Open source · Community-driven · MIT licensed

Stop wasting tokens. Get secure, production-grade functions on the first try.

When your AI agent builds without guidance, it starts from zero — burning tokens re-deriving architecture, exploring dead ends, and shipping code that only looks done. AI Function Builder Skills turns hard-won engineering knowledge into reusable SKILL.md packs, so your agent jumps straight to the right, secure, production-grade solution.

Browse skills Star on GitHub ★
  • ✔ Lower cost
  • ✔ Fewer errors
  • ✔ Real security
  • ✔ Faster delivery
# ~/.claude/skills/clerk-org-rbac/SKILL.md
---
name: clerk-org-rbac
description: Multi-tenant RBAC with
  Clerk Organizations, JWT-only auth
---

# Ask your agent:
"Set up multi-tenant RBAC
 for my Next.js SaaS."

→ Agent loads the skill
→ Ships the full architecture

The problem: your agent starts from zero

When you ask an AI agent to build a file upload, rate limiter, or auth system without any guidance, it doesn't start from expert knowledge — it starts from zero. It burns huge amounts of tokens re-deriving basic architecture, exploring dead ends, and searching for patterns it should already know.

Worse, it often gets things wrong in ways that don't show up until production: frontend-only auth checks anyone can bypass, rate limiters with race conditions under real load, file uploads that trust the client instead of verifying on the server. The result is code that looks done but isn't safe — and a token bill that reflects all that wasted exploration.

The fix: reusable, battle-tested skills

Each skill in this library is a structured SKILL.md instruction pack for one specific function — the exact architecture, the security model, the edge cases, and copy-paste-ready code templates — written by developers who've already shipped that function to production and hit the mistakes so you don't have to.

With a skill loaded, your agent doesn't rediscover best practices from scratch — it jumps straight to the right solution. That means lower cost, fewer errors, real security, and faster delivery.

How a skill is structured

Every skill is a self-contained folder with three layers — one for your agent, one for you, and one for the deep detail.

skills/
└── secure-file-upload/
    ├── SKILL.md          # For the agent — triggers, workflow, checklist
    ├── README.md         # For humans — deep use-case deep dive
    └── references/
        ├── architecture.md      # Sequence diagram + trade-offs
        ├── security-model.md    # 5-layer security model
        └── configuration.md     # Console setup + CORS

SKILL.md — for the agent

The instruction pack your AI agent reads. YAML frontmatter (name + description) tells the agent when to trigger; the body is the battle-tested workflow, security rules, and a self-check checklist it runs before showing you code.

README.md — for you

A human-readable deep dive into the skill's use case: the problem it solves, when to use it (and when not to), why the architecture is built that way, and what you get out of it.

references/ — the deep detail

Optional deep-dive docs loaded on demand — full security models, database schemas, SDK code samples, and console setup guides. Kept out of SKILL.md so the agent stays fast.

Skill catalog

Community-built, framework-agnostic skills for the hard parts of shipping secure backend systems — correctly, on the first try.

Auth & Authorization Next.js + Clerk

Clerk Organization RBAC

Multi-tenant role-based access control built entirely inside Clerk Organizations — custom roles, custom permissions, and JWT-only authorization. No auth database, no per-request Clerk API calls.

  • 8-role / 44-permission reference matrix from production
  • Dual gating: Can (roles) vs PlanGate (billing)
  • Backend-first security — frontend is cosmetic
  • Copy-paste useCan(), <PlanGate>, middleware.ts
"Set up multi-tenant RBAC for my SaaS" View skill →
Backend & API Node.js / TS + Redis

Redis Token Bucket Rate Limiter

A production-grade, race-condition-free token bucket rate limiter backed by Redis using a single atomic Lua script — with standardized 429 responses and X-RateLimit-* headers.

  • Refill, check & deduct atomically — no race conditions
  • Works with Upstash, ioredis, node-redis
  • Fail Open / Fail Closed architecture
  • Never trusts spoofable client headers
"Add rate limiting to my /api/payments" View skill →
Backend & API Any stack + S3/R2

Secure File Upload

Zero-server-bandwidth file, image, and avatar upload straight to S3-compatible storage via presigned URLs — with a 5-layer security model and atomic, cache-busting swaps.

  • Presigned URLs lock Content-Type & Content-Length
  • HeadObject + magic-byte verification (catches renamed .exe)
  • Random object keys — no stale CDN caches
  • Cleanup job for abandoned uploads
"Let users upload profile photos to S3" View skill →

Why use these skills?

The difference between code that looks done and code that actually ships safely.

💰

Lower cost

Agents spend tokens writing your actual feature, not relearning fundamentals or backtracking from mistakes.

✅

Fewer errors

Skills encode the failure modes that only show up in production — race conditions, spoofable headers, non-atomic operations — so the agent avoids them upfront.

🔒

Real security, not an afterthought

Every skill bakes in server-side validation, proper authorization boundaries, and a clear-eyed security/resource balance — not security bolted on after the fact.

⚡

Faster delivery

What used to take rounds of trial, review, and fixing now happens correctly on the first pass.

🏆

Battle-tested

Written by developers who've shipped these functions to production and hit the mistakes so you don't have to.

🧩

Zero lock-in

Works across Claude Code, opencode, Cursor, and other SKILL-format agents.

Get started in minutes

Clone the repo and install one or more skills into your agent's skills directory.

git clone https://github.com/axosecurity/ai-function-builder-skills.git
cd ai-skills

# Install all skills
bash scripts/install.sh --all

# …or just the ones you need
bash scripts/install.sh --skills "clerk-org-rbac secure-file-upload"
git clone https://github.com/axosecurity/ai-function-builder-skills.git
cd ai-skills

# opencode reads ~/.config/opencode/skills/ (or ~/.opencode/skills/)
mkdir -p ~/.config/opencode/skills
cp -r skills/clerk-org-rbac ~/.config/opencode/skills/
cp -r skills/redis-token-bucket-rate-limiter ~/.config/opencode/skills/
cp -r skills/secure-file-upload ~/.config/opencode/skills/
git clone https://github.com/axosecurity/ai-function-builder-skills.git
cd ai-skills

# Each skill is a folder with a SKILL.md — copy the whole folder
# into your agent's skills directory (~/.claude/skills/, etc.)
cp -r skills/clerk-org-rbac ~/.claude/skills/

Then start a new session and describe the task — your agent auto-detects and loads the right skill.

Built by developers, for developers

This library is open and community-driven. Have a battle-tested skill to share? Fork the repo, add your skill under skills/<name>/ with a SKILL.md, and open a pull request.

Contribute on GitHub