# Fullstack Pro Max

> Full-stack product delivery skill for agency/client and personal SaaS builds. Covers distinctive, non-templated UI/UX and frontend design (turning user-supplied reference site URLs into a Reference Design Brief before coding, suggesting real named sites per style/sector from a built-in 90-entry known-sites library when the user has no link, or sourcing ready-made components/themes from real compo…

- **Type:** Skill
- **Install:** `agentstack add skill-0x61a-fullstack-pro-max-fullstack-pro-max`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [0x61A](https://agentstack.voostack.com/s/0x61a)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [0x61A](https://github.com/0x61A)
- **Source:** https://github.com/0x61A/fullstack-pro-max

## Install

```sh
agentstack add skill-0x61a-fullstack-pro-max-fullstack-pro-max
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Fullstack Pro Max — Full-Stack Product Delivery

One skill for shipping a real product end to end: distinctive UI/UX, backend architecture, database & auth, deployment, testing, cybersecurity, SEO, ads, e-commerce payments, AI feature integration, analytics & measurement, email, and i18n/localization. Built for two use cases — agency/client delivery and personal SaaS builds — with adaptive stack selection rather than one fixed frontend+backend combo.

All 13 modules (Backend, Database & Auth, DevOps, Testing/QA, Security, E-commerce, UI/UX, SEO, Ads, AI Integration, Analytics, Email, i18n) are built — see `references/routing.md` for the full action-to-file map. If a future module is ever added and not yet built, this skill degrades gracefully: reason from general best practice and say so explicitly, rather than refusing.

## When to Apply

### Must Use
- Scaffolding a new project's backend/API from scratch
- Choosing a stack (frontend, backend, database, hosting) for a new build
- Designing or reviewing API endpoints, error handling, or request/response contracts
- Pre-launch security, SEO, or ads audits (see `references/workflows.md` § Pre-Launch Audit)
- Setting up CI/CD, deployment, database schema, or auth

### Recommended
- Mid-project architecture questions ("is this the right stack for what we're building")
- Code review that touches backend structure, API design, or error handling
- Deciding between competing patterns (REST vs GraphQL, cursor vs offset pagination, etc.)

### Skip
- Pure content writing or copy editing unrelated to building/shipping the product
- Non-technical business questions (pricing strategy, market research) with no engineering component
- Purely visual/CSS polish on an already-built page with no architectural question involved

**Decision criteria**: if the task is about *deciding how to build, ship, secure, or grow* a web product, this skill applies.

## Ask Before You Build

This skill defaults to asking clarifying questions before starting non-trivial work, not to guessing silently and hoping the guess matches what the user actually needed. (This mirrors how this skill itself was built — two rounds of structured questions on architecture, scope, and dependency policy before a single file was written.)

**Ask 2-4 concrete questions before:**
- Choosing a stack for a new project (frontend/backend/database/hosting) — unless the user already stated a preference or the existing codebase already implies one.
- Any `secure` work — what's the deployment target, what data is actually at risk, is there a compliance context (GDPR, PCI, none)? A generic OWASP pass without this context risks solving the wrong problem.
- Any `integrate-payments` work — Stripe vs. Shopify, subscription vs. one-time, and an explicit confirmation of test-mode vs. live keys before any code that could trigger a real charge.
- Any irreversible or hard-to-undo action — a production deploy, a migration against a live table, rotating/deleting a credential, a DNS/domain change. Match the caution level in the top-level system instructions on risky actions; this skill doesn't override that.
- A request broad enough to have multiple reasonable interpretations ("build the backend" could mean a scaffold, a full CRUD API, or a production-ready API with auth+tests+deploy — ask which, don't guess the most expensive interpretation by default).

**Don't ask when:**
- The answer is already visible in the codebase, the conversation, or this skill's own stated defaults (don't ask "which test framework" if `package.json` already has one installed).
- The task is small, reversible, and low-stakes (a copy tweak, a single CSS value, a typo fix).
- The user already stated a clear preference earlier in the conversation — don't re-ask something they already told you.

**How to ask:** batch questions together (2-4 at once, via a structured question tool if available, otherwise a short numbered list) rather than trickling out one question per turn. Offer a recommended default in each question where a sensible one exists (see Stack Selection Logic below for the default stack), and treat "I don't know, you decide" as a valid answer that unblocks proceeding with the stated default — don't force a decision the user doesn't have an opinion on.

**When asking isn't possible** (fully autonomous/non-interactive execution): state the assumption explicitly before proceeding — "Assuming Next.js + Supabase since no stack was specified" — rather than silently picking one with no note that a decision was made on the user's behalf.

## Action-Routing Table

| Action | Status | Module | Load |
|---|---|---|---|
| `plan` | ✅ Built | Backend (stack selection) + Database + DevOps | `references/backend-architecture.md` (Stack Decision Tree), `references/database-schema-design.md`, `data/backend/stacks.csv` |
| `build` | ✅ Backend built | Backend & API | `references/backend-architecture.md`, `references/api-design.md`, `scripts/backend/generate.py` |
| `design` | ✅ Built | UI/UX & Distinctive Frontend | `references/frontend-distinctiveness.md` (flagship — always load for brand-forward work), `references/ui-ux-quickref.md`, `scripts/ui-ux/generate.py` (tokens + skeletons, `--style` for aesthetic direction); example sites given → `references/reference-site-analysis.md` + `scripts/ui-ux/scan.py`; no example link but a style/sector named → `data/ui-ux/known-sites-library.csv` (90 rows, real named sites + gallery sources per style) via `scripts/common/search.py`, then same reference-site-analysis flow; wants a ready-made component/theme instead of from-scratch → `data/ui-ux/component-libraries.csv` (24 rows: 21st.dev, shadcn/ui, Aceternity UI, Magic UI, and 14 more, live-fetched not memorized) + `references/component-library-integration.md`; no references, identity from scratch → `references/art-direction-derivation.md` + `data/ui-ux/style-vocabulary.csv` |
| `integrate` | ✅ Built | Database & Auth / E-commerce | `references/database-schema-design.md`, `references/auth-patterns.md`, `scripts/database/generate.py` (for db/auth); `references/stripe-integration.md`, `shopify-integration.md`, `scripts/ecommerce/generate.py` (for payments) |
| `deploy` | ✅ Built | DevOps & Deployment | `references/ci-cd-pipelines.md`, `references/deployment-platforms.md`, `references/env-secrets-management.md`, `scripts/devops/generate.py`, plus the connected Vercel/Netlify/Cloudflare MCP tools |
| `test` | ✅ Built | Testing/QA | `references/testing-strategy.md`, `references/accessibility-performance-audit.md`, `scripts/testing/generate.py` |
| `secure` | ✅ Built | Security/Cybersecurity | `references/security-threat-modeling.md`, `secure-coding-standards.md`, `api-security.md`, `infra-cloud-security.md`, `incident-response.md`, `security-scoring.md`, `scripts/security/{generate,audit}.py`, `scripts/common/score.py` |
| `integrate-payments` | ✅ Built | E-commerce & Payments | `references/stripe-integration.md`, `shopify-integration.md`, `scripts/ecommerce/generate.py`, plus the connected Shopify MCP tools |
| `optimize-seo` | ✅ Built | SEO | `references/seo-technical.md`, `seo-content-eeat.md`, `seo-scoring-system.md`, `data/seo/*.csv`, `scripts/common/score.py` |
| `launch-ads` | ✅ Built | Ads | `references/ads-google.md`, `ads-meta.md`, `ads-other-platforms.md`, `ads-scoring-system.md`, `data/ads/*.csv`, `scripts/common/score.py` |
| `integrate-ai` | ✅ Built | AI Integration | `references/ai-integration.md`, `references/ai-security.md`, `data/ai/*.csv`, `scripts/ai/generate.py`, `scripts/common/score.py` |
| `measure` | ✅ Built | Analytics | `references/analytics-measurement.md`, `data/analytics/*.csv`, `scripts/analytics/generate.py`, `scripts/common/score.py` |
| `integrate-email` | ✅ Built | Email | `references/email-integration.md`, `data/email/*.csv`, `scripts/email/generate.py`, `scripts/common/score.py` |
| `localize` | ✅ Built | i18n / Localization | `references/i18n-localization.md`, `data/i18n/*.csv`, `scripts/i18n/generate.py`, `scripts/common/score.py` |
| `review` / `audit` | ✅ Built | All (cross-module) | `references/workflows.md` — chains the module-specific checks/scripts above into Complete SaaS Launch, Client Delivery Package, Pre-Launch Audit, and Security Hardening Pass sequences |

Full detail, trigger phrases, and the graceful-degradation rule live in [`references/routing.md`](references/routing.md) — load it whenever an action doesn't obviously map to a single file above.

## Module Reference

### Backend & API — ✅ Built (Phase 1)
Adaptive stack selection (Node.js: Next.js API Routes/Express/Nest.js/Fastify; Python: FastAPI/Django; BaaS: Supabase/Firebase; Edge: Cloudflare Workers) plus API design conventions (REST/GraphQL/tRPC/gRPC choice, pagination, versioning, idempotency, rate limiting) and error-handling patterns (taxonomy, retries, observability, per-stack conventions).
- Data: `data/backend/stacks.csv` (41 rows — includes `BE088`, a static/no-backend option for marketing-site briefs with no accounts or stored data), `data/backend/api-patterns.csv` (25 rows), `data/backend/error-handling.csv` (22 rows)
- References: `references/backend-architecture.md`, `references/api-design.md`
- Script: `scripts/backend/generate.py` — scaffolds a CRUD endpoint (route/controller/service or router/schema files as appropriate) for a named resource in any of the 6 supported stacks. Run `python3 scripts/backend/generate.py --help`.

### Database & Auth — ✅ Built (Phase 2)
Schema design patterns (normalization, PK strategy, soft/hard delete, multi-tenancy via RLS, indexing), auth strategy matrix (session/JWT/OAuth/magic-link/passkey/MFA/authorization models), migrations safety discipline. First-class Supabase coverage — if the Supabase MCP is connected in your environment, use it for `execute_sql`, `apply_migration`, `list_tables`, `get_advisors`.
- Data: `data/database/schema-patterns.csv` (30 rows), `data/database/auth-patterns.csv` (25 rows), `data/database/migrations-checklist.csv` (21 checks)
- References: `references/database-schema-design.md`, `references/auth-patterns.md`
- Script: `scripts/database/generate.py` — scaffolds a Supabase SQL migration (with optional starter RLS policies) or a Prisma model fragment for a named table. `python3 scripts/database/generate.py --help`.

### DevOps & Deployment — ✅ Built (Phase 3)
CI/CD pipeline shape (branch strategy, required gates, deploy strategy, rollback), Vercel/Netlify/Cloudflare/Railway platform decision matrix, env/secrets management discipline. If the Vercel, Netlify, or Cloudflare MCP tools are connected in your environment, use them directly for deploys/logs/project management alongside this module's guidance.
- Data: `data/devops/ci-cd-patterns.csv` (25 rows), `data/devops/platforms.csv` (17 rows), `data/devops/env-management.csv` (13 rows)
- References: `references/ci-cd-pipelines.md`, `references/deployment-platforms.md`, `references/env-secrets-management.md`
- Script: `scripts/devops/generate.py` — scaffolds a GitHub Actions CI workflow (lint/typecheck/test/build, platform-appropriate deploy step) plus a `.env.example`. `python3 scripts/devops/generate.py --help`.

### Testing/QA — ✅ Built (Phase 4)
Test strategy by stack (unit/integration/e2e, tooling per stack, mocking/factory/isolation discipline), plus a 25-check accessibility + Core Web Vitals performance checklist.
- Data: `data/testing/test-strategy.csv` (25 rows), `data/testing/a11y-perf-checklist.csv` (25 checks)
- References: `references/testing-strategy.md`, `references/accessibility-performance-audit.md`
- Script: `scripts/testing/generate.py` — scaffolds a test file skeleton (Vitest/Jest/pytest/Playwright) for a named subject. `python3 scripts/testing/generate.py --help`.

### Security/Cybersecurity — ✅ Built (Phase 5, full-depth "big three" module)
Genuine cybersecurity-expert depth, not a checklist skim: OWASP Top 10 mapped to concrete checks, STRIDE-based threat modeling, secure coding standards per stack (Node.js/Python/Next.js/Express/Django), API-specific security (BOLA, mass assignment, rate limiting, GraphQL complexity), infra/cloud security (IAM, network exposure, backups, DNS), supply-chain/dependency security (SCA, CI/CD pipeline hardening, SBOM), and a full incident-response lifecycle (preparedness → detection → containment → eradication → blameless post-mortem). 134 checks total.
- Data: `data/security/owasp-checklist.csv` (35), `threat-modeling-checks.csv` (20), `secure-coding-checks.csv` (20), `api-security-checks.csv` (15), `infra-cloud-security-checks.csv` (17), `incident-response-checklist.csv` (17), `supply-chain-checks.csv` (10)
- References: `references/security-threat-modeling.md`, `secure-coding-standards.md`, `api-security.md`, `infra-cloud-security.md`, `incident-response.md`, `security-scoring.md`
- Scripts: `scripts/security/generate.py` (scaffolds security-headers middleware for Next.js/Express/FastAPI), `scripts/security/audit.py` (stdlib regex-based static scan for hardcoded secrets, dangerous patterns, missing headers — exits non-zero on Critical/High findings, CI-gateable), `scripts/common/score.py` (shared severity-weighted posture scoring, also reused by the SEO and Ads modules)

### E-commerce & Payments — ✅ Built (Phase 6)
Stripe (checkout approach selection, subscriptions/metered billing, webhook non-negotiables, refunds/disputes, Connect, Tax) and Shopify (hosted vs. headless, checkout extensibility via Functions, GraphQL Admin API, inventory-as-source-of-truth) integration patterns. If the Shopify MCP is connected in your environment, use it directly for product/discount/order operations alongside this module's guidance.
- Data: `data/ecommerce/stripe-patterns.csv` (17 rows), `data/ecommerce/shopify-patterns.csv` (12 rows)
- References: `references/stripe-integration.md`, `references/shopify-integration.md`
- Script: `scripts/ecommerce/generate.py` — scaffolds a signature-verified, idempotent webhook handler for Stripe or Shopify across Next.js/Express/FastAPI. `python3 scripts/ecommerce/generate.py --help`.

### UI/UX & Distinctive Frontend Design — ✅ Built (Phase 7)
Flagship focus: producing frontend design that doesn't read as templated or generic-AI-looking — art-direction frameworks, unique layout/type/motion techniques, plus a curated original color/typography/UX-guideline set. This is the module that directly answers "make this look unique, not templated." When the user describes the desired theme by pointing at existing sites instead of (or alongside) words, `references/reference-site-analysis.md` turns those URLs into a written Reference Design Brief before any code gets written — extracting principles (palette, type pairing, layout pattern), never copying literal assets/copy.
- Data: `data/ui-ux/colors.csv` (30 palettes), `typography.csv` (20 pairings), `style-vocabulary.csv` (30 named aesthetic movements — brutalism to gradient-mesh — each with best-for/avoid-when/tradeoffs and machine-readable token tendencies in tags), `ux-guidelines.csv` (17 checks), `distinctiveness-patterns.csv` (17 flagship techniques), `sector-art-direction.csv` (17 sector recipes — cafe/restaurant, healthcare, legal, SaaS/tech, e-commerce, real estate, fitness, finance, education, nonprofit, plus 7 general local-service sectors: salon/beauty, trades/home services, events/weddings/photography, consulting/professional services, pet care/veterinary, hospitality/boutique lodging, auto services), `reference-analysis-checklist.csv` (10 checks), `motion-recipes.csv` (10 purpose-driven animation patterns with duration/easing values), `responsive-patterns.csv` (10 layout-collapse strategies), `known-sites-library.csv` (90 rows — 2 real named sites + 1 evergreen gallery-search source per style, all 30 styles), `component-libraries.csv` (24 rows — 18 real component/theme marketplaces like 21st.dev/shadcn/ui/Aceternity UI plus 6 needs-based selection-guide rows, indexed for live-fetch not memorized) — 275 rows tot

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [0x61A](https://github.com/0x61A)
- **Source:** [0x61A/fullstack-pro-max](https://github.com/0x61A/fullstack-pro-max)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-0x61a-fullstack-pro-max-fullstack-pro-max
- Seller: https://agentstack.voostack.com/s/0x61a
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.