skills/development/build-website-web-app/SKILL.md
Build, design, or generate a website or web app. Use when the user wants to create a landing page, web application, UI component, or clone an existing site. Synthesizes best practices from Lovable, v0, Bolt, Same.dev, Replit, Kiro, Orchids.app, Emergent, Leap.new, and Gemini vibe-coder.
npx skillsauth add bereniketech/claude_kit build-website-web-appInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Expert web application builder. Apply all of the following best practices when building websites or web apps.
Before writing code, state a brief plan: what you will build, what stack, key components or pages, and any notable design decisions. Then immediately proceed — do not wait for confirmation unless something is unclear.
Unless the user specifies otherwise:
| Layer | Choice | |-------|--------| | Framework | React + Vite | | Styling | Tailwind CSS | | Language | TypeScript | | UI Components | shadcn/ui | | Package manager | bun (prefer over npm) | | Backend / Auth / DB | Supabase | | Deployment | Vercel or Replit hosting |
"dev": "vite --host 0.0.0.0""dev": "next dev -H 0.0.0.0"Rule: Never write ad-hoc styles in components. Always define the design system first.
Order:
tailwind.config.ts — custom colors, fonts, animationsindex.css / globals.css — CSS variables as HSL values onlytext-white, bg-black, text-gray-500 in componentstext-foreground, bg-background, bg-primary, text-muted-foreground/* index.css design tokens (HSL only) */
:root {
--primary: 220 90% 56%;
--primary-foreground: 0 0% 100%;
--background: 0 0% 100%;
--foreground: 222 47% 11%;
--muted: 210 40% 96%;
--muted-foreground: 215 16% 47%;
--gradient-hero: linear-gradient(135deg, hsl(var(--primary)), hsl(220 70% 40%));
--shadow-elegant: 0 10px 30px -10px hsl(var(--primary) / 0.3);
--transition-smooth: all 0.3s cubic-bezier(0.4, 0, 0.2, 1);
}
Use composition over inheritance. Prefer compound components for shared state. Use render props for injectable rendering logic.
Composition pattern:
export function Card({ children, variant = 'default' }: CardProps) {
return <div className={`card card-${variant}`}>{children}</div>
}
export function CardHeader({ children }: { children: React.ReactNode }) {
return <div className="card-header">{children}</div>
}
Custom hooks — extract all non-trivial state into hooks:
export function useDebounce<T>(value: T, delay: number): T {
const [debouncedValue, setDebouncedValue] = useState<T>(value)
useEffect(() => {
const handler = setTimeout(() => setDebouncedValue(value), delay)
return () => clearTimeout(handler)
}, [value, delay])
return debouncedValue
}
Performance:
useMemo for expensive computations; useCallback for functions passed to children; React.memo for pure componentslazy() + Suspense@tanstack/react-virtualError boundaries: Wrap subtrees in an ErrorBoundary class component to catch render-time errors gracefully.
Animations: Use Framer Motion AnimatePresence for list/modal enter-exit transitions.
| Scale | Pattern |
|-------|---------|
| Local UI state | useState / useReducer |
| Shared page state | Context + Reducer |
| Server state | React Query / SWR |
| Global client state | Zustand |
Context + Reducer template:
const MarketContext = createContext<{ state: State; dispatch: Dispatch<Action> } | undefined>(undefined)
export function MarketProvider({ children }: { children: React.ReactNode }) {
const [state, dispatch] = useReducer(reducer, initialState)
return <MarketContext.Provider value={{ state, dispatch }}>{children}</MarketContext.Provider>
}
Use functional state updates (setCount(prev => prev + 1)) to avoid stale closures.
Rule: Separate data access from business logic from the HTTP layer.
Repository pattern (data access only):
interface MarketRepository {
findAll(filters?: MarketFilters): Promise<Market[]>
findById(id: string): Promise<Market | null>
create(data: CreateMarketDto): Promise<Market>
update(id: string, data: UpdateMarketDto): Promise<Market>
delete(id: string): Promise<void>
}
Service layer (business logic, calls repository):
class MarketService {
constructor(private marketRepo: MarketRepository) {}
async searchMarkets(query: string, limit = 10): Promise<Market[]> { /* … */ }
}
Middleware pattern (auth, rate limiting, logging):
export function withAuth(handler: NextApiHandler): NextApiHandler {
return async (req, res) => {
const token = req.headers.authorization?.replace('Bearer ', '')
if (!token) return res.status(401).json({ error: 'Unauthorized' })
req.user = await verifyToken(token)
return handler(req, res)
}
}
N+1 prevention: Always batch-fetch related entities with a single query + in-memory map instead of per-row queries.
Centralized error handler: Define an ApiError class and a single errorHandler(error, req) used by all routes. Handle ZodError separately for validation failures.
Retry with exponential backoff: Wrap all external API calls in fetchWithRetry(fn, maxRetries=3).
Structured logging: Emit JSON log entries with timestamp, level, message, and context fields. Never log PII or secrets.
Use when building apps targeting iOS 26+ or when the user requests the Liquid Glass design language.
SwiftUI — basic glass:
Text("Hello")
.padding()
.glassEffect(.regular.tint(.orange).interactive(), in: .rect(cornerRadius: 16))
Always wrap multiple glass views in a container:
GlassEffectContainer(spacing: 40.0) {
HStack(spacing: 40.0) {
Image(systemName: "scribble.variable").frame(width: 80, height: 80).glassEffect()
Image(systemName: "eraser.fill").frame(width: 80, height: 80).glassEffect()
}
}
Morphing transitions: Assign @Namespace + .glassEffectID on each element; wrap state changes in withAnimation.
UIKit: Use UIGlassEffect inside UIVisualEffectView; set clipsToBounds = true for corner radii.
WidgetKit: Detect @Environment(\.widgetRenderingMode) and handle .accented mode; use .widgetAccentable() for accent groups.
Rules:
GlassEffectContainer when applying glass to multiple siblings.glassEffect() after other appearance modifiers.interactive() only on elements that respond to user interactionsrc/
components/ # Reusable UI components
ui/ # shadcn base components
pages/ # Route-level components
hooks/ # Custom React hooks
lib/ # Utilities, API clients, helpers
api/ # Repository + service layer
utils/ # Helper functions
<h1> per page matching primary intent<header>, <main>, <footer>, <nav>, <section>, <article>alt with keywords; loading="lazy" below the foldDROP or DELETE in migrations; use IF EXISTS / IF NOT EXISTS in all DDLCREATE TABLE IF NOT EXISTS posts (
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
user_id uuid REFERENCES auth.users NOT NULL,
title text NOT NULL,
created_at timestamptz DEFAULT now()
);
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
CREATE POLICY "Users can read own posts"
ON posts FOR SELECT TO authenticated
USING (auth.uid() = user_id);
When the user wants to clone a site:
public/images/) and reference via local pathshero-background.png not image1.pngalt textvercel deploynpm run build then netlify deploy --prod --dir=disttesting
AUTHORIZED USE ONLY: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis: > 1.
testing
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
development
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
development
Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies.