alexpate
UserA collection of skills for building developer tools
Categories
Indexed Skills (9)
api-keys
Design API credentials for a developer tool — prefixed keys (sk_live_/pk_test_), SHA-256 hashing at rest, test vs live modes, scopes, rotation, last-used tracking, and display-once UX. Use when the user wants to add API keys, tokens, or authentication for their API, build a keys page in a dashboard, or handle secrets. Also use when they mention "auth for our API", "personal access tokens", "key rotation", "leaked credentials", or secret scanning, even if they never say "API key".
billing-entitlements
Design plans, entitlements, and metered billing for a developer tool — plans as data, a single getEntitlements() resolver, per-account overrides, usage snapshots, and Stripe-as-ledger sync. Use when the user wants to add pricing tiers, gate features by plan, meter usage, pick a billing metric, or wire up Stripe subscriptions. Also use when they mention "free tier limits", "grandfathering", "overage", "seat pricing", or ask "what should we charge for", even if they never say "billing" or "entitlements".
devtool-context
Creates or updates .agents/devtool-context.md, a one-page profile of the user's developer tool that every other skill in this collection reads first. Use when the user wants to set up devtool-skills, describe their product, create project context for agents, or run "devtool context". Also use proactively when another devtool skill is invoked and no .agents/devtool-context.md exists — offer to create it before continuing.
event-taxonomy
Establish one canonical event taxonomy and versioned schema registry for product analytics — object.verb naming, schema-as-code with CI validation, cross-source normalization, and forward-compatibility rules. Use when the user wants to name analytics events, design a tracking plan, clean up inconsistent event names, or unify analytics with webhook event types. Also use when they mention "instrumentation", "Segment spec", "Amplitude/Mixpanel/PostHog events", "usage metering", or are wiring metered billing to usage data, even if they never say "taxonomy".
integration-pages
Architect programmatic /integrations/[app] pages for a developer tool's site — a single integrations manifest driving generated detail pages, use-case-led content, category-filtered index, schema markup, and CI link checks. Use when the user wants an integrations directory, app marketplace pages, "works with X" pages, or partner pages. Also use when they mention "does our tool work with S3/Slack/GitHub" landing pages, connector catalogs, or generating pages from a data file, even if they never say "integration".
oss-to-hosted
Structure the open-source package → hosted platform funnel — the OSS/platform layer split, finding an honest upsell boundary, README-as-landing-page, telemetry ethics, license choice (MIT/Apache vs AGPL vs BSL), demo apps, and funnel metrics. Use when the user wants to open-source part of their product, add a cloud/hosted tier to an OSS project, decide what to gate, pick a license, or add telemetry to a CLI or library. Also use when they mention "open core", "cloud version", "self-hosted vs managed", or worry about AWS reselling their server, even if they never say "open source funnel".
sdk-design
Design Stripe-grade typed SDK clients for a developer-tool API — constructor config, resource-oriented methods, typed errors, auto-pagination, idempotency, built-in retries, and a README that converts. Use when the user wants to build, generate, or review an API client library, wrapper, or SDK. Also use when they mention "npm package for our API", "Python client", Stainless/Fern/Speakeasy, or complain that integration takes too many steps, even if they never say "SDK".
security-page
Build a credible security/trust page for a developer tool before SOC 2 — concrete controls, encryption specifics, subprocessor list, responsible disclosure, data lifecycle, and honest scoping of what you can claim. Use when the user wants a security page, trust page, or trust center, asks "do we need SOC 2", got a vendor security questionnaire, or is losing deals to security review. Also use when they mention a DPA, subprocessors, security.txt, responsible disclosure, or "enterprise readiness", even if they never say "security page".
webhook-delivery
Design Stripe-grade outbound webhook delivery — signed payloads, event envelopes, retries with backoff, idempotency, dead-letter handling, replay, and delivery logs. Use when the user wants to send webhooks, notify customers of events, add callbacks, or build event delivery infrastructure. Also use when they mention "notify the customer's server", "event subscriptions", "callback URLs", or HMAC signatures, even if they never say "webhook".
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.