Guide · Agent skill
How to use the Fullstack Guardian agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
Fullstack Guardian is an agent skill that tells an AI agent how to build a full-stack web feature from the database to the UI, with security checks at every layer. This guide covers what it does, how to install it from a ZIP file, how to trigger it with normal requests, and what to watch for. After reading, you should be able to add the skill to your agent and ask for a secured feature such as a CRUD screen with its REST endpoints.
Fullstack GuardianJeffallan/claude-skills · MIT Download the skill Quick start
- 1Download the ZIP. Get the fullstack-guardian ZIP from the skill page on this site.
- 2Unzip into the right folder. Unzip into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project for that project only.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the ZIP.
- 4Describe the feature in plain language. Explain the feature, such as a form that creates and edits records with a backing API.
- 5Review the design document. Check the requirements, acceptance criteria and specs/{feature}_design.md the agent writes before any code is produced.
- 6Check the security checklist results. Confirm auth, authorization, validation, output encoding and parameterized queries are addressed.
- 7Test each part as it is built. Run the tests the agent adds for each component, and handle the result before moving to the next step.
What is an agent skill, and what does Fullstack Guardian make the agent do?
An agent skill is a folder with a SKILL.md file and optional reference documents. When the skill is installed, the agent reads it and follows its workflow when a matching task comes up. Fullstack Guardian is one such skill, identified as fullstack-guardian and licensed MIT.
With the skill installed, the agent plans and builds a feature across the database, backend API and frontend UI together. It applies checks for authentication, authorization, input validation on both client and server, output encoding, and parameterized database queries.
- Gathers requirements and acceptance criteria before coding.
- Writes a short technical design document, stored as specs/{feature}_design.md.
- Runs a security checkpoint using references/security-checklist.md before writing code.
- Implements in small steps and tests each component as it goes.
- Loads reference guides on error handling, API design and architecture choices when relevant.
How do you install the fullstack-guardian skill?
You can install the skill in one of two ways. Download the ZIP file from the skill page on this site, then either unzip it into your personal skills folder or into a project's skills folder.
For a personal install, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. If you use the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into .claude/skills/ inside your project folder
- Claude apps: Settings, then Capabilities, then Skills, then upload the ZIP
How do you trigger the skill with a natural request?
You do not need a special command. Describe the feature in plain language and mention the kind of work involved. The skill's description lists the situations it is built for, so requests that match them are the most likely to load it.
Good triggers include full-stack feature work, building a REST API with a matching UI, connecting a frontend component to backend endpoints, or implementing CRUD operations with UI forms. Requests about microservices, real-time features, monorepo structure or technology selection also match.
- Build a feature to let users create, edit and delete support tickets, with API routes and form screens.
- Implement an authenticated endpoint that returns a user's profile, and wire up the page that shows it.
- Connect the order history page to the orders API and show errors clearly.
- Help me choose between a monolith and microservices for this project.
What does a secured feature look like?
The skill's example shows one authenticated route with its UI call. The backend checks the logged-in user, returns 403 before any database access if IDs do not match, uses a parameterized query, and returns an explicit response schema. The frontend attaches the auth header and validates input, but the server remains the real gate.
Use this example as a pattern for what the agent should produce, not as code to copy unchanged into production.
- Auth is enforced on the server through a require_auth dependency; the client header is a convenience only.
- The response schema excludes sensitive fields such as passwords and tokens.
- Client-side checks are never the only check.
@router.get("/users/{user_id}/profile", dependencies=[Depends(require_auth)])
async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
if current_user.id != user_id:
raise HTTPException(status_code=403, detail="Forbidden")
row = await db.fetchone("SELECT id, name, email FROM users WHERE id = ?", (user_id,))
if not row:
raise HTTPException(status_code=404, detail="Not found")
return ProfileResponse(**row)What files does the skill include?
The main SKILL.md holds the core workflow and constraints. The references folder holds topic guides that the agent loads when a task needs them. Each file covers one area, so the agent does not need to read everything for every feature.
- references/design-template.md: three-perspective design
- references/security-checklist.md: auth, authz and validation checks
- references/error-handling.md: error flows
- references/common-patterns.md: CRUD, forms and API flows
- references/backend-patterns.md: microservices, queues, observability and Docker
- references/frontend-patterns.md: real-time, optimization, accessibility and testing
- references/integration-patterns.md: type sharing, deployment and architecture decisions
- references/api-design-standards.md: REST and GraphQL conventions, versioning, CORS and validation
- references/architecture-decisions.md: technology selection and monolith vs microservices
- references/deliverables-checklist.md: completion and handoff
What do you need, and what are the safety notes?
The skill lists no requirements. It does not run scripts and does not use the network, according to its listing. Because it only guides the agent, you still review any code the agent writes before you run or deploy it.
The skill is a checklist and set of examples. It is not a security audit. For sensitive systems, have a qualified person review the authentication, authorization and data handling before production use.
- Requires: nothing listed
- Runs scripts: no
- Uses network: no
- Review all generated code before deploying it
- Never hardcode credentials or secrets; the skill's constraints say the same
What people use it for
- Adding a CRUD screen with a REST API and matching forms for a small internal tool.
- Building an authenticated profile or account page that reads from a protected endpoint.
- Wiring an existing frontend component to new backend endpoints with consistent error handling.
- Planning a new web app's architecture, including choosing a framework or deciding between a monolith and microservices.
- Reviewing a planned feature against a security-first checklist before coding starts.
Frequently asked questions
Is the fullstack-guardian skill free?
The skill is licensed under MIT, as stated in its listing and SKILL.md. Check the license text for the terms that apply to your use.
How do I install fullstack-guardian?
Download the ZIP from the skill page on this site and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps, you can upload the ZIP under Settings, Capabilities, then Skills.
What does fullstack-guardian require?
Its listing shows no requirements. It does not run scripts and does not use the network. You still need an agent that supports skills to use it.
When should I use fullstack-guardian instead of a frontend-only or backend-only skill?
Use it when a feature spans the database, API and UI and you want security checks at each layer. The skill notes that it may add unnecessary structure for a change that only touches the frontend or only the backend.
Is fullstack-guardian enough for a production security review?
No. The guidance is a checklist and examples, not an audit. Sensitive systems still need a qualified security review.
Why did the agent not follow the skill's workflow?
Check that the skill is in the correct folder and that your request matches its description, such as full-stack feature work or CRUD with UI forms. Ask the agent to follow the fullstack-guardian workflow explicitly if needed.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Fullstack Guardian suits developers building CRUD features or REST endpoints with matching UI, and teams that want a security-first checklist applied to new web features. It is a poor fit for small frontend-only or backend-only changes, where its full-stack structure can add unneeded work, and it is not a substitute for a security audit on sensitive systems.
Download the skill