saas-starter-skills

saas-starter-skills

Production-grade full-stack SaaS skills for AI coding agents — Next.js, Postgres/Drizzle, Auth, Stripe & Vercel.

Ask an agent to "build a SaaS app" and it cheerfully ships the same production bugs every time: DB queries with no tenant scoping, a Stripe success-redirect that grants paid access (no webhook), secrets prefixed NEXT_PUBLIC_, role === "admin" checks in the UI only, email sent inline on the request path, migrations that break mid-deploy. saas-starter-skills is a curated pack of 15 battle-tested skills that teach your agent to scaffold and ship a multi-tenant SaaS like a senior full-stack engineer — secure and isolated by default.

Works with Codex, Claude Code, Cursor, and OpenCode.

Pairs with saas-ui-skills — this repo is the backend/full-stack half, that one is the React + Tailwind + shadcn/ui half.

Quick start

Install all skills into your agent with one command — no install, no dependencies:

# Codex
npx saas-starter-skills install --target codex

# Claude Code
npx saas-starter-skills install --target claude

# Cursor
npx saas-starter-skills install --target cursor --scope project

# OpenCode
npx saas-starter-skills install --target opencode

# Everything, everywhere
npx saas-starter-skills install --target all

Browse what's inside first:

npx saas-starter-skills list

Then restart your agent (or start a new session) and it will pick the right skill up automatically when your task matches.

What's a "skill"?

A skill is a single Markdown file with YAML frontmatter telling the agent when to use it and how to do the task well:

---
name: payments-stripe
description: Use when integrating Stripe — Checkout, webhook verification, idempotency...
---

# Payments (Stripe)
...workflow, code patterns, pitfalls, hand-off...

Agents that support skills load the description up front and pull in the full body only when the task matches — so you get expert guidance without bloating every prompt.

The skills

Scaffold & data

Skill	Use when…
project-scaffolding	Bootstrapping a Next.js App Router + TS app with sane server/client boundaries.
environment-and-config	Validating env vars with zod, splitting server secrets from public config.
database-schema	Modeling Postgres with Drizzle — users, orgs, memberships, tenant tables, migrations.
data-access-layer	Wrapping the ORM in server-only, tenant-scoped query functions.

Auth & tenancy

Skill	Use when…
authentication	Adding sign-in/sign-up + sessions with Auth.js or a hosted provider.
multi-tenancy	Orgs/teams/workspaces — resolving the active tenant and guaranteeing isolation.
authorization-rbac	Controlling what a role may do with a central permission matrix + server checks.

Money & comms

Skill	Use when…
payments-stripe	Stripe Checkout, webhook signature verification, idempotent event handling.
subscription-billing	Plans, limits, and feature entitlements enforced server-side.
transactional-email	Resend + React Email, sent from jobs, with deliverability basics.

API & ship

Skill	Use when…
api-routes-and-validation	Route handlers / Server Actions with zod validation and consistent errors.
background-jobs	Offloading email, webhooks, and exports to a queue with retries + idempotency.
file-uploads-and-storage	Presigned direct-to-S3/R2 uploads, type/size limits, per-tenant keys.
observability-and-errors	Sentry + structured logs + analytics, without leaking PII or secrets.
deployment-and-ci	CI checks, preview deploys, migrations on release, health checks + rollback.

Examples

See the skills applied. The examples/ folder has real generated code — the kind of output an agent produces when it follows a skill:

Example	From skill
schema.ts	database-schema
webhook.ts	payments-stripe
createProject.ts	api-routes-and-validation
permissions.ts	authorization-rbac

Usage

npx saas-starter-skills <command> [options]

Commands
  list                       List available skills
  install                    Install skills into an agent

Options
  -t, --target <name>        codex | claude | opencode | cursor | all
      --scope <scope>        global (default) | project
      --skills <a,b,c>       comma-separated subset (default: all)
      --dir <path>           install into a custom directory (overrides target)
  -f, --force                overwrite existing skills
  -h, --help                 show this help

Examples

# Just the payments + schema skills, into the current project
npx saas-starter-skills install --target claude --skills payments-stripe,database-schema --scope project

# Into a custom agent directory
npx saas-starter-skills install --dir ./my-agent/skills

# Re-install and overwrite
npx saas-starter-skills install --target codex --force

Where skills get installed

Target	Global	Project
Codex	~/.codex/skills	.codex/skills
Claude Code	~/.claude/skills	.claude/skills
OpenCode	~/.config/opencode/skills	.opencode/skills
Cursor	—	.cursor/rules (flat .md rules)

Design principles

• Secure & isolated by default. Every data skill scopes to a tenant; every endpoint validates and authorizes.
• Concrete over abstract. Real Next.js + Drizzle + Stripe code, not vague advice.
• Pitfalls included. Each skill ends with the mistakes agents actually make.
• Composable. Skills hand off to each other (scaffold → data → auth → billing → ship).
• Zero-dependency installer. Pure Node, nothing to install, nothing to trust.

Built around Next.js + Drizzle + Stripe, but the patterns (tenant isolation, input validation, idempotent webhooks, expand-then-contract migrations) apply to any full-stack SaaS.

Contributing

New skills and improvements are very welcome — see CONTRIBUTING.md. Every skill is validated in CI:

node scripts/validate-skills.mjs

Open a skill request if there's a SaaS pattern you want your agent to master.

Author

Built by Param Bhavsar — Google Summer of Code '19 @ TensorFlow, ex-HSBC. If this saves you from shipping a cross-tenant data leak, a ⭐ helps others find it.

Part of a family of agent-skill packs: saas-ui-skills (React UI) · agent-ml-skills (ML/DS/MLOps).

License

MIT