Agent skills
BoringStack ships agent skills in the repo root .claude/skills/ (cross-app and audit skills) and per-app in apps/api/.claude/skills/ and apps/ui/.claude/skills/. Each skill is a markdown file with a prompt that an agent follows. Type the skill name (e.g., /add-full-feature) in Claude Code or Cursor and the agent runs the workflow.
Verification commands
Section titled “Verification commands”Skills guide an agent’s implementation work. The verified workflow supplies executable checks and structured evidence afterward. Use the account-resource recipe for its explicit owner/admin-write policy; the evaluator is separate maintainer tooling.
Full-stack skills
Section titled “Full-stack skills”/add-full-feature
Section titled “/add-full-feature”Builds a resource that needs both an API endpoint and a UI page. Runs the API feature builder, regenerates the OpenAPI client, then runs the UI feature builder against the new endpoint. Use this for pages, forms, and any cross-app slices.
Example: Resource: support-tickets, account-scoped, fields: subject + body + status, UI: list + create form
/build-feature
Section titled “/build-feature”Builds a feature inside one template only. In apps/api/: endpoints, CRUD resources, BullMQ jobs, audit-log events, notification events, ACL flags. In apps/ui/: pages, components, UI slices, wiring existing endpoints into the SPA.
Focused skills
Section titled “Focused skills”/add-audit-event
Section titled “/add-audit-event”Adds a single auditLogService.record(...) call to an existing service. Picks an action name from constants, decides what metadata is safe (no PII), wires it in, writes the test.
/add-email-template
Section titled “/add-email-template”Walk-through for manual email template creation: write Handlebars files, regenerate the precompiled JSON, call sendTemplate(...), inspect in Mailpit.
/add-notification-event
Section titled “/add-notification-event”Wraps bun run new:notification-event with dedup-strategy decisions, render functions, and dispatcher wiring.
Review skills
Section titled “Review skills”/security-review
Section titled “/security-review”Reviews a branch or PR for security regressions. Runs Layer 1 scanners locally (gitleaks, osv-scanner, bun audit) and kicks off Layer 2 agents (differential-review, insecure-defaults, sharp-edges, supply-chain-risk-auditor).
Checks BoringStack-specific invariants: ACL ability checks on every route, multi-tenant accountId scoping, Stripe webhook signature handling, rate limits on credential routes, audit-log coverage on mutations, idempotent BullMQ jobs.
On the UI: no raw fetch outside openapi.ts, no dangerouslySetInnerHTML, no import.meta.env outside src/lib/env/, no token storage in localStorage, no JSX strings without i18n, CSRF + content-type validation.
Audit skills
Section titled “Audit skills”A family of read-only, agent-to-agent audits. Each one runs static analysis and
writes evidence-backed findings to a single JSON artifact under .audit/, which
/execute-audit then works through autonomously. Every finding cites exact files
and is classified by whether a linter/parser guardrail could enforce it, so fixes
extend the tooling rather than patch one instance (“lint as a contract”).
/audit-monorepo
Section titled “/audit-monorepo”Read-only, full-monorepo audit (apps/api, apps/ui, apps/docs, infra, scripts, CI,
root configs). Fans out parallel read-only subagents per app and concern, then
writes one evidence-backed JSON report to .audit/audit-report.json. The broad
pass when you want everything in one report.
Scoped audits
Section titled “Scoped audits”Seven focused audits, each staying in its own lane so findings stay precise and routable. Reach for one when you want depth in a single area instead of the full sweep:
/audit-api-security: apps/api auth, OAuth, and sessions; multi-tenantaccountIdscoping; audit-log coverage on mutations; Stripe webhook verification; cookies; rate limiting; secret/PII leakage./audit-drizzle-queries: the apps/api Drizzle data layer. N+1 patterns, missing indexes, transaction boundaries, query-levelaccountIdscoping, raw-SQL safety, pagination correctness./audit-react-data: apps/ui data fetching and forms. TanStack Query keys, caching, and invalidation; mutation and optimistic-update correctness; loading/error states; React Hook Form + Zod validation./audit-react-hooks: apps/ui hooks. Effect dependency arrays, stale closures, memoization and render identity, callback stability, effect cleanup, rules-of-hooks edge cases./audit-ci-workflows:.github/workflowsand infra pipelines. Action SHA pinning, push/PR path-filter parity, least-privilege permissions, secret handling, concurrency, version-pin drift, local-vs-CI gate parity./audit-dependencies: dependencies across apps. Cross-app version drift, override hygiene, exact-pin policy, lockfile integrity, unused/missing deps (knip), supply-chain and vuln-override posture./audit-tests-coverage: test coverage and quality across apps. Missing sibling tests on logic modules, assertion-light tests, skipped tests without tracking, coverage-ratchet gaps, untested critical paths.
/execute-audit
Section titled “/execute-audit”Reads .audit/audit-report.json and works every finding to completion on a single
branch. Guardrail-first: when a finding is a class a rule can catch, it extends the
relevant lint:meta rule so the bug surfaces as a violation, then fixes the code,
validating each fix with the repo’s own bun run check, committing per finding,
and reverting-and-continuing on failure.
Related
Section titled “Related”- First feature in 10 minutes; end-to-end walkthrough.
- Spec loop; approval gate for risky slices.