🦙 nanolama

A tiny master that forges skill-equipped repos.

validate License: MIT Skills: 49 Version: 0.3.0 Stack: Django 5.2 · Next.js 16 PRs welcome

nanolama is a portable Claude Code skills library — a plugin, not an application. Install it and every session already knows how this house stack is built: multi-tenant Django/DRF, cookie JWT, Celery, Channels, Next.js/React Query/Zod, AWS, the product-UX / dashboard / design-system practice that shapes its ERP screens, and the review / security / testing discipline that keeps it correct. The product is the curated catalog below.

Every skill teaches a reusable pattern plus an "adapt to your repo" note — it is model-agnostic and works on any project on the stack, not one codebase. Tenant isolation and security are the north star.

Install

/plugin marketplace add Deadlymind/nanolama
/plugin install nanolama@nanolama-marketplace

Skills auto-trigger from their descriptions — ask "how do I add a tenant-scoped endpoint?" and multi-tenancy, drf-api and rbac-permissions bring themselves in. You can also invoke one explicitly: /nanolama:security-review.

claude --plugin-dir .            # from a clone: load for a single session
/plugin marketplace add .        # or register the local checkout as a marketplace
/plugin install nanolama@nanolama-marketplace

What a skill looks like

One SKILL.md per skill: frontmatter that decides when it fires, then a focused body. The description is the only trigger signal, so it names the real situation — and hands adjacent scope to a sibling so skills don't fight over the same prompt:

---
name: multi-tenancy
description: Enforces tenant isolation on a Django/DRF app where every business model
  carries a non-null tenant FK and ViewSets auto-filter fail-closed. Use when adding a
  tenant-scoped model, writing or reviewing a ViewSet or queryset, or fixing a
  cross-tenant data leak. Not for role/permission gating (see rbac-permissions).
---

(abridged — read the real multi-tenancy)

Every body follows the same shape — When to use · Pattern · Adapt to your repo · Gotchas · See also — and scripts/validate_skills.py enforces it (frontmatter limits, section order, unique descriptions, resolvable cross-references and links), so the library stays coherent as it grows.

Repo layout

.claude-plugin/plugin.json       # plugin manifest
.claude-plugin/marketplace.json  # this repo is its own marketplace
skills/<name>/SKILL.md           # the catalog
scripts/catalog.yaml             # single source of truth -> generates the badges + table
scripts/validate_skills.py       # the SKILL.md contract, enforced
tests/                           # incl. intentionally-invalid skill fixtures
template/SKILL.md                # copy this to start a new skill

The stack these skills target (baseline)

  • Backend — Django 5.2 LTS · DRF 3.16 · PostgreSQL · Python 3.12+
  • Auth — cookie-based JWT (djangorestframework-simplejwt + dj-rest-auth)
  • Multi-tenant — non-null entreprise FK on every business model · fail-closed auto-filtered ViewSets · {resource}_{action} RBAC
  • Async / real-time — Celery 5.6.3 + Redis · Django Channels 4.2+ on ASGI (Daphne in dev, Uvicorn/Gunicorn in prod)
  • AI — Anthropic Claude (agentic tools + OCR extraction) + Tavily
  • Frontend — Next.js 16 · React 19 · TanStack Query 5 · Zustand · Zod 4 · Tailwind v4 · shadcn/ui · next-intl (fr/en/ar, Arabic RTL)
  • Infra — AWS Elastic Beanstalk · Amplify · RDS Postgres · ElastiCache Redis · S3 · GitHub Actions CI

These versions are the baseline as of 2026-07-16, not a permanent truth. The version-check skill has you deep-research the current stable/LTS release and its support window before you install, pin, or upgrade anything — Django 5.2 is still the current LTS, but the rest of the stack keeps moving.

What's inside

49 skills across 7 categories.

🗄️ Backend — Django & DRF

Skill What it does
audit-logging Append-only, tenant-scoped audit trail of auth, RBAC and data-access events.
celery-tasks Hardened background jobs: time limits, retries/backoff, pass ids not objects, idempotency.
codebase-guide How a feature is built end to end: model to serializer to viewset to urls to tests.
db-concurrency Money/counter safety: select_for_update + atomic + F(); Decimal not float.
drf-api Serializers, viewsets, routers, pagination, export actions, the OpenAPI schema.
migrations Safe schema + data migrations: apps.get_model, idempotent RunPython, tenant backfills.
money-decimal Fixed-precision Decimal money math: never float, quantize per step, one rate set, golden tests.
multi-tenancy entreprise FK on every business row; fail-closed auto-filtered ViewSets.
rbac-permissions {resource}_{action} roles; secure-by-default checks; guard custom @actions.
webhook-handler Receive inbound webhooks safely: verify signature, dedupe by event id, resolve tenant, ack then enqueue.
websockets-channels Channels consumers, cookie-JWT WS auth, tenant-scoped groups, send-after-commit.

🎨 Frontend — Next.js & React

Skill What it does
accessibility WCAG 2.2 accessible React + shadcn/Radix UI: keyboard, focus, contrast, and RTL.
dashboard-data-design Decision-first dashboards and dense ERP data: KPI contracts, tables, charts, exceptions, drill-downs, data states.
design-system The governed design language: semantic token roles, component taxonomy, contracts, patterns, deprecation.
frontend-perf Core Web Vitals (LCP/INP/CLS): bundle/code-split, RSC streaming, image/font, cache tuning.
i18n-rtl next-intl fr/en/ar; every string via t(); logical CSS + Arabic RTL.
nextjs-module Feature pattern: lib/api to query-keys to hooks to pages; the shared fetch client.
product-ux-design End-to-end feature UX: roles, task flows with failure branches, IA, screen inventory, acceptance criteria.
react-query Server state: query keys, staleTime, invalidation after mutations.
tailwind-shadcn Tailwind v4 semantic tokens + shared shadcn components; reuse, do not rebuild.
visual-ui-design Implementation-ready screen blueprints: hierarchy, layout, typography direction, responsive, states, critique.
zod-forms Typed schemas + forms; the Select-all and z.coerce.number traps; i18n messages.
zustand-state Client stores with persist/partialize (ids not objects) and the hydration guard.

🔗 Full-stack contract

Skill What it does
cookie-auth-csrf The cookie-JWT + CSRF seam: HttpOnly/SameSite flags, X-CSRFToken on writes, CORS credentials, refresh/logout.
drf-zod-contract Keep a DRF serializer and its Zod 4 schema / TanStack hook in sync, end to end.
tenant-session-switch Switch tenant safely: cancel in-flight, clear cache, resubscribe sockets, refetch; tenant in the key.

☁️ Infra & DevOps — AWS + CI

Skill What it does
aws-services Provision RDS Postgres, ElastiCache Redis, private S3 with an IAM instance role.
ci-cd GitHub Actions gates: check, makemigrations --check, tests, lint, typecheck, build.
deploy-aws Elastic Beanstalk + Amplify runbook: Procfile, migrate leader-only, env vars, rollback.
observability Structured logging, tracing, metrics + error tracking, tenant-correlated across DRF/Celery/Channels.
production-readiness Go-live checklist orchestrating health, secrets, migrations, monitoring, rollback and sign-off.

🤖 AI integration

Skill What it does
ai-evals Deterministic hard gate plus an advisory LLM judge; golden sets; never gate safety on a flaky check.
ai-integration Claude tool-use + agentic loops; the write-tool safety contract; OCR extraction; per-tenant metering.

🛡️ Quality & Security

Skill What it does
browser-e2e-testing Playwright-style E2E of critical journeys: storage-state auth, tenant seeding, RBAC denial, flake control.
code-review Review the diff for correctness + reuse/simplify/efficiency; tenant/RBAC gates; ranked.
debug Reproduce, isolate, hypothesize, fix root cause, verify + add a regression test.
dependency-audit Audit Python + JS deps for CVEs and drift: pip-audit, pnpm audit, lockfile hygiene.
incident-response Once it is live-broken or a secret leaked: report, contain, fix, blameless post-mortem, rotate.
perf-review Find N+1 / unbounded queries; select_related, prefetch_related, bounded dashboards.
security-review Audit for tenant isolation, RBAC gaps, PII leaks, upload validation, secrets.
threat-modeling STRIDE per feature at design time against this stack's trust boundaries; threat to mitigation to owner.
verify Drive the change end to end and observe real behavior before claiming done.
version-check Deep-research the current stable/LTS version and support window before installing or pinning.
write-tests Django TestCase with tenant fixtures + the isolation test, and vitest fetch-mocking.

🧰 Workflow & Meta

Skill What it does
architecture-decisions ADRs: context, decision, consequences; numbered and immutable; supersede rather than edit.
changelog Maintain a Keep a Changelog CHANGELOG.md; roll Unreleased into a release.
commit-message Write Conventional Commits from the staged diff; correct type/scope/subject.
git-workflow The branch to PR to merge loop: branch discipline, rebase before review, and safe recovery.
skill-authoring Author or fix a nanolama skill: the SKILL.md contract, description formula, cross-refs.

Creating your first skill

  1. Copy template/ to skills/<your-name>/.

  2. Rewrite the frontmatter and every section (see the skill-authoring skill for the full contract).

  3. Add an entry to scripts/catalog.yaml.

  4. Regenerate the catalog table and validate:

    python scripts/generate_readme.py
python scripts/validate_skills.py
python -m pytest -q

See CONTRIBUTING.md for the full SKILL.md contract.

Trust & security

Skills are instructions a model will act on. Only install skill libraries from sources you trust, and read every SKILL.md (and any bundled script) before enabling it. In particular, the security-review skill is not hardened against prompt injection — run it only on diffs you trust.

Portability

nanolama is deliberately model-agnostic. Skills use entreprise as the example tenant name and generic module paths; each one carries an "Adapt to your repo" section telling you what to rename or confirm. Nothing here hard-codes one project's layout (except the skill-authoring skill, which is about this repo).

Contributing & license

Contributions welcome — see CONTRIBUTING.md. Licensed under MIT. Conventions and structure adapted from public skill repos are credited in THIRD_PARTY_NOTICES.md.