fullstack-guardian

Implements security-focused full-stack features spanning frontend, backend, and database layers.

1|Updated Aug 18, 2026
One-click install
npx skills add https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent --skill fullstack-guardian-scsm-unrestrict
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: fullstack-guardian
Source: https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent/tree/main/frontend-engineer/skills/fullstack-guardian
Command: npx skills add https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent --skill fullstack-guardian-scsm-unrestrict

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Full-stack features often ship with security gaps because frontend, backend, and security concerns are handled separately. This Skill enforces a three-perspective workflow so every feature addresses authentication, authorization, input validation, and output encoding across all layers before code is written. ## Core Features & Use Cases - Three-Perspective Design: Generates technical design documents covering Frontend, Backend, and Security concerns for every feature, with a mandatory security checklist checkpoint before coding. - Layered Implementation Guidance: Provides reference patterns for REST/GraphQL API design, CRUD flows, form handling, WebSocket real-time features, microservices, message queues, and database optimization. - Architecture Decision Support: Includes decision matrices for framework selection, monolith vs microservices, REST vs GraphQL, JWT vs sessions, and caching strategies. - Use Case: When building an authenticated user profile API with a React form, the Skill produces the backend endpoint with parameterized queries and ownership checks, the frontend component with validation and error handling, plus security notes on rate limiting and response filtering. ## Quick Start Ask the agent to implement a new full-stack feature, such as an authenticated CRUD endpoint with a corresponding UI form, and it will produce the design document, backend code, frontend code, and security notes.

Frequently Asked Questions about fullstack-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a secure full-stack feature with authentication?

Start with the three-perspective design template covering Frontend, Backend, and Security concerns, then run the security checklist before coding. Implement server-side auth guards, parameterized queries, scoped response schemas, and client-side validation as a secondary layer.

Should I use a monolith or microservices for my web application?

Choose a modular monolith for new products, teams under ten developers, or simple domains. Choose microservices when you have clear bounded contexts, independent scaling needs, multiple teams, and sufficient DevOps infrastructure.

REST vs GraphQL: which API style should I choose?

Choose REST for simple CRUD APIs, public APIs needing HTTP caching, and teams unfamiliar with GraphQL. Choose GraphQL for mobile apps needing flexible queries, complex data requirements, or real-time subscriptions.

How do I prevent SQL injection and XSS in full-stack apps?

Use parameterized queries for all database access and never interpolate user input into SQL strings. Sanitize and encode output on the frontend, define explicit response schemas that exclude sensitive fields, and validate input on both client and server.

JWT vs session-based authentication: which is better?

JWTs enable stateless horizontal scaling and suit SPAs and microservices, while sessions allow simple revocation. A hybrid approach works well: short-lived JWT access tokens paired with revocable refresh tokens stored in httpOnly cookies.

What are the limitations of client-side validation?

Client-side validation improves user experience but can be bypassed by anyone calling the API directly. Always re-validate on the server using schema validators like Zod or Pydantic, and treat client checks as a convenience, never the security gate.