Skip to content
Back to skills

Shipjaw Build

ASecurity

Scaffolds a brand-new TypeScript/Next.js application (NestJS API only when the product truly needs one) from a build-ready product prompt — writes committed documentation/, enforces strict TypeScript, Vitest, Playwright, security headers, clean architecture, then ships v1 behind a verification gate. Use when bootstrapping greenfield, running create-next-app from a dense brief, pasting a product prompt, documentation/product/source-prompt.md is ready, après shipjaw-prompt, prompt prêt, initial...

  • 2 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 19, 2026
developmenttypescriptgobashnextjstestinggitapisecuritydocumentation

Works with

  • api

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned October 7, 2026

npx -y skills add XyDisorder/shipjaw --skill shipjaw-build --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Shipjaw Build?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Shipjaw Build
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/xydisorder-shipjaw-build/badge)](https://www.skillsdirectory.com/skills/xydisorder-shipjaw-build)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: shipjaw-build
description: Scaffolds a brand-new TypeScript/Next.js application (NestJS API only when the product truly needs one) from a build-ready product prompt — writes committed documentation/, enforces strict TypeScript, Vitest, Playwright, security headers, clean architecture, then ships v1 behind a verification gate. Use when bootstrapping greenfield, running create-next-app from a dense brief, pasting a product prompt, documentation/product/source-prompt.md is ready, après shipjaw-prompt, prompt prêt, initial build, or first scaffold of a new Shipjaw app. Do not use to polish a vague idea first (shipjaw-prompt), adopt an existing foreign codebase (shipjaw-adopt), tweak CSS/copy only, non-TS repos, or when documentation/knowledge-base/ already exists (shipjaw-ask).
disable-model-invocation: true
---

# shipjaw-build

Bootstrap-only. Turns a **build-ready product prompt** into a scaffolded
TypeScript site and a committed `documentation/` map. Later sessions use
`shipjaw-ask`. Prefer `shipjaw-prompt` first when the idea is still vague.

Slash-preferred (`disable-model-invocation`) — avoid ambient auto-scaffold.

**Operating principles:** `references/skill-principles.md` (1–18) — open
only if a principle conflict arises; hard rules below are enough for most
runs.

## Anti-triggers (stop — don't run bootstrap)

- `documentation/knowledge-base/` already exists → `shipjaw-ask`
- Existing app code **without** Shipjaw KB → `shipjaw-adopt` (do not
  re-scaffold in place)
- Idea is still vague / user wants help wording the product →
  `shipjaw-prompt` first
- Single-file cosmetic / copy tweak with no product build
- Non-TypeScript codebase
- User only wants framework tutorial text (point at official docs)

## Hard rules (never negotiable)

1. **Typing** — `strict: true`. No `any`. `unknown` only at untyped
   entry points, narrowed via zod/type guard. → `code-standards.md`
2. **File size** — hard cap **500 lines**; plan split ~300.
3. **Architecture** — canonical tree in `project-structure.md` (including
   types / constants / helpers, **ports**, **composition root**, thin
   adapters, error→UI/HTTP map). Contracts consumer updates **only if
   `packages/contracts/` exists**. No grab-bag `lib/utils.ts` or layer
   barrels.
4. **Tests** — Vitest for domain/application; Playwright + axe +
   keyboard/focus smoke for critical flows. Bug fix ⇒ regression test;
   never weaken tests to green. → `testing-and-ci.md` ·
   `regression-and-business-rules.md`
5. **Security** — secrets out of git; authz in `application/`; actions
   re-check session; middleware; CSP via scaffold `next.config.ts`.
6. **Documentation** — committed `documentation/`. No app code before
   `INDEX.md` + phase-01. Stamp via `scripts/stamp-provenance.sh`.
7. **Verify** — one gate/phase; **stop after 2 failed attempts**. On the
   second failure read `references/gate-failure-modes.md` before one
   last focused fix; then ask the human if still red.
8. **KB current** — update before done; state not only in chat.
9. **UI floor** — when shipping visible UI, obey
   `references/design-constraints.md` (+ product design-brief).

## Checklist

```
- [ ] Intake prompt (message or product/source-prompt.md)
- [ ] Clarify gaps only (≤2 rounds / ~8 Q) or skip if dense
- [ ] Stack via stack-shape + tech-choices (read on demand)
- [ ] Write documentation/ (INDEX + phase-01) before feature code
- [ ] Scaffold Next (temp-dir merge if docs already present)
- [ ] Copy scaffold kit idempotently (see templates/scaffold/README)
- [ ] ./scripts/copy-continuation-contract.sh <project-root>
- [ ] ./scripts/stamp-provenance.sh <project-root>
- [ ] ./scripts/validate-docs.sh <project-root>
- [ ] Suggest /compact — scaffold done, before phase-01 gate loop starts
- [ ] Implement core *User can…* + tests (types/consts/helpers placed per
      project-structure — no utils grab-bag)
- [ ] Flip features-index.md row + write product/feature-<slug>.md
      (templates/product-feature.md) — **before** the gate (run-gate.sh
      now hard-fails if a feature module isn't in features-index.md)
- [ ] ./scripts/run-gate.sh <project-root> --with-e2e
- [ ] Fix ≤2 attempts; update remaining KB surgically (changelog, decisions)
- [ ] Write documentation/handoff.md (next /shipjaw-ask …)
- [ ] For non-trivial phase-01+: built-in challenge on MVP/ADR choices (note in phase Challenge)
- [ ] Hand off to shipjaw-ask (optional /shipjaw-challenge if plan still soft / want durable report)
```

## Workflow (summary — `references/workflow.md`)

1. Intake → 2. Clarify → 3. Stack → 4. Docs → 5. Scaffold + kit +
   continuation scripts → **compact checkpoint** → 6. Implement + gate →
   7. KB + compact.

If the repo looks like an older Shipjaw / skill-my-app project, read
`references/migration.md` instead of re-bootstrapping.

## Scripts (execute, don't reinvent)

From this skill directory:

```bash
./scripts/copy-continuation-contract.sh <project-root>
./scripts/stamp-provenance.sh <project-root>
./scripts/init-docs-skeleton.sh <project-root>   # adopt / repair
./scripts/validate-docs.sh <project-root>        # feedback loop
./scripts/validate-docs-drift.sh <project-root>  # dangling refs + staleness (value grows in shipjaw-ask)
./scripts/run-gate.sh <project-root> [--with-e2e]
```

## Cost / narration

- Load only the reference the current step needs.
- Act; don't paste reference contents into chat (principle 14).
- Prefer merge-over-overwrite for existing config (principle 13).

## References (on demand)

Core (stack-agnostic — apply regardless of which profile is active):

- `skill-principles.md` · `migration.md` ·
  `regression-and-business-rules.md`
- `discovery-questions.md` · `security.md` ·
  `gate-failure-modes.md` (2nd gate fail) · `design-constraints.md` (UI)
- `doc-structure.md` · `workflow.md`

Technology profile — TypeScript/Next.js, Shipjaw's only profile today
(`profiles/typescript-next/`; see `profiles/README.md`):

- `stack-shape.md` · `tech-choices.md`
- `project-structure.md` · `code-standards.md` · `testing-and-ci.md`
- `monorepo-and-nestjs.md` — Nest only
- `modern-extras.md` — only if discovery activated
- `prod-readiness.md` — only when deploying/launching publicly, not a
  mandatory gate

Templates & tooling:

- `templates/` · `templates/scaffold/` · `templates/business-rule.md` ·
  `templates/handoff.md` · `VERSION` · `scripts/`

Files in this skill

  • SKILL.md6.3 KB
  • VERSION11 B
  • profiles/README.md1.9 KB
  • profiles/typescript-next/code-standards.md4.6 KB
  • profiles/typescript-next/modern-extras.md1.7 KB
  • profiles/typescript-next/monorepo-and-nestjs.md2 KB
  • profiles/typescript-next/project-structure.md12.6 KB
  • profiles/typescript-next/stack-shape.md1.8 KB
  • profiles/typescript-next/tech-choices.md4.7 KB
  • profiles/typescript-next/testing-and-ci.md4.8 KB
  • references/challenge-built-in.md3.4 KB
  • references/design-constraints.md2.3 KB
  • references/discovery-questions.md2.8 KB
  • references/doc-structure.md7.4 KB
  • references/gate-failure-modes.md3.4 KB
  • references/migration.md3.5 KB
  • references/regression-and-business-rules.md3.3 KB
  • references/security.md4.3 KB
  • references/skill-principles.md10.3 KB
  • references/workflow.md7.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.