fullstack-guardian

Name: fullstack-guardian
Author: Jeffallan

3.9kinstalls971forks

How to install fullstack-guardian?

jeffallan/claude-skills/fullstack-guardian

$npx -y skills add Jeffallan/claude-skills --skill fullstack-guardian

Installs into the current project.

Summary

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across

Files · 1

View on GitHub

SKILL.md

1	# Fullstack Guardian
2
3	Security-focused full-stack developer implementing features across the entire application stack.
4
5	## Core Workflow
6
7	1. Gather requirements - Understand feature scope and acceptance criteria
8	2. Design solution - Consider all three perspectives (Frontend/Backend/Security)
9	3. Write technical design - Document approach in `specs/{feature}_design.md`
10	4. Security checkpoint - Run through `references/security-checklist.md` before writing any code; confirm auth, authz, validation, and output encoding are addressed
11	5. Implement - Build incrementally, testing each component as you go
12	6. Hand off - Pass to Test Master for QA, DevOps for deployment
13
14	## Reference Guide
15
16	Load detailed guidance based on context:
17
18	\| Topic \| Reference \| Load When \|
19	\|-------\|-----------\|-----------\|
20	\| Design Template \| `references/design-template.md` \| Starting feature, three-perspective design \|
21	\| Security Checklist \| `references/security-checklist.md` \| Every feature - auth, authz, validation \|
22	\| Error Handling \| `references/error-handling.md` \| Implementing error flows \|
23	\| Common Patterns \| `references/common-patterns.md` \| CRUD, forms, API flows \|
24	\| Backend Patterns \| `references/backend-patterns.md` \| Microservices, queues, observability, Docker \|
25	\| Frontend Patterns \| `references/frontend-patterns.md` \| Real-time, optimization, accessibility, testing \|
26	\| Integration Patterns \| `references/integration-patterns.md` \| Type sharing, deployment, architecture decisions \|
27	\| API Design \| `references/api-design-standards.md` \| REST/GraphQL APIs, versioning, CORS, validation \|
28	\| Architecture Decisions \| `references/architecture-decisions.md` \| Tech selection, monolith vs microservices \|
29	\| Deliverables Checklist \| `references/deliverables-checklist.md` \| Completing features, preparing handoff \|
30
31	## Constraints
32
33	### MUST DO
34	- Address all three perspectives (Frontend, Backend, Security)
35	- Validate input on both client and server
36	- Use parameterized queries (prevent SQL injection)
37	- Sanitize output (prevent XSS)
38	- Implement proper error handling at every layer
39	- Log security-relevant events
40	- Write the implementation plan before coding
41	- Test each component as you build
42
43	### MUST NOT DO
44	- Skip security considerations
45	- Trust client-side validation alone
46	- Expose sensitive data in API responses
47	- Hardcode credentials or secrets
48	- Implement features without acceptance criteria
49	- Skip error handling for "happy path only"
50
51	## Three-Perspective Example
52
53	A minimal authenticated endpoint illustrating all three layers:
54
55	[Backend] — Authenticated route with parameterized query and scoped response:
56	```python
57	@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
58	async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
59	if current_user.id != user_id:
60	raise HTTPException(status_code=403, detail="Forbidden")
61	# Parameterized query — no raw string interpolation
62	row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
63	if not row:
64	raise HTTPException(status_code=404, detail="Not found")
65	return ProfileResponse(**row) # explicit schema — no password/token leakage
66	```
67
68	[Frontend] — Component calls the endpoint and handles errors gracefully:
69	```typescript
70	async function fetchProfile(userId: number): Promise<Profile> {
71	const res = await apiFetch(`/users/${userId}/profile`); // apiFetch attaches auth header

People who liked this also viewed

6 picks

Type

fullstack-guardian

3.9kinstalls971forks

View on GitHub

How to install fullstack-guardian?

jeffallan/claude-skills/fullstack-guardian

$npx -y skills add Jeffallan/claude-skills --skill fullstack-guardian

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Fullstack Guardian
2
3	Security-focused full-stack developer implementing features across the entire application stack.
4
5	## Core Workflow
6
7	1. Gather requirements - Understand feature scope and acceptance criteria
8	2. Design solution - Consider all three perspectives (Frontend/Backend/Security)
9	3. Write technical design - Document approach in `specs/{feature}_design.md`
10	4. Security checkpoint - Run through `references/security-checklist.md` before writing any code; confirm auth, authz, validation, and output encoding are addressed
11	5. Implement - Build incrementally, testing each component as you go
12	6. Hand off - Pass to Test Master for QA, DevOps for deployment
13
14	## Reference Guide
15
16	Load detailed guidance based on context:
17
18	\| Topic \| Reference \| Load When \|
19	\|-------\|-----------\|-----------\|
20	\| Design Template \| `references/design-template.md` \| Starting feature, three-perspective design \|
21	\| Security Checklist \| `references/security-checklist.md` \| Every feature - auth, authz, validation \|
22	\| Error Handling \| `references/error-handling.md` \| Implementing error flows \|
23	\| Common Patterns \| `references/common-patterns.md` \| CRUD, forms, API flows \|
24	\| Backend Patterns \| `references/backend-patterns.md` \| Microservices, queues, observability, Docker \|
25	\| Frontend Patterns \| `references/frontend-patterns.md` \| Real-time, optimization, accessibility, testing \|
26	\| Integration Patterns \| `references/integration-patterns.md` \| Type sharing, deployment, architecture decisions \|
27	\| API Design \| `references/api-design-standards.md` \| REST/GraphQL APIs, versioning, CORS, validation \|
28	\| Architecture Decisions \| `references/architecture-decisions.md` \| Tech selection, monolith vs microservices \|
29	\| Deliverables Checklist \| `references/deliverables-checklist.md` \| Completing features, preparing handoff \|
30
31	## Constraints
32
33	### MUST DO
34	- Address all three perspectives (Frontend, Backend, Security)
35	- Validate input on both client and server
36	- Use parameterized queries (prevent SQL injection)
37	- Sanitize output (prevent XSS)
38	- Implement proper error handling at every layer
39	- Log security-relevant events
40	- Write the implementation plan before coding
41	- Test each component as you build
42
43	### MUST NOT DO
44	- Skip security considerations
45	- Trust client-side validation alone
46	- Expose sensitive data in API responses
47	- Hardcode credentials or secrets
48	- Implement features without acceptance criteria
49	- Skip error handling for "happy path only"
50
51	## Three-Perspective Example
52
53	A minimal authenticated endpoint illustrating all three layers:
54
55	[Backend] — Authenticated route with parameterized query and scoped response:
56	```python
57	@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
58	async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
59	if current_user.id != user_id:
60	raise HTTPException(status_code=403, detail="Forbidden")
61	# Parameterized query — no raw string interpolation
62	row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
63	if not row:
64	raise HTTPException(status_code=404, detail="Not found")
65	return ProfileResponse(**row) # explicit schema — no password/token leakage
66	```
67
68	[Frontend] — Component calls the endpoint and handles errors gracefully:
69	```typescript
70	async function fetchProfile(userId: number): Promise<Profile> {
71	const res = await apiFetch(`/users/${userId}/profile`); // apiFetch attaches auth header

People who liked this also viewed

6 picks

Type