技能

Pre-launch audit for a website or SaaS - checks SEO tags (title, description, canonical, lang, Open Graph), robots.txt, sitemap.xml, favicon and apple-touch-icon, real 404 status, HTTPS redirect, legal pages (privacy, terms, refund), image alt text, page weight and response time, plus a payment self-check (webhook signature, raw body, idempotency, refunds, secrets, success-page grants), then lists the problems and fixes them in the codebase. Ships a no-dependency crawler script (audit_site.py) that produces a pass/warn/fail report. Use when the user says they are about to launch, ship, go live, submit to Product Hunt or AI directories, or asks "is my site ready", "SEO check", "why is my site not indexed", or wants a launch checklist, or asks whether their payment or webhook setup is safe.

Drafts a Privacy Policy, Terms of Service and Refund Policy for a SaaS, digital product or website from a short questionnaire, adapted to the payment provider (Creem, Paddle, Lemon Squeezy as Merchant of Record, or Stripe/direct) and to where users are (EU/UK GDPR, California CCPA/CPRA, China PIPL notes), then renders them as Markdown, HTML or Next.js pages and links them in the footer. Output is a starting template, NOT legal advice - the user must review it and have it checked by a qualified lawyer. Use when the user needs privacy policy, terms, refund policy, legal pages, or a payment provider (Paddle/Creem/Lemon Squeezy/Stripe) review asks for them.

Adds Creem payments to a Next.js (App Router) app end to end. Covers products, one-time and subscription checkout, webhook signature verification, three-layer idempotency (event id, resend key, grant key), a tested entitlement state machine with stale and out-of-order guards, customer portal and in-product cancellation, refunds and chargebacks revoking access, Vitest and Playwright test-card tests, and go-live. Ships 3 slash commands (/add-creem-paywall, /debug-creem-webhook, /payment-audit). Use when the user wants to sell with Creem (creem.io), add a paywall, subscriptions or a lifetime deal, wire Creem webhooks, fix "webhook signature invalid", or handle refunds and access revocation.

A complete, working Next.js 16 SaaS starter that takes payments through Creem (merchant of record) - Better Auth email-code login, Drizzle + SQLite, Creem checkout for monthly / yearly / lifetime plans, a signed and deduplicated webhook that grants and revokes access, Manage billing and in-product cancel, a gated page and API route, a Dockerfile, the three Creem slash commands, and an end-to-end test that runs the whole purchase against a mock Creem. Use when the user wants to start a new paid web app, a SaaS boilerplate with payments, or a Creem example project that already works, rather than adding payments to an existing app (use creem-checkout for that).

Server-side feature gating and paid-content delivery that works with any payment provider (Creem, Paddle, Stripe, Polar, Lemon Squeezy, manual grants). Covers a scope model (all / plan / pack / single item), expired vs revoked vs never-bought decisions, numeric plan limits, update windows for one-time purchases, blocking double purchases, short-lived signed download links that re-check access, and a Gate server component. Pure core with tests. Use when the user needs to lock features or files behind a plan, add a Pro tier, sell packs or bundles, add plan limits, or protect paid downloads in a Next.js app.

Adds license keys to a paid desktop app, CLI, plugin or self-hosted product. Covers key generation, hashed storage, device activation with an activation limit, same-device reinstall, deactivation to move devices, revocation on refund or chargeback, expiry, and signed offline leases. Ships a runnable zero-dependency server and client with tests, and explains when to use Creem's built-in license keys (proxied through your backend) instead. Use when the user asks for license keys, activation codes, serial numbers, "limit to N devices", offline licensing, or revoking a refunded customer's key.

Plans and runs a move from Stripe, Polar or Lemon Squeezy to Creem (or to Paddle) without cutting off paying customers. Covers the product map, importing existing buyers as legacy grants so access continues, stopping renewals on the old provider at period end, dual-running both webhooks, invitations to re-subscribe, and a cut-over checklist. Ships plan_migration.mjs (plan, Markdown, SQL) with tests. Use when the user wants to switch payment providers, leave Stripe, Polar or Lemon Squeezy for a merchant of record, or asks how to move subscribers to Creem.

Adds Paddle Billing (the current Paddle API, not Paddle Classic) to a Next.js App Router app. Covers sandbox setup, Paddle.js overlay checkout tied to the signed-in user, Paddle-Signature verification with timestamp tolerance and secret rotation, event-id dedupe, occurred_at ordering with tombstones, subscription states, scheduled cancels, refunds and chargebacks through adjustments, the customer portal and in-product cancel. Tested against Paddle's official sample payloads. Use when the user wants to sell with Paddle, switch to Paddle as merchant of record, or fix Paddle webhooks, refunds or access.

Self-host a Next.js (or any Dockerized) app with a SQLite database on one AWS Lightsail instance - Docker Compose with Caddy for automatic HTTPS, a first-boot script that installs Docker and locks down SSH and the firewall, daily consistent SQLite backups to a Lightsail bucket with 30-day retention, a restore script and a scripted backup-and-restore drill, GitHub Actions deploys through GHCR with health checks and automatic rollback, health and disk alerts, Lightsail automatic snapshots, and a RUNBOOK template. Use when the user wants to deploy, host or self-host their app on AWS, Lightsail, a VPS or their own server instead of Vercel, or asks about backups, HTTPS, zero-downtime deploys or restoring the database.

A method for finding paid demand on Xiaohongshu (RED, 小红书) by hand, with your AI assistant as the analyst. Includes a library of about 40 search terms grouped by theme, read-only browsing rules, an evidence check that separates self-reported income, AI-generated content labels and public shop sales counts, a buying-intent tally for comment sections, a 6-item scoring sheet (0-2 each, max 12), a report template that keeps facts apart from inferences, and two anonymized real sample reports. Low-frequency and human-assisted. Use when the user wants side-project, digital-product or small-tool ideas that people on Xiaohongshu already pay for, asks whether an income claim in a note is real evidence, or wants an opportunity scored and written up. 中文：小红书找商机的方法——约 40 个分组搜索词、只读浏览规则、证据真假判断（自报收入 / AI 生成标注 / 店铺公开销量）、评论区求购信号计数、6 项打分表（满分 12）和事实与推断分开写的报告模板，附两份脱敏真实样例。低频、人工辅助。

Generates Open Graph / Twitter (X) share images for every page of a website and wires up the og:* and twitter:* meta tags, then verifies the social preview. Supports Next.js App Router (opengraph-image.tsx with next/og ImageResponse), Astro (build-time PNGs via satori + resvg) and any static site (Pillow script). Use when the user asks for OG images, social share cards, link previews, "my link looks bad on X/Slack/LinkedIn/WeChat", twitter:card, or before launching a site.

Creates or upgrades a repository's AGENTS.md (read by Codex, Cursor, and other agents) and a CLAUDE.md that imports it, so Claude Code, Codex, Cursor and Gemini CLI share one set of project rules. Scans the repo to detect languages, package manager, real build/test/lint commands, framework, directory layout and existing rule files (.cursorrules, .cursor/rules, CLAUDE.md, copilot-instructions), then writes a concise, verified rules file. Use when the user asks to set up AGENTS.md or CLAUDE.md, "project rules", "make Claude Code and Codex follow the same conventions", onboard an agent to a repo, or migrate .cursorrules.