fullstack-guardian

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, automation, database, react, security, web.

What it does

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill fullstack-guardian

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/fullstack-guardian ~/.claude/skills/fullstack-guardian

Safety box score

Grade C, moderate risk: 40 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a broad full-stack implementation guide that can generate frontend, backend, security, testing, and deployment artifacts. Its main risk is operational reach: it includes networked app patterns and deployment examples that can touch live services and cluster resources, including deletion commands, while most file writes stay inside the project.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It includes runnable build/test/deploy examples such as `npm run build`, Playwright, k6, and a Docker `CMD`, but no native executable script or installer ships with the skill.
Network access	2 (moderate)	The guidance explicitly uses outbound-facing patterns like `fetch`, `new WebSocket(url)`, and `http.get('https://api.example.com/users')`, so generated work will commonly send data over the network.
Filesystem reach	1 (low)	It writes design docs and project files such as `specs/{feature_name}_design.md`, migrations, and Docker/config files, but does not target home, system, or other out-of-repo paths.
Secrets & credentials	1 (low)	It mentions auth material like `JWT_SECRET=<generate-secure-secret>` and bearer/refresh tokens, but does not instruct reading existing secret stores or browser sessions.
Privilege & persistence	2 (moderate)	Deployment snippets and Kubernetes/Docker configuration can change service and runtime settings (`kubectl apply`, `kubectl patch`), though there is no sudo or global install step.
Instruction hijack surface	0 (none)	There are no prompt-injection instructions, hidden text, or requests to ignore safeguards; the content is ordinary implementation guidance.
Irreversible actions	3 (high)	The skill explicitly covers deployment handoff and includes commands like `kubectl apply -f k8s/green-deployment.yml` and `kubectl delete deployment myapp-blue`, which can publish or remove live workloads.
Transparency	0 (none)	All reviewed files are plain markdown with readable code blocks; there are no binaries, obfuscated blobs, or downloaded installers.

Before installing

Read `references/integration-patterns.md` for the `kubectl apply` and `kubectl delete deployment myapp-blue` examples before letting the agent use it.
Use a scratch repo or non-production branch first, and point any kubeconfig or deploy context at staging only.
Run it once with fake credentials and no production API tokens or cluster admin access.
Check whether you want the agent to create deployment/runbook files at all, or only app code and tests.

Rated 2026-10-20 by an automated review of 11 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/fullstack-guardian/SKILL.md
Branch: main
Updated: 2026-09-19

csharp-developer — Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Builds REST APIs using minimal or controller-based routing.
agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.
running-release-tests — Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile.
django-expert — Use when building Django web applications or REST APIs with Django REST Framework.