saas-starter-skills

Production-grade full-stack SaaS skills for AI coding agents — Next.js, Postgres/Drizzle, Auth, Stripe & Vercel.

Ask an agent to "build a SaaS app" and it cheerfully ships the same production bugs every time: DB queries with no tenant scoping, a Stripe success-redirect that grants paid access (no webhook), secrets prefixed NEXT_PUBLIC_, role === "admin" checks in the UI only, email sent inline on the request path, migrations that break mid-deploy. saas-starter-skills is a curated pack of 15 battle-tested skills that teach your agent to scaffold and ship a multi-tenant SaaS like a senior full-stack engineer — secure and isolated by default.

Works with Codex, Claude Code, Cursor, and OpenCode.

Pairs with saas-ui-skills — this repo is the backend/full-stack half, that one is the React + Tailwind + shadcn/ui half.

Quick start

Install all skills into your agent with one command — no install, no dependencies:

# Codex
npx saas-starter-skills install --target codex

# Claude Code
npx saas-starter-skills install --target claude

# Cursor
npx saas-starter-skills install --target cursor --scope project

# OpenCode
npx saas-starter-skills install --target opencode

# Everything, everywhere
npx saas-starter-skills install --target all

Browse what's inside first:

npx saas-starter-skills list

Then restart your agent (or start a new session) and it will pick the right skill up automatically when your task matches.

What's a "skill"?

A skill is a single Markdown file with YAML frontmatter telling the agent when to use it and how to do the task well:

---
name: payments-stripe
description: Use when integrating Stripe — Checkout, webhook verification, idempotency...
---

# Payments (Stripe)
...workflow, code patterns, pitfalls, hand-off...

Agents that support skills load the description up front and pull in the full body only when the task matches — so you get expert guidance without bloating every prompt.

The skills

Scaffold & data

| Skill | Use when… | |---|---| | project-scaffolding | Bootstrapping a Next.js App Router + TS app with sane server/client boundaries. | | environment-and-config | Validating env vars with zod, splitting server secrets from public config. | | database-schema | Modeling Postgres with Drizzle — users, orgs, memberships, tenant tables, migrations. | | data-access-layer | Wrapping the ORM in server-only, tenant-scoped query functions. |

Auth & tenancy

| Skill | Use when… | |---|---| | authentication | Adding sign-in/sign-up + sessions with Auth.js or a hosted provider. | | multi-tenancy | Orgs/teams/workspaces — resolving the active tenant and guaranteeing isolation. | | authorization-rbac | Controlling what a role may do with a central permission matrix + server checks. |

Money & comms

| Skill | Use when… | |---|---| | payments-stripe | Stripe Checkout, webhook signature verification, idempotent event handling. | | subscription-billing | Plans, limits, and feature entitlements enforced server-side. | | transactional-email | Resend + React Email, sent from jobs, with deliverability basics. |

API & ship

| Skill | Use when… | |---|---| | api-routes-and-validation | Route handlers / Server Actions with zod validation and consistent errors. | | background-jobs | Offloading email, webhooks, and exports to a queue with retries + idempotency. | | file-uploads-and-storage | Presigned direct-to-S3/R2 uploads, type/size limits, per-tenant keys. | | observability-and-errors | Sentry + structured logs + analytics, without leaking PII or secrets. | | deployment-and-ci | CI checks, preview deploys, migrations on release, health checks + rollback. |

Examples

See the skills applied. The examples/ folder has real generated code — the kind of output an agent produces when it follows a skill:

| Example | From skill | |---|---| | schema.ts | database-schema | | webhook.ts | payments-stripe | | createProject.ts | api-routes-and-validation | | permissions.ts | authorization-rbac |

Usage

npx saas-starter-skills <command> [options]

Commands
  list                       List available skills
  install                    Install skills into an agent

Options
  -t, --target <name>        codex | claude | opencode | cursor | all
      --scope <scope>        global (default) | project
      --skills <a,b,c>       comma-separated subset (default: all)
      --dir <path>           install into a custom directory (overrides target)
  -f, --force                overwrite existing skills
  -h, --help                 show this help

Examples

# Just the payments + schema skills, into the current project
npx saas-starter-skills install --target claude --skills payments-stripe,database-schema --scope project

# Into a custom agent directory
npx saas-starter-skills install --dir ./my-agent/skills

# Re-install and overwrite
npx saas-starter-skills install --target codex --force

Where skills get installed

| Target | Global | Project | |---|---|---| | Codex | ~/.codex/skills | .codex/skills | | Claude Code | ~/.claude/skills | .claude/skills | | OpenCode | ~/.config/opencode/skills | .opencode/skills | | Cursor | — | .cursor/rules (flat .md rules) |

Design principles

• Secure & isolated by default. Every data skill scopes to a tenant; every endpoint validates and authorizes.
• Concrete over abstract. Real Next.js + Drizzle + Stripe code, not vague advice.
• Pitfalls included. Each skill ends with the mistakes agents actually make.
• Composable. Skills hand off to each other (scaffold → data → auth → billing → ship).
• Zero-dependency installer. Pure Node, nothing to install, nothing to trust.

Built around Next.js + Drizzle + Stripe, but the patterns (tenant isolation, input validation, idempotent webhooks, expand-then-contract migrations) apply to any full-stack SaaS.

Contributing

New skills and improvements are very welcome — see CONTRIBUTING.md. Every skill is validated in CI:

node scripts/validate-skills.mjs

Open a skill request if there's a SaaS pattern you want your agent to master.

Author

Built by Param Bhavsar — Google Summer of Code '19 @ TensorFlow, ex-HSBC. If this saves you from shipping a cross-tenant data leak, a ⭐ helps others find it.

Part of a family of agent-skill packs: saas-ui-skills (React UI) · agent-ml-skills (ML/DS/MLOps).

License

MIT