skill
system-architecture
Production-grade Claude/Cursor skills for backend, auth, database security, billing, and file uploads — stops AI coding agents from writing code that gets hacked or turns to spaghetti after 3 weeks. f
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/alyanhaider/system-architecture itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 22, 2026🧠 Production-Grade AI Coding Skills & Rules
A curated collection of production-grade skill files and rule systems designed for AI coding agents (Claude 3.5 Sonnet, Cursor, Windsurf, Claude Code, and GitHub Copilot).
⚡ The Core Problem
AI agents write code that works now, not code that scales in 3 weeks.
When prompting an AI to build a feature, it defaults to the path of least resistance:
- It hardcodes CORS origins to
*(security vulnerability). - It dumps business logic straight into Express routes or controllers.
- It writes database queries inside loops (generating N+1 query performance kills).
- It stores session tokens in browser
localStorage(making sessions stealable via XSS).
This repository bridges the gap. By loading these specific skill files into your AI workspace, you enforce strict architectural boundaries, industry-standard security patterns, and robust coding rules automatically—without having to repeat yourself in every prompt session.
📁 Skills Index
| Skill Domain | Description | Prevents these AI Blunders |
|---|---|---|
🔒 authentication-security | secure cookie configurations, JWT access/refresh rotation, password hashing, OAuth state | Storing tokens in localStorage, MD5/SHA256 password storage, missing OAuth state parameter |
🛡️ security-hardening | input sanitization, rate-limiting rules, security headers (Helmet), injection prevention | SQL injection, prototype pollution, missing request limits, raw logging of passwords |
🌐 cors-configuration | environment-based allowed origins, credentials configuration, preflight (OPTIONS) handlers | Wildcard * origins, silent auth failures, 404 responses for OPTIONS preflight checks |
🏛️ backend-architecture | strict Route ➔ Controller ➔ Service ➔ Model layer isolation, config routing | Mixing business logic with HTTP route handlers, direct DB calls in route controllers |
🏗️ project-structure | feature-based folder layouts, shared modules, deleting-features isolation testing | "Dumping grounds" folders (utils/helpers), circular code dependencies |
💾 database-design | schema patterns, migrations, indexes, soft-delete rules, parameterized queries | Schema conflicts in production, slow unindexed queries, missing timestamps |
🚀 deployment-pipeline | environment configs, CI/CD, dockerization, health endpoints, fail-fast variable loaders | Leaking .env keys, container start failures, unrun migrations during staging |
📥 file-uploads-and-storage | multi-part parsing, S3/R2 storage integration, pre-signed URLs, validation | Malicious executable uploads, server filesystem crashes, unchecked file sizes |
⚡ performance-optimization | list pagination, N+1 prevention, Redis caching, profiling, lazy-loading | Unbounded list queries, database overload via looping queries, missing cache TTLs |
📦 caching-and-background-jobs | Redis setup, BullMQ background tasks, worker idempotency, cron triggers | Blocking the main thread, lost jobs on server crash, non-idempotent workers |
🔗 monorepo-vs-multirepo | shared workspaces, package configurations, Turborepo setup, type sharing | Tooling overhead, circular imports across client/server, broken yarn/pnpm links |
🗺️ api-design-and-responses | REST standards, ok/fail response wrappers, status codes, standard error shapes | Inconsistent response payloads, HTTP 200 returned on server crashes |
📥 Installation & Usage
You can download and inject any specific skill directly into your current project's rules folder (e.g. .cursor/rules/) using npx or our lightweight installation scripts.
Method 1: Using npx (Universal CLI)
Run this command from the root of your project:
# General syntax:
npx @alyanhaider/system-architecture install <skill-name>
# Example - Install CORS Configuration:
npx @alyanhaider/system-architecture install cors-configuration
Method 2: Unix Shell Script (macOS / Linux)
curl -sSL https://raw.githubusercontent.com/alyanhaider/system-architecture/main/install.sh | bash -s -- <skill-name>
Method 3: Windows (PowerShell)
powershell -c "irm https://raw.githubusercontent.com/alyanhaider/system-architecture/main/install.ps1 | iex; Install-Skill -Skill <skill-name>"
🤖 Configuring Your AI Editor
1. For Cursor (Automatic Rules Activation)
Download the desired skills into your project's .cursor/rules/ directory (e.g., .cursor/rules/cors-configuration.md). At the top of your markdown skill files, add context instructions like this to tell Cursor when to load the rule:
---
description: Run on all backend files when configuring CORS or cross-origin requests
globs: src/backend/**/*, app.js, server.js
---
2. For Windsurf, Claude Code, or Copilot
Append the key rules and custom profiles from rules.md to your workspace context files:
- VS Code / Copilot: Add rules to
.github/copilot-instructions.md. - Claude Code: Add instructions to
.clauderulesin the project root. - Custom Claude System Prompts: Copy-paste the "One-paragraph brief" from the bottom of your chosen skill directly into your system prompt.
✏️ Contributing & Suggestions
If you find a new recurring AI bug or have an optimization to suggest:
- Fork the repository.
- Create your feature branch.
- Submit a Pull Request.
📄 License & Author
Developed and maintained by Alyan Haider. Released under the MIT License.