A free, open-source Agent Skill for Claude that stops the model from writing 2019-era code in 2026 projects.
LLMs are trained on a decade of blog posts, Stack Overflow answers, and abandoned repos, so the statistically likely completion is often the outdated or insecure one. This skill overrides that default with current, production-correct patterns for the Node/Mongo/React ecosystem — and catches the bugs models reproduce most often: deprecated APIs, IDOR, injection, mass assignment, N+1 queries, race conditions, at-least-once delivery bugs, and broken responsive/RTL/a11y markup.
SKILL.md is a router: Claude reads it, then loads only the reference file matching the layer being touched, keeping context usage small.
| Layer | Reference |
|---|---|
| Node runtime, async, Express routes, middleware, error handling | references/node-express.md |
| Mongoose schemas, queries, indexes, transactions, idempotency | references/mongodb-mongoose.md |
| NestJS modules, DTOs, guards, TypeORM/Postgres, GraphQL | references/nestjs-typeorm.md |
| React components, hooks, Next.js routing, Server Actions, caching | references/react-next.md |
| EJS templates, server-rendered forms, POST-Redirect-GET | references/ejs-ssr.md |
| Auth, secrets, XSS, CORS, CSRF, cookies, headers, uploads, SSRF | references/security.md |
| UI: forms, tables, modals, responsive, RTL, a11y, dark mode | references/ui-a11y-rtl.md |
| BullMQ, Redis, cron, distributed locking, caching | references/redis-bullmq-jobs.md |
| Puppeteer/Playwright/Crawlee, crawlers, extraction pipelines | references/scraping-automation.md |
| Telegram/WhatsApp bots, Baileys, Socket.IO, websockets | references/bots-realtime.md |
| Payments, provider webhooks, credit/wallet ledgers, subscriptions | references/payments-saas.md |
| LLM API calls, prompts, tool calling, RAG, agent loops | references/ai-integrations.md |
| Dependencies, Biome/ESLint, package managers, git, scripts | references/biome-tooling.md |
| Test strategy, Supertest, Testcontainers, MSW, Playwright | references/testing.md |
| Logging, redaction, correlation ids, health checks, alerting | references/observability.md |
| PM2/nginx/Cloudflare, shared hosting, Docker, migrations, backups | references/deployment.md |
| File structure, layering, naming, TypeScript hygiene | references/code-quality.md |
| Current framework versions and recently-changed APIs | references/versions-verified.md |
Every rule carries a tag that tells Claude how hard to enforce it:
| Tag | Meaning |
|---|---|
| [MUST] | Security or runtime correctness — never ship code that violates it |
| [SHOULD] | Strong best practice — follow by default, deviate with a stated reason |
| [CONTEXTUAL] | Depends on project size, stack, or hosting — infer or ask |
| [AVOID] | A smell, not an error — flag it, don't block on it |
This repo is also a plugin marketplace. Inside Claude Code:
/plugin marketplace add leviro/web-stack-guardrails
/plugin install web-stack-guardrails@web-stack-guardrails
You get update notifications when new versions are published — refresh with /plugin marketplace update.
Copies the skill into ~/.claude/skills (override the target with CLAUDE_SKILLS_DIR):
curl -fsSL https://raw.githubusercontent.com/leviro/web-stack-guardrails/main/install.sh | bashRe-run the same command to update.
git clone https://github.com/leviro/web-stack-guardrails.git
mkdir -p ~/.claude/skills/web-stack-guardrails
cp -r web-stack-guardrails/{SKILL.md,references,scripts} ~/.claude/skills/web-stack-guardrails/For a single project instead (commit it so your whole team gets the skill), copy the same three items into .claude/skills/web-stack-guardrails/ inside the project.
After any of the above, restart Claude Code (or start a new session). The skill shows up in the available-skills list and can be triggered explicitly with /web-stack-guardrails (or /web-stack-guardrails:web-stack-guardrails when installed as a plugin).
Download web-stack-guardrails.skill from the latest release and upload it under Settings → Capabilities → Skills (requires a plan with skills support). The .skill file is a zip of SKILL.md + references/ + scripts/, built automatically by CI on every tagged release.
No commands needed after install. The skill activates automatically whenever Claude writes or reviews code in a covered layer — Express routes, Mongoose queries, React components, payment webhooks, bot handlers, deployment configs, and so on. It stays out of the way for pure algorithm questions, other languages, or concept explanations.
What changes in practice:
- Claude reads
package.jsonbefore writing code, instead of guessing framework versions. - Endpoints get ownership checks, not just authentication.
req.bodyis never spread into a model — fields are allowlisted or schema-validated.- Webhooks and queue jobs get idempotency guards.
- Money is stored in integer minor units; dates are stored UTC.
- UI ships with loading/error/empty states and survives 320px and
dir="rtl".
If a rule blocks something you actually want, tell Claude — only [MUST] rules are non-negotiable, and your repo's existing conventions always win over the skill's preferences.
Fork it. Edit the reference files, add your own, or delete layers you don't use — just keep the router table in SKILL.md in sync with the files on disk. Then lint the package:
python3 scripts/validate.pyThe validator checks for stale API patterns in examples, broken cross-file links, router entries that don't match files on disk, duplicated paragraphs, [MUST] rules with no stated failure mode, and the overall MUST/SHOULD ratio. It exits non-zero on errors; warnings are advisory.
Version numbers live only in references/versions-verified.md (with a verified_at date) so they can be refreshed without touching the rules.
MIT — free for any use, commercial or personal. Copy it, fork it, ship it with your product. Attribution appreciated but the license only requires keeping the copyright notice.