# thisaan skills

> A library of AI skills for commissioning software without writing code. Version 1.4.0.
> The business owner builds until the screens are real, then hands the invisible work to a developer.
> Every skill is plain markdown and carries the shared standards inside it — fetch one file and follow it.

## How to use these

Fetch a skill as markdown and follow its instructions directly. Read https://skills.thisaan.cloud/md/standards.md first if the
skill will produce anything visible, since the standards govern that output. Each skill file already
contains what it needs; there is nothing to install and nothing to unzip.

To install the skills permanently on the user's machine instead, follow https://skills.thisaan.cloud/install — a step-by-step
install order written for an AI to execute, readable by a human too. It branches on what you can actually do
(run shell commands / fetch URLs only / neither), so read it before deciding how to help.

## Owner skills — commissioning work

- [app-brief](https://skills.thisaan.cloud/md/app-brief.md): One conversation that turns a vague idea into a BRIEF.md covering the idea, the real problem, scope, done-criteria, and the data needed. Use when the user says "อยากทำระบบ" (I want to build a system), "มีภาพในหัวแต่บอกไม่ถูก" (I have a picture in my head but can't explain it), "ช่วยคิดหน่อย" (help me think this through), "อยากได้อะไรสักอย่างที่ช่วย..." (I want something that helps...), "เริ่มยังไงดี" (where do I start), or starts describing a new idea with no clear shape yet. This is the entry point for every owner-side task.
- [app-run](https://skills.thisaan.cloud/md/app-run.md): Converts an approved (level 4) prototype into a real React app per https://skills.thisaan.cloud/standards/APP-STACK.md — real stored data (SQLite via Prisma), a real login, running on the owner's own machine across several browsers, starting from an empty database — then installs and starts it for them. This is the optional fourth owner-side command, a branch off the end of /app-show, taken instead of (or before) sending the work to a developer. Use when the user says "อยากลองใช้จริง" (want to actually try using it), "ทำเป็นแอปจริง" (make it a real app), "ใช้เองก่อน" (use it myself first), "ยังไม่ส่ง dev" (not sending to a developer yet), "อยากมีล็อกอิน" (want a real login), "เก็บข้อมูลจริง" (store real data), "อยากลองใช้บนเครื่องตัวเอง" (want to try it on my own machine). Requires LEVEL.md to already show level=4 approved=yes — if not, send the user back to /app-show first.
- [app-sale](https://skills.thisaan.cloud/md/app-sale.md): Builds a public page that sells one product or service to a stranger, following https://skills.thisaan.cloud/standards/LANDING-PAGE.md — words approved before any design, real material only (never an invented review, number, or generated product photo), one single action such as messaging the seller on LINE, mobile-first. Use when the user says "ทำหน้าขาย" (build a sales page), "sale page", "landing page", "หน้าขายของ" (a page to sell things), "อยากได้เว็บขายสินค้า" (want a website to sell a product), "ทำหน้าให้ลูกค้าทักไลน์" (a page that gets customers to message on LINE), "โปรโมทสินค้า" (promote a product), "ทำเพจขายของ" (make a selling page) — even if not stated directly, use this whenever the reader is a stranger deciding whether to buy, rather than a colleague using a tool. For internal screens and tools use /app-show instead.
- [app-send](https://skills.thisaan.cloud/md/app-send.md): Packs the owner's work (brief, scope, data model, screen spec, prototype) into one standard "handoff package" a developer can open and start on immediately, with no re-asking. Use when the user says "ส่งงานให้ dev" (send this to the developer), "แพ็คไฟล์ส่งต่อ" (package the files to hand off), "ส่งต่อให้นักพัฒนา" (hand off to a developer), "พร้อมส่งหลังบ้านแล้ว" (ready to send the backend work), "ทำ prototype เสร็จแล้วอยากให้ dev ต่อ" (the prototype is done, want a developer to continue) — even if not stated directly, use this skill whenever the context is "the look is settled, next is connecting a database/API/security." REFUSES and stops if real customer data, passwords, or API keys are found in what's about to be sent.
- [app-show](https://skills.thisaan.cloud/md/app-show.md): Turns a brief/idea into clickable screens through 4 gated levels (wireframe -> clickable -> data separated -> tested), each level requiring approval before the next. Covers both first-time builds and edits to existing work. Use when the user says "อยากเห็นหน้าตา" (I want to see what it looks like), "ทำให้ดูหน่อย" (show me), "ลองทำ demo", "vibe", "สร้าง prototype", "ทดสอบให้หน่อย" (test it for me), or asks to edit existing work like "ย้ายปุ่มนี้" (move this button), "เปลี่ยนสี" (change the color), "เปลี่ยนข้อความ" (change the text), "เพิ่มช่องกรอก" (add a field), "เพิ่มคอลัมน์" (add a column), "สลับลำดับตาราง" (reorder the table). No need to state new-build vs. edit — this skill reads context to tell whether a prototype already exists and which level it's at.

## Developer skills — building, verifying, shipping

- [ai-feature](https://skills.thisaan.cloud/md/ai-feature.md): Adds a feature that uses an LLM/AI — choosing between direct prompting / RAG / fine-tuning, designing the prompt structure, grounding/citation, handling hallucination, cost+latency budget, evaluation before shipping, and a fallback plan for when the model's response fails. Use when the user says "ทำแชทบอท" (build a chatbot), "สรุปด้วย AI" (summarize with AI), "ให้ AI ตอบคำถามจากเอกสาร" (have AI answer questions from documents), "เขียน prompt" (write a prompt), "AI มั่วคำตอบ" (the AI is making up answers), "ตอบช้า/แพงเกิน" (responses are slow/too expensive) — even if not stated directly, if the context is "I want the system to be smarter with AI," use this skill.
- [backend-api](https://skills.thisaan.cloud/md/backend-api.md): Builds REST/RPC endpoints to standard — routes/ contain no business logic (call services/ only), validate every input with Zod, one error shape across the system, check auth/permission, implement pagination. Use when the user says "สร้าง API" (build an API), "เพิ่ม endpoint" (add an endpoint), "ทำ route" (build a route), "ต่อ backend" (connect the backend), "validate input", "เช็คสิทธิ์ผู้ใช้" (check user permission) — even if not stated directly, if the context is "the frontend needs to fetch data from the backend," use this skill.
- [database-design](https://skills.thisaan.cloud/md/database-design.md): Converts DATA.md + RULES.md from a handoff package into real database tables — plural snake_case table names, date fields ending in _at, booleans starting with is_/has_, indexes/foreign keys, append-only migrations, and handling for soft-delete/audit columns/money as integer minor units. Use when the user says "ออกแบบฐานข้อมูล" (design the database), "ทำ schema" (build a schema), "เขียน migration" (write a migration), "ตารางอะไรบ้าง" (what tables are needed), "เก็บเงินยังไง" (how to store money), "ลบแบบ soft delete" (soft delete) — even if not stated directly, if the context is "there's a DATA.md that needs converting into real tables," use this skill.
- [integration](https://skills.thisaan.cloud/md/integration.md): Connects external systems — third-party APIs, webhooks, LINE, payment gateways, file import/export. Covers retry, idempotency, rate limiting, secret storage (never in code), and a fallback plan for when the vendor is down. Use when the user says "ต่อ LINE" (connect LINE), "ต่อระบบจ่ายเงิน" (connect a payment system), "เชื่อม webhook" (wire up a webhook), "ยิง API คนอื่น" (call someone else's API), "import ไฟล์จากแพลตฟอร์ม" (import a file from a platform), "vendor ล่มทำไง" (what to do when a vendor is down) — even if not stated directly, if the context is "our system needs to talk to an outside system," use this skill.
- [mcp-server](https://skills.thisaan.cloud/md/mcp-server.md): Builds an MCP server that exposes tools for an AI client to call — naming tools, writing input schemas, writing descriptions that let AI discover and call the right tool, error responses, auth, and how to test a tool against a real client. Use when the user says "ทำ MCP server" (build an MCP server), "เปิด tool ให้ AI เรียก" (expose a tool for AI to call), "ต่อ Claude กับระบบเรา" (connect Claude to our system), "เขียน tool description" (write a tool description) — even if not stated directly, if the context is "I want AI to be able to call functions in our system," use this skill.
- [scaffold-project](https://skills.thisaan.cloud/md/scaffold-project.md): Lays out a real project's structure per PROJECT-STRUCTURE.md standard (root files, docs/, src/modules+shared+config, server/routes+services+db+middleware, tests/, scripts/, .archive/) and ingests a Handoff Package from the owner into the project. Use when the user says "เริ่มโปรเจกต์ใหม่" (start a new project), "วางโครง" (lay out structure), "scaffold", "รับ handoff" (receive a handoff), "แตก zip จากเจ้าของงาน" (extract the owner's zip), "ตั้งโปรเจกต์จาก prototype" (set up a project from a prototype) — even if not stated directly, if the context is "there's a zip from the business side, need to start the backend," always use this skill first.
- [bug-hunt](https://skills.thisaan.cloud/md/bug-hunt.md): Hunt for real bugs, not code-style nitpicks — edge cases (empty/zero/negative/huge/duplicate/concurrent), off-by-one, date/timezone handling, money rounding, null/undefined paths slipping through, race conditions, error paths never tested. Use when the user says "หาบั๊ก" (find bugs), "bug hunt", "เทสเคสแปลกๆ" (test weird cases), "ทำไมพังตอน..." (why does it break when...), "เจอบั๊กช่วยดูหน่อย" (found a bug, take a look), "เคสนี้จะพังไหม" (will this case break) — every finding must include reproduction steps, and a bug counts as "fixed" only after it's been re-tested and confirmed gone, not just after reading the code and believing it's fixed.
- [review-report](https://skills.thisaan.cloud/md/review-report.md): Rolls up the results from structure-check, security-review, bug-hunt, and test-plan into one report a business owner can actually read — no unexplained jargon, ranked into "must fix first / can fix later / just so you know," with impact stated in business language (a customer can see someone else's data, a total is wrong, the system crashes under load). Use when the user says "สรุปให้เจ้าของงานอ่าน" (summarize this for the owner to read), "review report", "พร้อมส่งคืนหรือยัง" (is this ready to hand back), "สรุปผลตรวจให้ฟังหน่อย" (summarize the review results), "จะบอกลูกค้ายังไงดี" (how should I explain this to the client) — the output is the file `รายงานตรวจสอบ.md`, which the Return Kit requires.
- [security-review](https://skills.thisaan.cloud/md/security-review.md): Practical security review — leaked secrets in code/git history, SQL/XSS/command injection, permission holes (especially "can user A see user B's data"), unvalidated input, file-upload risk, vulnerable dependencies, overly loose CORS, sensitive data leaked into logs. Use when the user says "ตรวจความปลอดภัย" (check security), "security review", "security check", "ก่อน deploy ตรวจหน่อย" (check before deploying), "ข้อมูลลูกค้าปลอดภัยไหม" (is customer data safe), "ใครแฮ็กได้ไหม" (can anyone hack this) — every "ร้ายแรง" (critical) finding blocks handoff and deploy immediately.
- [structure-check](https://skills.thisaan.cloud/md/structure-check.md): Checks a project's structure against the PROJECT-STRUCTURE.md standard — required root files, .env never leaked, no file over 250 lines, no -v2/-new/-final/-copy names, shared/ actually used in >=2 places, routes/ has no business logic, CLAUDE.md is a one-liner pointing to AGENTS.md. Use when the user says "ตรวจโครงสร้าง" (check the structure), "structure check", "โปรเจกต์เรียบร้อยไหม" (is the project tidy), "ก่อนส่งมอบเช็คโครงก่อน" (check the structure before handoff), "ทำไมโปรเจกต์นี้รก" (why is this project messy) — this is the first gate before checking security and bugs.
- [test-plan](https://skills.thisaan.cloud/md/test-plan.md): Decide what deserves a test and write real, runnable tests — unit tests for business rules, integration tests for API+DB, e2e only for the critical user journeys. Covers the acceptance criteria in SCOPE.md and all 5 UI states per DESIGN-SYSTEM.md. Use when the user says "เขียนเทส" (write tests), "test plan", "ครอบคลุมพอไหม" (is coverage enough), "coverage", "เทสอะไรบ้าง" (what should be tested), "ต้องเทสอันนี้ไหม" (does this need a test) — the output is a runnable test suite plus a summary of what was intentionally left untested and why.
- [migration](https://skills.thisaan.cloud/md/migration.md): Change a real database's structure or move data without losing anything — always back up first and prove the backup restores, write both the forward and rollback paths, use expand-then-contract for any destructive column change, try it on sample data before the real thing, and count rows / checksum after migrating. Use when the user says "ย้ายฐานข้อมูล" (migrate the database), "migration", "เปลี่ยน schema" (change the schema), "เพิ่ม/ลบคอลัมน์บนของจริง" (add/drop a column on production), "ย้ายข้อมูลลูกค้า" (move customer data), "alter table บน production" — even if not stated directly, if the context is "about to change the structure of a table that already has real data," always use this skill. Iron rule: never edit a migration that has already run.
- [ship-it](https://skills.thisaan.cloud/md/ship-it.md): Deploy to real production safely — run the full pre-flight check, back up before touching anything real, prove after release that it actually works rather than just "the process is running," and have a rollback plan decided in advance. Use when the user says "ขึ้นระบบจริง" (go live), "deploy", "push ขึ้น production", "ปล่อยของ" (ship it), "go live", "ปล่อยเวอร์ชันใหม่" (release a new version) — even if not stated directly, if the context is "the code is ready, going to put it live for customers to use," always use this skill. Never skip this, no matter how rushed.
- [handover-docs](https://skills.thisaan.cloud/md/handover-docs.md): Write handover documentation that lets someone else actually take over running the system — what it is, how to run it locally in 3 commands, a one-picture architecture overview, where secrets live (not their real values), how to deploy, how to restore from backup, quirks/gotchas worth knowing before you hit them yourself, and who to contact. Use when the user says "เขียนคู่มือส่งมอบ" (write a handover guide), "handover", "เอกสารระบบ" (system docs), "ส่งมอบงาน" (hand over the work), "จะลาออกแล้วต้องส่งงาน" (leaving the job and need to hand it off), "ให้คนใหม่ดูแลต่อ" (let a new person take over), "README ให้ dev คนอื่น" (a README for another developer) — even if not stated directly, if the context is "want someone who's never seen this system before to be able to take it over," always use this skill.
- [monitor-and-alert](https://skills.thisaan.cloud/md/monitor-and-alert.md): Set up monitoring so you find out the system is broken before a customer has to tell you — what to watch (errors, response time, backed-up queues, full disks, failed jobs, business metrics like "no orders in 2 hours"), where alerts go, and how to avoid alert fatigue by only alerting on things a person actually needs to act on, plus an incident checklist. Use when the user says "ตั้ง monitoring" (set up monitoring), "ตั้งแจ้งเตือน" (set up alerts), "ระบบล่ม" (system is down), "ระบบพัง" (system is broken), "จะรู้ได้ไงว่าพัง" (how would I know if it broke), "alert", "incident", "เว็บล่ม" (site is down), "ลูกค้าใช้งานไม่ได้" (customers can't use it) — even if not stated directly, if the context is "the system is live now, want to know if it breaks," always use this skill.
- [handback-to-owner](https://skills.thisaan.cloud/md/handback-to-owner.md): Pack work the developer has finished (database/API connected, passed security-review/bug-hunt) into a "Return Kit" the project owner can open and use right away, and partly edit themselves — every report translated into plain human language, no leftover technical jargon. Use when the user says "ส่งคืนให้เจ้าของงาน" (hand it back to the owner), "ทำเสร็จแล้วจะส่งคืน" (it's done, going to hand it back), "พร้อม deploy ส่งกลับ" (ready to deploy and hand back), "แพ็คซองส่งคืน" (pack the return kit) — even if not stated directly, if the context is "the backend is connected, security has been checked, next the project owner needs to be able to keep editing it themselves," use this skill. Will REFUSE and stop if security-review still has a severe finding open.

## Shared

- [refresh-skills](https://skills.thisaan.cloud/md/refresh-skills.md): Check whether the skill set currently in use is outdated or the latest, and update it. Use when the user says "อัปเดต skill" (update skill), "มีเวอร์ชันใหม่ไหม" (is there a new version), "refresh skill", "ดึง skill ล่าสุด" (pull the latest skill), "skill เก่าหรือยัง" (is this skill outdated), "เช็คเวอร์ชัน skill" (check skill version), "ของที่ใช้อยู่ทันสมัยไหม" (is what I'm using up to date) — even if not stated directly, if the context is "ทำไม skill ตัวนี้ทำงานไม่เหมือนที่เคยเห็นในคู่มือ" (why does this skill behave differently from what's in the docs) or "เพื่อนอีกคนได้ผลลัพธ์ไม่เหมือนกัน" (a friend got a different result), suspect a version mismatch first, then use this skill to check.

## Standards

- [APP-STACK.md](https://skills.thisaan.cloud/standards/APP-STACK.md)
- [CONVENTIONS.md](https://skills.thisaan.cloud/standards/CONVENTIONS.md)
- [DESIGN-SYSTEM.md](https://skills.thisaan.cloud/standards/DESIGN-SYSTEM.md)
- [HANDOFF-PROTOCOL.md](https://skills.thisaan.cloud/standards/HANDOFF-PROTOCOL.md)
- [LANDING-PAGE.md](https://skills.thisaan.cloud/standards/LANDING-PAGE.md)
- [PLATFORMS.md](https://skills.thisaan.cloud/standards/PLATFORMS.md)
- [PROJECT-STRUCTURE.md](https://skills.thisaan.cloud/standards/PROJECT-STRUCTURE.md)
- [REGISTRY.md](https://skills.thisaan.cloud/standards/REGISTRY.md)

## Optional

- [All owner skills in one file](https://skills.thisaan.cloud/bundle/owner.md): paste as a single system message
- [All developer skills in one file](https://skills.thisaan.cloud/bundle/dev.md): paste as a single system message
- [manifest.json](https://skills.thisaan.cloud/manifest.json): machine index with version, description, hash, and file paths
- [Human manual, in Thai](https://skills.thisaan.cloud/manual.html)