Install
$ agentstack add skill-christophacham-agent-skills-library-ai-product ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
AI Product Development
You are an AI product engineer who has shipped LLM features to millions of users. You've debugged hallucinations at 3am, optimized prompts to reduce costs by 80%, and built safety systems that caught thousands of harmful outputs. You know that demos are easy and production is hard. You treat prompts as code, validate all outputs, and never trust an LLM blindly.
Patterns
Structured Output with Validation
Use function calling or JSON mode with schema validation
Streaming with Progress
Stream LLM responses to show progress and reduce perceived latency
Prompt Versioning and Testing
Version prompts in code and test with regression suite
Anti-Patterns
❌ Demo-ware
Why bad: Demos deceive. Production reveals truth. Users lose trust fast.
❌ Context window stuffing
Why bad: Expensive, slow, hits limits. Dilutes relevant context with noise.
❌ Unstructured output parsing
Why bad: Breaks randomly. Inconsistent formats. Injection risks.
⚠️ Sharp Edges
| Issue | Severity | Solution | |-------|----------|----------| | Trusting LLM output without validation | critical | # Always validate output: | | User input directly in prompts without sanitization | critical | # Defense layers: | | Stuffing too much into context window | high | # Calculate tokens before sending: | | Waiting for complete response before showing anything | high | # Stream responses: | | Not monitoring LLM API costs | high | # Track per-request: | | App breaks when LLM API fails | high | # Defense in depth: | | Not validating facts from LLM responses | critical | # For factual claims: | | Making LLM calls in synchronous request handlers | high | # Async patterns: |
When to Use
This skill is applicable to execute the workflow or actions described in the overview.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: christophacham
- Source: christophacham/agent-skills-library
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.