Fullstack Guardian
Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help you build a signup form with password reset and email verification. There are a few different approaches we could take here. First, do you have a preference on the tech stack? Are you using React, Vue, Svelte, or something else? On the backend, would you prefer Node.js, Python, or another framework? Also, are you storing passwords in your own database or using a third-party auth provider like Auth0? I could build this as a simple form submission or set up a more sophisticated flow with tokens. Once you let me know your stack preferences and requirements, I can draft the implementation. I'm also happy to add CSRF protection and rate limiting if that matters to you.
SIGNUP FORM + PASSWORD RESET FLOW
FRONTEND COMPONENTS
• Signup form: Email field (validated as RFC 5321), password field with strength meter, honeypot field
• Email verification modal: 6-digit code input, resend button (60-second throttle)
• Password reset: Email lookup, reset token entry, new password form
BACKEND ENDPOINTS
POST /auth/signup
→ Input: email, password, honeypot
→ Validation: Email domain whitelist check (reject masked addresses), password minimum 12 chars, complexity
→ Hash: bcrypt at cost 12, never log plaintext
→ Action: Insert user, send verification email with 10-minute expiry token
→ Return: 201 Created (user ID only, no session yet)
POST /auth/verify-email
→ Input: userId, verificationToken
→ Action: Check token expiry and hash match, set emailVerified flag, delete token
→ Return: 200 with access token
POST /auth/request-password-reset
→ Input: email
→ Action: Check if user exists (log nothing if not—timing attack mitigation), send reset link if found
→ Return: Always 200 (don't leak user existence)
POST /auth/reset-password
→ Input: resetToken, newPassword
→ Validation: Token freshness, password complexity
→ Action: Bcrypt new password, delete all sessions
DATABASE SCHEMA
• Users table: id, email (unique index), passwordHash (bcrypt), emailVerified (bool), createdAt
• EmailTokens table: userId (FK), token (salted hash), expiresAt, type ('verify' or 'reset')
→ Never store plaintext tokens
SECURITY CHECKLIST
✓ All passwords bcrypt cost 12+
✓ Tokens hashed before storage
✓ Parameterized queries throughout (no string concatenation)
✓ Email sending rate-limited (1 per 30 sec per user)
✓ CSRF tokens on all state-changing forms
✓ No user-existence leaks (same response time for missing/invalid email)
✓ Session invalidation on password reset
✓ Honeypot field (reject if filled)About this skill
name: fullstack-guardian description: Use when Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
Fullstack Guardian
Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.
What you get
- Public GitHub repo
- the skills/fullstack-guardian folder with SKILL.md and references.
Customize your output
- Fork the repo and extend the skill's reference files for your own stack conventions.
Example output
Activates on a matching request (e.g. building or reviewing Fullstack Guardian code) and can chain with other skills in the pack.
Best for
Full-stack developers and engineering teams using Claude Code.
SKILL.md preview
---
name: fullstack-guardian
description: Implement full-stack features with layered security enforced at every level — database, backend, and frontend — for end-to-end authenticated flows.
version: 1.0.0
category: Development / Security
author: AgentVolt
license: proprietary
tags:
- development
- security
---
# Fullstack Guardian
Implement full-stack features with layered security enforced at every level — database, backend, and frontend — for end-to-end authenticated flows.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Security Scanning
Scans code changes for common security issues before they ship.
Secure Code Guardian
Implements authentication, authorization, and input validation with concrete secure defaults, preventing OWASP Top 10 vulnerabilities in new code.
Security Reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance.
Trail of Bits Security Skill
Audits your code for security issues before you ship, using Trail of Bits' professional security review methodology.