Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Showdar Build

ASecurity

Use when implementing or refactoring an agreed application change within existing architecture and contracts.

2 stars
0 votes
0 copies
0 views
Added 9/22/2026
developmenttypescriptrustgoswiftkotlinreactnextjsnodetestingdebugging

Works with

cli

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add caongocquy/showdar-skills --skill showdar-build --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Showdar Build?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Showdar Build
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/caongocquy-showdar-build/badge)](https://www.skillsdirectory.com/skills/caongocquy-showdar-build)

More formats (shields.io, HTML) on the badges page.

Download with Pro
Files
SKILL.md
---
name: showdar-build
description: Use when implementing or refactoring an agreed application change within existing architecture and contracts.
---

# Showdar Build

## Purpose

- Convert an approved requirement/plan into maintainable production code.
- Preserve existing ownership boundaries and public contracts unless change is explicitly required.
- Minimize blast radius without cutting required correctness, error handling, or tests.
- Make implementation decisions evidence-based and stack-native.
- Read `references/minimal-change.md` and `references/architecture-boundaries.md` before introducing new abstractions.

## When to use

- Implementing a feature, refactor, bug fix after root cause is known, or architecture-safe change.
- Applying an approved UI implementation after design decisions are clear.
- Small migrations where the upgrade-specific analysis is already complete.
- Completing a bounded task recovered from a previous session.

## When not to use

- Root cause is unknown; use showdar-debug.
- Requirements/change surface are unclear and multiple approaches remain; use showdar-plan.
- The work is only review or testing strategy.
- Production deploy/release actions belong to showdar-ship.

## Inputs and assumptions

- User outcome and current repository conventions are understood.
- Relevant tests/build/typecheck commands are known or discoverable.
- Existing public interfaces and state ownership are constraints unless explicitly changed.
- For dirty repositories, distinguish user work from this task before editing.
- `scripts/change-surface.mjs` can summarize current git changes without mutation.

## Non-negotiable rules

- Change the smallest coherent surface that fully satisfies the behavior.
- Never “fix” uncertainty with broad optional chaining, swallowed exceptions, retries, or cache clearing.
- Preserve or improve type safety at external/data boundaries.
- Handle expected error/recovery behavior explicitly using `references/error-handling.md`.
- Do not introduce a generic abstraction for one use unless it creates a real ownership/volatility boundary.
- Keep comments focused on why/non-obvious constraints, not restating code.
- Add/adjust tests at the lowest level that can fail for the intended regression/behavior.
- Do not rewrite unrelated formatting or files.

## Workflow

### Phase 1 — pre-change check
- Read repository instructions and current relevant implementation/tests.
- Confirm exact change surface and must-not-change contracts.
- Inspect current diff/status so unrelated user changes are protected.

### Phase 2 — define behavior proof
- Identify the test or executable scenario that proves the requested behavior.
- For a defect, reproduce the regression first where practical.
- For new behavior, encode the smallest useful failing/acceptance test before implementation when the project supports it.

### Phase 3 — implement minimal coherent change
- Follow existing naming, dependency injection, state ownership, and error contracts.
- Keep new code local until a true reusable boundary exists.
- Update public types/contracts deliberately when required.
- Use `references/feature-flags.md` only when rollout/reversibility justifies a flag.

### Phase 4 — stack-specific pass
- Read the matching file under `stacks/` for lifecycle, rendering, native, server/client, or event-loop hazards.
- Check generated/native files only if the change requires them.

### Phase 5 — verification
- Run targeted test first, then relevant suite/typecheck/lint/build.
- Inspect final diff for unrelated changes, duplicated policy, unsafe fallback, and missing edge behavior.
- Verify all claims from fresh command output.

## Decision points

- One function change vs new service? Prefer local unless ownership/reuse demands a boundary.
- Error can be recovered here? Handle with context; otherwise propagate without swallowing cause.
- Behavior can race/retry? Model idempotency/concurrency explicitly rather than adding debounce blindly.
- Existing design/system pattern safe? Follow it; otherwise document the targeted deviation.
- Rollout risk high? Consider flag/staged path with explicit removal condition.

## Stack detection

- React: read `stacks/react.md` for state/effect/render/accessibility traps.
- Next.js: read `stacks/nextjs.md` for server/client/cache/runtime boundaries.
- React Native: read `stacks/react-native.md` for lifecycle/list/native-performance concerns.
- Flutter: read `stacks/flutter.md` for rebuild/async/layout/state concerns.
- Node/Fastify: read `stacks/node-fastify.md` for validation/event-loop/resource lifecycle.
- TypeScript: read `stacks/typescript.md` for unknown-boundary validation, unions, and public contract typing.
- NestJS: use `stacks/node-nestjs.md` for module/provider/request ownership and transaction/error boundaries.
- Dart, Swift, Kotlin, and Rust/Tauri: read the matching stack file for lifecycle, concurrency, native, and release constraints.
- Unsupported stacks: inspect project conventions and apply the same minimal/coherent contract.

## Failure modes

- Shotgun edits across layers because ownership was not identified.
- “Defensive” null/error handling that hides the real contract violation.
- Test passes only because a dependency is mocked away.
- New abstraction increases indirection without reducing policy duplication or volatility.
- Implementation changes public behavior without updated types/tests/docs.
- Performance-sensitive loop/render path gets more allocations or I/O without measurement.
- Native/build files changed by guesswork.

## Stop conditions

- Stop when the requested outcome is outside this skill and hand off to the more appropriate workflow.
- Stop before destructive, irreversible, production, credential, publishing, or deployment actions unless the user explicitly approved them.
- Stop when required evidence is unavailable and proceeding would require guessing about behavior, ownership, or safety.
- Stop when a repository instruction conflicts with this playbook; repository/user instructions win.
- Stop when requested behavior is implemented, the relevant tests/builds pass freshly, and final diff contains no unexplained changes.

## Escalation conditions

- Ask when implementation exposes an unresolved product choice or compatibility break not covered by the plan.
- Escalate destructive migration, secret, publishing, or production action.
- Return to debugging if the assumed root cause fails under the regression test.
- Return to planning if the required change surface expands into independent subsystems.

## Verification

- Run the narrow behavior/regression test and read the result.
- Run typecheck/analyzer/compiler as applicable.
- Run relevant integration/build/platform checks for touched boundaries.
- Inspect `git diff` or equivalent for unrelated edits and accidental generated files.
- For performance-sensitive changes, compare measured path before/after when feasible.
- Ensure no secrets/logged sensitive data were introduced.

## Output contract

- **Implemented** — concise behavior and exact change surface.
- **Why this shape** — ownership/contract rationale when non-obvious.
- **Tests/verification** — commands actually run and outcomes.
- **Risks/unverified** — anything not proven locally.
- **Follow-up** — only required follow-up; omit speculative cleanup.

## Anti-patterns

- Opportunistic repository-wide refactor during a feature fix.
- Adding `try/catch` that returns null/default for unknown failures.
- Threading booleans through layers instead of modeling real state.
- Memoizing every React/Flutter subtree without measurement.
- Duplicating existing token/config/business policy instead of using the owner.
- Declaring done after code edits without fresh verification.

## Example

User request: “Prevent duplicate submit on payment confirmation.”
- Confirm whether duplicate effect is UI re-entry, network retry, or backend idempotency before patching.
- Add the lowest-level regression that reproduces the confirmed duplicate path.
- Implement minimal guard/idempotency at the true owner, not every caller.
- Verify normal retry/recovery still works.
- See `examples/change-surface.md` for how to bound the patch.

Attribution

caongocquycaongocquy
View sourceMore from caongocquy →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

284722 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2192 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Tanstack Start

Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 + Cloudflare Workers app with file-based routing and server functions — even if they don't name TanStack Start specifically. No template repo — Claude generates every file fresh per ...

9881 votes

Pentest

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

5491 votes
View all in development →