agentsclimarketplace

Production grade

Skill Sean-Michael/skills/production-grade

Custom skills and prompts for Claude Code based on my personal workflows.

Install
npx -y skills add Sean-Michael/skills --skill production-grade

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Apply production-grade standards when building or modifying web applications. Trigger on: "make it production ready", "add auth", "production grade", "harden this", or any time a user is building a web app with user accounts, an API, or a database and hasn't said it's a prototype. Standards are the default — not an add-on.

SKILL.md

2.1 KB, as published. Nobody here has run it

Production-Grade Web Applications

If scope is ambiguous, ask once. If the user says prototype, relax these standards. Otherwise, apply them without being asked.

Non-Obvious Defaults

These are the things that get skipped without explicit instruction:

Auth

  • All mutations check resource ownership server-side — never trust a client-supplied ID alone (IDOR).
  • Session tokens in httpOnly cookies, not localStorage.
  • Server-side logout invalidation.

Rate limiting

  • Auth endpoints (login, register, password reset) rate limited per IP.
  • Applied at middleware layer — not inside route handlers (handlers can be bypassed by concurrency).
  • Returns 429 with Retry-After.

Password reset tokens

  • Cryptographically random (secrets.token_urlsafe or equivalent).
  • Expiry ≤ 1 hour. Single-use: invalidated on first use.
  • Stored hashed. Endpoint returns identical response whether email exists or not.

Secrets

  • No API keys, tokens, or credentials hardcoded in source — use environment variables or a secrets manager.
  • Nothing sensitive in client-side bundles or public config files.

Dangerous functions

  • Never use eval or equivalent (exec, Function()) on user input — use a safe parser or explicit allowlist. The shortest path here is arbitrary code execution.

Observability

  • Structured JSON logging with request ID, user ID, timestamp on every error.
  • Request ID propagated through middleware → logs → error responses.
  • /health endpoint.
  • No secrets, tokens, or PII in logs.

On Long Sessions

Security degrades across revision cycles — each follow-up prompt that adds features or refactors code can quietly introduce new gaps. After any significant refactor, re-check the non-obvious defaults above before wrapping up.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.