webapp-last-90

Why it's ranked here

Its strongest idea is operational discipline. The skill requires evidence for tenant isolation, production builds, health checks, monitoring, and restored backups instead of accepting configuration alone. The verdict can still excuse deferred owner tasks, so its conclusions depend on those deferrals being recorded honestly.

What's good

The checklist connects requirements to concrete failure tests. Cross-user access must fail, database health must affect the health response, and backups count only after restoration. It also batches requests for credentials and decisions, while handling repository-only work without repeated interruptions. Self-hostable monitoring options avoid forcing paid services.

Tradeoffs

This is instruction-driven automation, not an independent security guarantee. Its effectiveness depends on Claude correctly understanding the application, tracing real flows, and executing the prescribed verification. Some critical outcomes still require accounts, secrets, infrastructure, or legal approval. Explicit deferral can permit release with known gaps rather than resolving them.

How to use it well

Use it after a web app is deployed and reachable, with repository access and time to review its baseline findings. It best serves owners who want an agent to finish concrete launch work while clearly separating credential and policy decisions. It does not replace deployment tooling, legal counsel, or independent penetration testing.

Observed

License

MIT

Primary format

Markdown instructions with JSON plugin manifests

Packaging

Claude plugin containing a Claude skill; it can also be copied as a plain skill

Interface

Slash command with default and explanation modes

Platform scope

Describes VPS and managed hosting paths, including SQLite and Supabase stacks

Repository structure

The supplied tree contains plugin manifests, one skill definition, and two reference documents