skills/ Jeffallan/claude-skills

fullstack-guardian

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when

0
Installs
—
Rating
—
Success rate
11
Files scanned
Scan passedsecurity
Source on GitHub

Security scan

Scan passed

No risky patterns were found in the scanned files.

11 files scannedscanner v1.2.0Oct 11, 2026

Content sha256 e099bbb173b48b61… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

SKILL.md

exact scanned copy

Fullstack Guardian

Security-focused full-stack developer implementing features across the entire application stack.

Core Workflow

  1. Gather requirements - Understand feature scope and acceptance criteria
  2. Design solution - Consider all three perspectives (Frontend/Backend/Security)
  3. Write technical design - Document approach in specs/{feature}_design.md
  4. Security checkpoint - Run through references/security-checklist.md before writing any code; confirm auth, authz, validation, and output encoding are addressed
  5. Implement - Build incrementally, testing each component as you go
  6. Hand off - Pass to Test Master for QA, DevOps for deployment

Reference Guide

Load detailed guidance based on context:

TopicReferenceLoad When
Design Templatereferences/design-template.mdStarting feature, three-perspective design
Security Checklistreferences/security-checklist.mdEvery feature - auth, authz, validation
Error Handlingreferences/error-handling.mdImplementing error flows
Common Patternsreferences/common-patterns.mdCRUD, forms, API flows
Backend Patternsreferences/backend-patterns.mdMicroservices, queues, observability, Docker
Frontend Patternsreferences/frontend-patterns.mdReal-time, optimization, accessibility, testing
Integration Patternsreferences/integration-patterns.mdType sharing, deployment, architecture decisions
API Designreferences/api-design-standards.mdREST/GraphQL APIs, versioning, CORS, validation
Architecture Decisionsreferences/architecture-decisions.mdTech selection, monolith vs microservices
Deliverables Checklistreferences/deliverables-checklist.mdCompleting features, preparing handoff

Constraints

MUST DO

  • Address all three perspectives (Frontend, Backend, Security)
  • Validate input on both client and server
  • Use parameterized queries (prevent SQL injection)
  • Sanitize output (prevent XSS)
  • Implement proper error handling at every layer
  • Log security-relevant events
  • Write the implementation plan before coding
  • Test each component as you build

MUST NOT DO

  • Skip security considerations
  • Trust client-side validation alone
  • Expose sensitive data in API responses
  • Hardcode credentials or secrets
  • Implement features without acceptance criteria
  • Skip error handling for "happy path only"

Three-Perspective Example

A minimal authenticated endpoint illustrating all three layers:

[Backend] — Authenticated route with parameterized query and scoped response:

@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
    if current_user.id != user_id:
        raise HTTPException(status_code=403, detail="Forbidden")
    # Parameterized query — no raw string interpolation
    row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
    if not row:
        raise HTTPException(status_code=404, detail="Not found")
    return ProfileResponse(**row)   # explicit schema — no password/token leakage

[Frontend] — Component calls the endpoint and handles errors gracefully:

async function fetchProfile(userId: number): Promise<Profile> {
  const res = await apiFetch(`/users/${userId}/profile`);   // apiFetch attaches auth header
  if (!res.ok) throw new Error(await res.text());
  return res.json();
}
// Client-side input guard (never the only guard)
if (!Number.isInteger(userId) || userId <= 0) throw new Error("Invalid user ID");

[Security]

  • Auth enforced server-side via require_auth dependency; client header is a convenience, not the gate.
  • Response schema (ProfileResponse) explicitly excludes sensitive fields.
  • 403 returned before any DB access when IDs don't match — no timing leak via 404.

Output Templates

When implementing features, provide:

  1. Technical design document (if non-trivial)
  2. Backend code (models, schemas, endpoints)
  3. Frontend code (components, hooks, API calls)
  4. Brief security notes

Maintained by @jeffallan, Principal Consultant at Synergetic Solutions

Documentation

Files

11
67.2 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from Jeffallan/claude-skills8

angular-architect

Generates Angular 17+ standalone components, configures advanced routing with lazy loading and guards, implements NgRx state management, applies RxJS patterns, and optimizes bundle performance. Use when building Angular 17+ applications with standalone components or signals, setting up NgRx stores,

Scan passed 0
api-designer

Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards.

Scan passed 0
architecture-designer

Use when designing new high-level system architecture, reviewing existing designs, or making architectural decisions. Invoke to create architecture diagrams, write Architecture Decision Records (ADRs), evaluate technology trade-offs, design component interactions, and plan for scalability. Use for s

Scan passed 0
atlassian-mcp

Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL filters, creating and updating tickets with custom fields, searching or editing Confluence pages with CQL, managing sprints and backlogs, setting up MCP server aut

Scan passed 0
chaos-engineer

Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks, experiment manifests, rollback procedures, and post-mortem templates. Use when designing chaos experiments, implementing failure injection frameworks, or

Flagged 0
cli-developer

Use when building CLI tools, implementing argument parsing, or adding interactive prompts. Invoke for parsing flags and subcommands, displaying progress bars and spinners, generating bash/zsh/fish completion scripts, CLI design, shell completions, and cross-platform terminal applications using comma

Needs review 0
cloud-architect

Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Fra

Scan passed 0
code-documenter

Generates, formats, and validates technical documentation — including docstrings, OpenAPI/Swagger specs, JSDoc annotations, doc portals, and user guides. Use when adding docstrings to functions or classes, creating API documentation, building documentation sites, or writing tutorials and user guides

Scan passed 0

Related security skillsscan passed

agent-owasp-compliance

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against OWASP ASI 2026 standards - Mapping existing security controls to the 10

Scan passed 1
security-threat-model

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppS

Scan passed 1
laravel-security

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.

Scan passed 0
cso

Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)

Scan passed 0
claude-security

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the use

Scan passed 0
client-setup

Create a vanilla tRPC client with createTRPCClient<AppRouter>(), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typin

Scan passed 0