These are my personal collection of skills that I use which have given me some good results over the time and I am just doing this so that they may be useful to someone else out there like me. They in no way guarantee any protection but they can help you get there.
I noticed my AI agent was great at making things work — and pretty bad at thinking about what happens when they don't. These skills are my attempt to close that gap. They're not a silver bullet, but they've made me a more careful builder.
A security-focused prompt gives you different thinking than a reliability one. I wrote separate skills for each domain so the agent could switch mental models rather than give me the same surface-level checks every time.
These skills ask it to re-read its own output with a more critical eye — like a second reviewer who's actively looking for what could go wrong, not just confirming what's there.
Race conditions, missing retries, unsigned webhooks. The stuff that doesn't show up in happy-path tests. I kept hitting the same patterns, so I wrote them down as things to always check.
Each skill is a plain Markdown file — just paste it into your agent's context when the domain is relevant. None of them guarantee anything, but they give the agent a better starting point than a blank slate.
These aren't rules handed down from on high. They're just patterns I've found myself thinking about repeatedly, so I baked them into the skills.
"Think like a real security engineer, not a tutorial."
Reason about the system as an attacker would. Assume credentials leak, tokens get replayed, and inputs are crafted, not typed.
"Test sad paths, not just happy paths."
Every new function deserves at least three failure tests: wrong input, missing dependency, partial success. The happy path is the easy one.
"Never trust the browser as a security boundary."
Client validation is UX. Server validation is the contract. Authorisation is checked on every read, every write, every join.
"Production-grade means recoverable, not perfect."
Assume something will break. Skills emphasise observability, graceful degradation, and reversible deploys over heroic correctness.
A few examples of the kinds of things these skills have helped surface in my own work. Not because the agent is careless — but because it needed a more specific lens to look through.
Install using npx commands — no SDK, no account. I usually load a skill right before a focused review, or keep a couple in my system prompt when I'm working in a sensitive area.
Use npx skills add to bring individual skills into .claude/,
.cursor/, or wherever your agent reads prompts from.
Take only what's useful to you.
I usually reach for a skill right before a focused pass — security before merging auth changes, reliability before a new async worker. Or drop it in your system prompt if you want it always on.
These work best as starting points. Edit them, combine them, strip out the parts that don't fit your stack. If you find something that works better, I'd love to know.
Everything is on GitHub. These are my skills — no team behind them, no roadmap, no promises. If something here saves you from a bad deploy or a security headache, that's good enough for me.