Backend
The behind-the-scenes parts: logins, payments, databases and sending email.
18 skills. Each one is plain markdown you can paste into ChatGPT, Claude, Gemini or any AI chat, or install in Claude Code or Cursor. How it works
add-chatbot-guardrails-and-rate-limits
Protects a public AI chatbot from abuse before launch - per-user and per-IP rate limits, a monthly spend cap, input and output size limits, prompt-injection-resistant system prompts, moderation, and logging without personal data. Use when the user worries about abuse or a surprise AI bill, wants to rate limit an API, or needs to stop jailbreak attempts on a chatbot.
Not yet model-tested; testing Jan 2027Backendadd-clerk-auth
Adds Clerk authentication to a Next.js or React app - install the SDK, set the keys, wrap the app in ClerkProvider, add the hosted sign-in components, protect routes with clerkMiddleware, and check the user on the server before reading data. Use when the user mentions Clerk, wants Google sign-in through Clerk, or asks for Clerk middleware or protected pages.
Not yet model-tested; testing Jan 2027Backendadd-file-uploads
Adds file uploads to a web app - pick storage such as S3, R2, Supabase Storage or UploadThing, upload straight from the browser with signed URLs, check file type and size on the server, and keep private files behind signed links. Use when the user wants image uploads, profile photos, attachments, or a drag-and-drop upload box.
Not yet model-tested; testing Jan 2027Backendadd-stripe-checkout
Adds Stripe Checkout for one-off payments or subscriptions with a server route that creates the session and a verified webhook that fulfils the order. Use when the user wants to take payments, charge cards, sell a product, add a pricing page, subscriptions, or a buy button.
Not yet model-tested; testing Jan 2027Backendapply-stripe-best-practices
Reviews or plans a Stripe integration against Stripe's own guidance - pick the right API (hosted pages, Payment Element, Setup Intents, Connect, Tax), use restricted keys and sandboxes, and make webhook handling signed and idempotent. Use when choosing which Stripe API to use, reviewing existing Stripe code, or hardening a Stripe account before launch.
Not yet model-tested; testing Jan 2027Backendaudit-app-security
Audits a web app for the security holes AI-written code most often ships - leaked secrets, missing auth checks, open database rules, injection, unsafe uploads, weak headers and vulnerable packages - and fixes them in priority order. Use when the user asks for a security review or audit, worries their vibe-coded app is hackable, or wants to harden an app before going live.
Not yet model-tested; testing Jan 2027Backendbuild-ai-chatbot-api-route
Builds the server side of an AI chatbot - one API route that keeps the model key on the server, adds a system prompt, sends the chat history to an LLM such as OpenAI, Claude or Gemini, and streams the reply back. Use when the user wants to add a chatbot or AI assistant to their app, call the OpenAI API safely, or build a GPT-style chat backend.
Not yet model-tested; testing Jan 2027Backendbuild-contact-form-with-email
Builds a contact form that actually emails you, with a Next.js server action, server-side Zod validation, an email API such as Resend, a spam honeypot and success and error states. Use when the user wants contact form messages delivered to their inbox, an enquiry form, or a form that sends email.
Not yet model-tested; testing Jan 2027Backendbuild-fastapi-backend
Scaffolds a production-ready Python API with FastAPI - a clear folder layout, Pydantic models, settings from environment variables, dependency injection for the database and auth, async routes and a first pytest suite. Use when the user wants a Python backend, a FastAPI project, a REST API or server in Python, or to tidy a messy FastAPI app.
Not yet model-tested; testing Jan 2027Backendbuild-mcp-server
Builds a Model Context Protocol (MCP) server that gives AI agents like Claude, Cursor or Codex tools for your API, database or files - a few well-named tools with typed inputs, clear errors, stdio or HTTP transport, and a test with the MCP Inspector. Use when the user wants to build an MCP server, expose their app or API to an AI agent, or add custom tools to Claude or Cursor.
Not yet model-tested; testing Jan 2027Backendbuild-rag-search-over-docs
Builds retrieval-augmented generation (RAG) so an AI answers from your documents - split docs into chunks, embed them into a vector store, retrieve the best matches, and answer with citations or say it does not know. Use when the user wants a chatbot that knows their docs, AI search over a knowledge base, or answers grounded in their content.
Not yet model-tested; testing Jan 2027Backenddesign-rest-api
Designs a clean REST API before you build it - resource names, HTTP methods and status codes, request and response shapes, pagination, filtering, errors, versioning and auth - written down as a short contract the front end can rely on. Use when the user is planning API routes or endpoints, choosing status codes or an error format, or tidying an inconsistent API.
Not yet model-tested; testing Jan 2027Backenddesign-supabase-postgres-schema
Designs and reviews a Supabase Postgres database the safe and fast way - tables and migrations through the Supabase CLI, row level security on every exposed table, fast RLS policies, the right indexes and query checks with EXPLAIN. Use when creating Supabase tables, writing RLS policies, a Supabase query is slow, or the user asks for Postgres best practices on Supabase.
Not yet model-tested; testing Jan 2027Backendhandle-errors-gracefully
Adds sensible error handling to an app - separate expected errors from bugs, show friendly messages to users, log the details with context, retry only what is safe, and stop one failing service from taking the whole app down. Use when the app crashes on bad input, users see raw stack traces, or errors are swallowed and nothing gets logged.
Not yet model-tested; testing Jan 2027Backendoptimise-slow-sql-queries
Speeds up slow SQL queries in Postgres or MySQL - find the slow ones, read the EXPLAIN ANALYZE plan, add the right index, rewrite N+1 loops and wide selects, and page with cursors instead of big offsets. Use when a database query is slow, a page waits on the database, or the user mentions indexes, EXPLAIN or N+1 queries.
Not yet model-tested; testing Jan 2027Backendset-up-prisma-orm
Sets up Prisma ORM in a Node or TypeScript app, or repairs an existing app's database connection, by detecting the Prisma version first - new apps on Prisma 8, existing Prisma 6 or 7 apps kept on their version. Use when the user wants to add Prisma, connect Postgres or MySQL with an ORM, fix a Prisma connection error, or set up prisma.config.ts.
Not yet model-tested; testing Jan 2027Backendset-up-supabase-auth
Sets up Supabase authentication (email magic link, password or Google OAuth) in a Next.js app with server-side sessions, protected routes and row level security. Use when the user wants login, sign in, sign up, user accounts, auth, or to protect pages and data per user.
Not yet model-tested; testing Jan 2027Backendthreat-model-your-app
Writes a short, evidence-based threat model for your own codebase - map components, trust boundaries, assets and entry points, list realistic abuse paths, rank them by likelihood and impact, and tie each fix to a place in the code. Use when the user asks for a threat model, wants to know how an attacker could abuse their app, or plans security work before launch.
Not yet model-tested; testing Jan 2027