Lean builder
Use whenever you write or change code in this project. Keeps the build to what PRD.md asks for: the smallest change that works, with no extra features, libraries or abstractions.
Resource library
Skills are short instructions your coding agent loads when they fit the task. Every prd-help pack carries these, in .agents/skills for Codex, OpenCode and Cursor and in .claude/skills for Claude Code. Each card opens the full SKILL.md on prd-help.
Use whenever you write or change code in this project. Keeps the build to what PRD.md asks for: the smallest change that works, with no extra features, libraries or abstractions.
Use before you tick a step in PROGRESS.md or say that a step is done. A step is done only when its acceptance checks were actually run and passed, with the evidence written down.
Use in a project linked to prd-help, an MCP server named prd-help with the tools next_step, get_prd and report_step. How to take each step from prd-help, read the current PRD and report back.
Find the root cause before fixing anything, in four phases. Its one script only runs the project's own tests.
Checks the branch's changes for bugs and security holes and only reports; the student decides what to fix.
Reports only security issues it can trace to attacker input, with OWASP-based references.
Secure-by-default rules for Next.js, React, Vue, Express, Django, FastAPI, Flask and Go; reads only the guide for the project's stack.
Reviews UI code for accessibility, focus, forms and layout. Vercel's rules are frozen into the skill, so it downloads nothing.
prd-help reads the Stack and Deployment sections of your PRD and adds up to 6 of these, by a fixed list: Postgres, Supabase or Neon → supabase-postgres-best-practices; Prisma → prisma-client-api; MongoDB → mongodb-schema-design, mongodb-query-optimizer; Expo or React Native → react-navigation, react-native-testing; Sign in with Google → sign-in-with-google-web; PostHog → instrument-error-tracking; Cloudflare Agents → agents-sdk; Firebase → firestore-rules-creation; Redis → redis-core; Cloudflare → workers-best-practices; Resend → email-best-practices, react-email.
Postgres schema, index, security and query rules that apply to any Postgres, Supabase and Neon included.
Correct Prisma Client queries, relations and transactions.
Document schema design: when to embed, when to reference. Asks before any write to a database.
Strict Firestore security rules that validate every write. Checks them with a dry run only.
Redis data types, keys and expiry used the right way.
Writing and configuring Cloudflare Workers for production.
Sending email that arrives: domains, templates, bounces.
Email templates as React components. Sends nothing by itself; the API key stays in .env.
Finds why a MongoDB query is slow; creates indexes only with the student's approval.
Stacks, tabs and drawers with React Navigation 7. Guidance only, no commands.
Component tests with React Native Testing Library (from callstack/react-native-testing-library, also MIT).
Google sign-in on the web, checked on the server. Its backend examples are Python only.
Adds PostHog error tracking with a local SDK install; keys stay in .env.
Building agents on Cloudflare's Agents SDK. One reference stores secrets in Cloudflare instead of .env.