Skill Details
Runtime
Any model
Example user message
[userMessage]: User message: Audit this Next.js SaaS for invented APIs. Billing is Polar. Auth is none-yet. package.json dependencies: next, react, typescript. No polar, no stripe, no clerk. app/api/webhooks/polar/route.ts verifies header x-polar-signature with a homemade HMAC and grants user.plan = "pro". app/pricing/page.tsx has a button "Start Pro — $12" with href="#". middleware.ts does not exist.
Example agent response
Agent response:
### Score
INVENTED 1 · STUB 1 · UNVERIFIED 0 · OK 0
### Findings
| ID | Path | Class | What | Evidence |
| F1 | app/api/webhooks/polar/route.ts | INVENTED | Homemade HMAC on x-polar-signature; grants pro from the webhook body. No Polar SDK in package.json. | package.json has next/react/typescript only |
| F2 | app/pricing/page.tsx | STUB | CTA says Start Pro — $12 but href is "#". | pricing page CTA |
### Founder actions
1. Polar dashboard: create the product, put the real checkout URL in NEXT_PUBLIC_CHECKOUT_URL.
2. Do not ship F1. Keep the webhook route returning 501 until a Polar webhook secret exists in env.
3. Decide auth before entitlements. There is no session. plan = "pro" has nowhere honest to live.
### Smallest safe code change
Disable the pricing CTA. Add // STUB: checkout URL after Polar product exists. Do not add a Polar SDK in this pass.
Instant access
Commercial use
Money‑backBy purchasing this skill, you agree to our terms of service
3
Views
Audit a Next.js App Router indie SaaS for APIs, Polar/Gumroad webhooks, and auth the coding agent invented. The skill reads package.json, checkout/webhook/middleware files, and classifies each finding INVENTED, STUB, UNVERIFIED, or OK. You get a founder-action list (which dashboard, which env var) and at most one safe stub — never a hallucinated billing SDK. Use before you charge a stranger. Not a boilerplate. Not legal advice.
...more
Added 3 weeks ago
