observability. Each skill fires automatically on a specific symptom (writing an API route, adding an env var, wiring auth) so the guidance lands before the mistake, not in a postmortem. Modern stack assumed: TypeScript, edge runtimes, serverless, React Server Components, Postgres + Drizzle/Prisma, modern auth (Clerk, WorkOS, better-auth, Lucia), Vercel/Cloudflare/Fly, OpenTelemetry, structured logging. Each skill has: when-to-use / when-to-skip, numbered procedures, bad-vs-good examples, a story for the specific failure mode it prevents, and a quick checklist. Symlink each skill folder into your skills directory: Every skill has a SKILL.md with a YAML frontmatter description field. That description is symptom-based — phrased as "use when…
README
Suhail’s Skills
A library of 20 skills for shipping apps without footguns.
Covers the stuff that breaks in production: exposed API keys, missing auth, no rate limits on LLM calls, JWTs in localStorage, SQL string concatenation, no migrations strategy, no observability. Each skill fires automatically on a specific symptom (writing an API route, adding an env var, wiring auth) so the guidance lands before the mistake, not in a postmortem.
Modern stack assumed: TypeScript, edge runtimes, serverless, React Server Components, Postgres + Drizzle/Prisma, modern auth (Clerk, WorkOS, better-auth, Lucia), Vercel/Cloudflare/Fly, OpenTelemetry, structured logging.
What’s in here
| Skill | Fires when… |
|---|---|
| secrets-and-env | adding an API key, editing .env, naming a var NEXT_PUBLIC_* / VITE_* |
| auth-and-sessions | wiring login, JWTs, cookies, OAuth, “remember me” |
| authorization | writing any endpoint that reads or mutates user-owned data |
| input-validation | endpoint, Server Action, or form accepts a body / query / form data |
| api-route-hardening | creating a route handler, Server Action, or HTTP endpoint |
| llm-endpoint-safety | calling an LLM API from a server route, building a chat endpoint |
| database-query-safety | writing SQL, Drizzle/Prisma queries with user input |
| migrations-and-schema | editing a schema file, writing ALTER TABLE, generating a migration |
| transactions-and-consistency | multi-step DB writes, money/inventory/balance updates |
| jobs-and-queues | scheduling crons, shipping workers, any task >1s |
| caching-and-invalidation | adding a cache layer, memoizing, hitting stale-data symptoms |
| rsc-boundaries | mixing "use client" / Server Actions, hydration errors |
| error-handling | writing try/catch, error boundaries, returning errors from an API |
| observability | shipping anything to prod, asking “why is this slow/broken?” |
| reliability-patterns | making outbound HTTP calls, integrating a third-party API |
| testing-strategy | writing tests or asking “should I test this?” |
| data-privacy | storing PII, building export/delete, handling cross-border data |
| webhooks | receiving webhooks (Stripe, GitHub, Slack, Clerk, Polar) |
| file-uploads | accepting uploads, generating presigned URLs, processing images |
| production-readiness | “we’re shipping,” “ready for launch,” “going live” |
Each skill has: when-to-use / when-to-skip, numbered procedures, bad-vs-good examples, a story for the specific failure mode it prevents, and a quick checklist.
Install
Symlink each skill folder into your skills directory:
for d in */; do
ln -s "$(pwd)/$d" ~/.claude/skills/$(basename "$d")
done
Or copy them in directly if you prefer.
How they work
Every skill has a SKILL.md with a YAML frontmatter description field. That description is symptom-based — phrased as “use when…” — so the dispatch matches what you’re actually doing rather than what the skill is “about.”
The body of each skill is short on essays and long on procedure: numbered rules, bad-vs-good code, and a quick checklist at the end. Sibling reference files exist where a section earned its own page.
Contributing
Add a skill the same shape as the existing ones:
- Folder name = skill name (kebab-case)
SKILL.mdwith frontmatter (name,description)- Description is a symptom-based trigger, not a topic label
- Body under ~200 lines; split deeper material into sibling files
- At least one concrete failure story per skill — the specific incident it prevents
License
MIT.
Recommended Tools
Try a different keyword or remove a filter.
Install
npx skillfish add suhailkakar/the-skills