the-skills

Use when the user creates a route handler, Server Action, RPC endpoint, or any HTTP endpoint that mutates state or accepts user input. Covers rate limiting, body-size caps, request timeouts, idempotency keys, error response contracts, and method/CORS hygiene.

Use when the user is wiring login, signup, logout, OAuth, JWTs, session cookies, "remember me", password reset, magic links, or token storage. Covers httpOnly cookies vs localStorage, CSRF, session rotation, password hashing, logout-everywhere.

Use when the user writes any endpoint, server action, route handler, or query that reads or mutates user-owned data — anything taking a resource ID from the request. Catches IDOR, missing row-level checks, "logged in" mistaken for "allowed to," and role/permission gaps.

Use when the user adds a cache layer, memoizes a fetch, sets a Redis/KV key, configures Next.js fetch caching, or sees stale-data complaints. Covers cache keys, TTL choice, stampede prevention, invalidation strategies, and the per-user vs global trap.

Use when the user stores user data, PII, payment info, health/biometric data, builds export/delete features, signs up for data processors, configures backups, or designs cross-border data flows. Covers encryption at rest/transit, deletion paths, audit logs, what to never log, and minimum-data principles.

Use when the user writes raw SQL, Drizzle/Prisma/Kysely queries, ORM `findMany` / `findUnique` calls with user input, or anything constructing a query from request data. Covers parameterization, N+1 detection, missing indexes, SELECT *, query plans, and unbounded result sets.

Use when the user writes try/catch, throws errors, builds error boundaries, returns errors from an API, sets up global error handling, or designs how failures surface to users. Catches swallowed errors, leaked internals in error responses, missing graceful degradation, and "the spinner spins forever" UX.

Use when the user accepts file uploads, generates presigned URLs, proxies files to S3/R2/Blob storage, processes images/videos, or builds an "attach a file" feature. Catches server-proxied uploads (slow + memory-eating), unbounded sizes, MIME spoofing, image-resize abuse, and stored XSS via uploaded HTML/SVG.

Use when an endpoint, Server Action, route handler, form handler, or webhook receiver accepts a request body, query param, search param, header, or form data. Catches unvalidated `req.body`, missing schema parsing, type-cast assumptions, dates as strings, and trust-boundary holes.

Use when the user schedules a cron, ships a worker, sends an email/SMS asynchronously, processes uploads, builds a "do this in the background" flow, or any task that takes more than a second. Covers idempotent handlers, retries with backoff, dead-letter queues, the "exactly once" myth, and visibility timeouts.

Use when the user calls an LLM API from a server route, builds a chat endpoint, wires generateText/streamText/streamObject, integrates OpenAI/Anthropic/Google/Mistral, or proxies any AI request from the client. Catches client-side keys, missing per-user quotas, prompt injection, runaway costs, and abuse loops.

Use when the user edits a schema file (schema.prisma, drizzle schema), generates a migration, writes ALTER TABLE / DROP COLUMN / ADD CONSTRAINT, renames a column, or changes a type. Catches table locks on big tables, breaking deploys, missing backfills, no rollback path.

Use when the user is shipping anything to production, adding console.log for debugging, asking "why is this slow/broken?", wiring logging/tracing/metrics, or setting up alerts. Catches console.log in prod, missing trace IDs, alerting on symptoms instead of SLOs, and "we have no idea what happened" incidents.

Use when the user says "ready to ship", "ready for launch", "going live", "ready for prod", "production-ready", "ship it", before opening to real users, or before announcing a launch. Walks the full pre-launch checklist across security, data, reliability, ops, billing, and rollout — and explicitly flags what's missing.

Use when the user makes outbound HTTP calls, integrates a third-party API, calls an LLM/Stripe/email/SMS provider, or anywhere "the network might be slow or down." Covers timeouts, retries with jitter, circuit breakers, fallbacks, and the "what if their API is down at peak" question.

Use when the user mixes "use client" and server code, writes Server Actions, imports server-only or client-only modules, or hits hydration errors / "X is not exported from server" / "Functions cannot be passed to Client Components". Catches secrets leaking to the client, accidental client bundles, hydration drift, and the data-fetching-in-client-components anti-pattern.

Use when the user is adding an API key, editing .env / .env.local / .env.production, naming a variable NEXT_PUBLIC_/VITE_/PUBLIC_/EXPO_PUBLIC_, wiring a third-party SDK that needs a credential, or logging/returning errors that may include credentials. Catches client-bundled secrets, committed env files, and secrets in logs.

Use when the user writes tests, asks "should I write a test for this?", chooses between unit/integration/e2e, sets up a test runner, or hits flaky tests. Covers what to integration-test vs unit-test, testing the contract not the implementation, fakes vs mocks, and flaky-test triage.

Use when the user writes multi-step database mutations, money transfers, "create X and Y together", or anywhere a partial failure leaves the DB in an inconsistent state. Covers when to use a transaction, isolation levels, optimistic vs pessimistic locking, idempotency for mutations.

Use when the user is receiving webhooks (Stripe, GitHub, Slack, Clerk, Polar, Resend, Linear, Polar, custom), building a webhook endpoint, or signing webhooks for someone else. Catches missing signature verification, missing idempotency, sync handlers that time out, and replay vulnerabilities.