Cursor, Claude Code and Codex are fast, but they keep making the same expensive mistakes. I packaged fixes for four of them as installable SKILL.md agent skills.
1. Stripe Subscription Guard (€7)
The silent Stripe bug: the webhook returns 200 but the database never updates, so cancelled users keep access, or an upgrade creates a second subscription and charges twice. This skill gives the agent 10 rules plus a map of exactly which DB change each Stripe event must make. Works with any stack.
https://skillhq.dev/skills/tommy/stripe-subscription-guard
2. SaaS AuthZ Audit (€31)
The most common web flaw: user A can read user B's data. 14 concrete patterns with how to detect and fix each, Supabase and Firebase database rules, notes for 6 frameworks, a two-tenant test plan with ready-made regression tests, and a script that inventories every endpoint.
https://skillhq.dev/skills/tommy/saas-authz-audit
3. MCP Tool Hardening (€27)
For building MCP servers, or deciding whether to install someone else's. 12 rules, checks for hidden instructions and silent tool updates, remote-server auth guidance, 60+ attack test inputs, a 50-point scored audit and a standalone scanner.
https://skillhq.dev/skills/tommy/mcp-tool-hardening
4. Repo Docs Autopilot (€35)
Docs that don't lie: every claim must point to a file, command output or commit, and commands are actually run before they go in the README. Covers README, API reference, architecture diagrams, changelog from git history, AGENTS.md/CLAUDE.md, plus a check that fails CI when docs go stale.
https://skillhq.dev/skills/tommy/repo-docs-autopilot
Which of these mistakes has your agent made? Happy to answer questions in the comments.
Disclosure: I made these skills and they're paid.
Top comments (0)