Audit the SaaS codebase (or a diff) against the path-scoped rules and an OWASP-style SaaS checklist: auth/session, RLS/tenant isolation, secrets, input validation, Stripe webhook verification, dependency vulnerabilities. Produces a severity-ranked findings report.
Implement Stripe billing end-to-end: products/prices from config, checkout session, webhook handler with signature verification and idempotency, and customer portal. Present plan then implement.
Set up the Vercel project, wire environment variables across environments, and add a GitHub Actions CI workflow (lint, typecheck, build). Presents the full config plan before touching anything.
Detect the project's current stage and route to the right first skill. Run at the very beginning of any new session. Shows the studio map and recommends the next action.
Report where the project stands: which spec artifacts exist, what's missing, and which skill to run next. Run at the start of any session to re-orient.
Scaffold the test stack for the SaaS app: install and configure Vitest + Testing Library, Playwright, and a CI test step. Run after qa-plan is approved. Produces a runnable test harness.
Produce a STRIDE-lite threat model for the SaaS app: enumerate assets, trust boundaries, and entry points, then name the top threat and mitigation for each STRIDE category, focused on multi-tenant SaaS.
Pressure-test a SaaS idea before any PRD: problem, target user, market, willingness to pay. Run right after /start. Produces an idea-validation doc and a PROCEED/PIVOT/KILL verdict.
Turn a validated idea into a full PRD: goals, target users, user stories with acceptance criteria, non-goals, and success metrics. Requires idea-validation.md. Drafts then awaits approval.
Author tests for one PRD user story: unit, integration, and e2e cases plus any RLS policy or Stripe webhook fixture tests required. Run after test-setup is complete. Produces passing test files.
★not rated 1 2mo agoA47 tokens
originalMIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: