Production-grade Claude Skills for Ruby on Rails. Stop fighting your AI coding agent on Rails conventions — drop in
rails-skillsand Claude Code, Cursor, Codex, Gemini CLI, Antigravity, and Windsurf will write Rails code the way senior Rails developers actually write it.
The problem
You ask Claude Code or Cursor to "add a draft status with scheduled publishing to Post." It generates a migration, a callback, a controller update. It looks fine. Then you notice:
- It added a
before_savecallback instead of using your existingPublishPostJob - It used a string column for
statusinstead of theenumalready on the model - It didn't add the partial index PostgreSQL needs for the new status
- The test it wrote doesn't use your existing
Postfactory - It hardcoded the timezone
Every Rails dev using an AI agent has had this morning. The agent isn't dumb — it just doesn't know your Rails conventions. rails-skills teaches it.
What this is
A pack of independent Claude Skills (open standard, released by Anthropic in December 2025) covering the patterns, performance traps, security baselines, and deployment conventions that senior Rails developers care about. Each skill is portable across:
- Claude Code
- Claude.ai
- the Claude API
- OpenAI Codex
- Cursor
- Gemini CLI
- Antigravity
- Windsurf
Quick install
Work across many projects? Install once, globally instead of per-repo. The Rails skills are description-gated — they stay dormant on non-Rails projects (React, Go, Python…) and wake up only for Rails work. See Two install modes.
Claude Code
Per-project:
cd <your-rails-app> git clone https://github.com/sandeepmvl/rails-skills .claude/skills
Global — all projects (recommended for multi-project devs):
git clone https://github.com/sandeepmvl/rails-skills ~/.claude/skills/rails-skillsThen start Claude Code. The orchestrator skill (rails-project-discovery) interviews you and routes to the right downstream skills automatically — and only triggers when you're actually working on Rails.
Cursor
cd <your-rails-app> git clone https://github.com/sandeepmvl/rails-skills .cursor/skills
Other tools
See docs/install.md for OpenAI Codex, Gemini CLI, Antigravity, and Windsurf instructions.
The skills
v0.1 — Foundation (16 skills)
| # | Skill | What it does |
|---|---|---|
| 00 | rails-project-discovery |
Orchestrator — interviews you about your app and routes to the right skills below |
| 01 | activerecord-patterns |
Associations, scopes, callbacks, includes vs preload vs eager_load |
| 02 | n-plus-one-killer |
Detect, diagnose, and eliminate N+1 queries |
| 03 | service-objects-vs-fat-models |
When to keep logic in the model and when to extract a service object |
| 04 | rspec-testing-pyramid |
RSpec, FactoryBot, VCR, system specs — what to test at which layer |
| 05 | safe-migrations |
strong_migrations rules, zero-downtime patterns, backfill in batches |
| 06 | rails-api-design |
Versioning, serialization, pagination, rate limiting, JWT auth |
| 07 | solid-queue-and-sidekiq |
Choosing between them, idempotent jobs, retries, scheduled work |
| 08 | devise-pundit-rodauth |
Authentication + authorization patterns done the Rails way |
| 09 | kamal-docker-production |
Multi-stage Dockerfile, docker-compose dev, Kamal 2 deploys |
| 10 | rails-security-baseline |
Strong params, CSRF, Brakeman, secrets, JWT, CORS, OWASP for Rails |
| 11 | rails-caching-strategy |
Solid Cache, Redis, fragment vs low-level, cache stampede prevention |
| 12 | hotwire-turbo-stimulus |
Turbo Drive/Frames/Streams, Stimulus, Action Cable broadcasts |
| 13 | activestorage-uploads |
Direct upload, variants, signed URLs, validation, S3/GCS service config |
| 14 | actionmailer-baseline |
Mailer setup, deliver_later, previews, specs, bounces, idempotent sends |
| 15 | observability-baseline |
lograge structured logs, Sentry, PII scrubbing, Rails.error.report |
v0.2 — Expansion (24 skills)
| # | Skill | What it does |
|---|---|---|
| 16 | rails-upgrade-7-to-8 |
dual-Gemfile next-version pattern; 7.x → 8 hops |
| 17 | rails-upgrade-6-to-7 |
importmap / jsbundling, encrypts, Trilogy intro |
| 18 | rails-upgrade-5-to-6 |
Zeitwerk transition, Webpacker decision |
| 19 | rails-upgrade-4-to-5 |
API mode, ActionCable, ApplicationRecord |
| 20 | rails-upgrade-3-to-4 |
strong params, Turbolinks, encrypted secrets |
| 21 | db-migration-postgres-mysql |
Type mapping, JSONB→JSON, Trilogy gem swap |
| 22 | db-migration-mysql-postgres |
UTF8MB4→UTF-8, prepared_statements + pgbouncer |
| 23 | db-migration-oracle-postgres |
ora2pg, DATE→TIMESTAMPTZ, sequences |
| 24 | react-with-rails |
Inertia.js default, vite_rails, API+SPA alt |
| 25 | vue-with-rails |
Inertia + Vue 3 + Vite |
| 26 | angular-with-rails |
Standalone components, @for/@if, provideHttpClient |
| 27 | puma-tuning-and-concurrency |
Workers/threads, jemalloc, YJIT, PumaWorkerKiller |
| 28 | asset-pipeline-propshaft |
Propshaft vs Sprockets, jsbundling, importmap |
| 29 | multi-database-and-replicas |
connects_to, sticky writes, sharding caveats |
| 30 | webhook-handling |
Idempotent inserts, HMAC verify, DLQ patterns |
| 31 | stripe-webhook-integration |
construct_event, PaymentIntent, idempotency keys |
| 32 | external-api-integration |
Faraday 2, Stoplight circuit breaker, VCR |
| 33 | feature-flagging |
Flipper, gradual rollout, kill switch |
| 34 | form-objects-query-objects-presenters |
Architectural extractions beyond fat models |
| 35 | actiontext-richtext |
Trix, sanitization, embedded attachments, search index |
| 36 | i18n-and-timezones |
rails-i18n, fallbacks, Time.current, DST traps |
| 37 | rails-search |
pg_search → Meilisearch → Elasticsearch tiering |
| 38 | multi-tenancy |
acts_as_tenant, subdomain resolver, require_tenant |
| 39 | console-safety-production |
Sandbox, audit log, rake tasks over console |
v0.3 — Specialization (18 skills)
| # | Skill | What it does |
|---|---|---|
| 40 | when-NOT-to-use-microservices |
Refuses microservices before guiding them. Modular monolith default. |
| 41 | microservices-decomposition |
Bounded contexts, owned data, JWT/mTLS, sagas |
| 42 | monolith-to-services-extraction |
Strangler fig, dark-launch, dual-write, cutover |
| 43 | kafka-rails |
karafka 2.x, outbox, schema registry, partitioning |
| 44 | rabbitmq-rails |
bunny + sneakers, DLX, prefetch, manual ack |
| 45 | redis-streams-rails |
XADD, XREADGROUP, XAUTOCLAIM reaper |
| 46 | cdc-debezium-rails |
Postgres logical replication, outbox + EventRouter SMT |
| 47 | event-driven-architecture |
Domain vs integration events, rails_event_store, outbox |
| 48 | distributed-tracing-rails |
OpenTelemetry, OTLP, baggage, sampling, exemplars |
| 49 | observability-rails-advanced |
RED/USE, SLOs, multi-burn-rate alerts, runbooks |
| 50 | hipaa-rails |
PHI handling, AR Encryption, audit logs, BAAs |
| 51 | pci-dss-rails |
SAQ-A path, Stripe Elements, never PAN/CVV |
| 52 | gdpr-rails |
DSAR, erasure, lawful basis, consent, retention |
| 53 | soc2-rails |
Trust Services, audit logs, access reviews, MFA |
| 54 | data-warehouse-integration |
Fivetran/Airbyte ingest, dbt transforms, reverse-ETL |
| 55 | ci-cd-github-actions-rails |
matrix sharding, bundler-cache, OIDC, Kamal deploy |
| 56 | ci-cd-gitlab-rails |
stages, services, id_tokens for OIDC, Auto DevOps caveat |
| 57 | ci-cd-jenkins-rails |
Declarative pipeline, credentials store, when NOT Jenkins |
Tooling & project-fit (2 skills)
| # | Skill | What it does |
|---|---|---|
| 58 | rubocop-and-code-quality |
RuboCop + omakase preset + rubocop-rails/-performance/-rspec, SimpleCov, erb_lint, RBS vs Sorbet |
| 59 | scaffold-project-skills |
Interview your app + generate project-specific local skills (tenancy, domain workflows, your verify loop) — the product-aware layer the generic pack can't ship |
See PLAN.md for the full roadmap and rationale.
Before / after
Same prompt — "list the 20 most recent posts with their authors" — to the same agent. Without the pack, then with it.
Without rails-skills (AI-typical — a hidden N+1 that only bites in production):
# app/controllers/posts_controller.rb def index @posts = Post.order(created_at: :desc).limit(20) end
<% @posts.each do |post| %> <%= post.title %> — <%= post.author.name %> <%# 1 + 20 queries %> <% end %>
With rails-skills (the n-plus-one-killer + activerecord-patterns skills trigger):
# app/controllers/posts_controller.rb def index # includes(:author) → 2 queries total, regardless of row count. @posts = Post.includes(:author).order(created_at: :desc).limit(20) end
The agent also adds a Bullet config to catch the next N+1 in development before it ships, and explains why includes beats a manual join here. That's the difference: not just correct code, but conventional code with the reasoning a senior Rails dev would give.
A 30-second screencast of this exact flow lands here before the public launch. Until then, the worked example above is the demo.
What this is NOT
- Not magic. A
rails-upgrade-4-to-8skill will guide and accelerate the upgrade. It will not do it autonomously. Rails upgrades require human judgment on gem replacements and test fixes. - Not a replacement for the Rails Guides. These skills target the gaps where AI agents go wrong, not the basics.
- Not a gem. Nothing here gets
required into your Rails app. Skills are markdown files consumed by AI coding agents.
Using this alongside your project-specific skills
rails-skills is a baseline, not a replacement for skills that know your product.
If your app already has local skills encoding its own rules — tenant isolation, domain workflows, payment/booking logic, your test + verification gates, branch discipline — those should stay the source of truth. A general Rails pack can't know what matters for your launch, and you don't want a broad skill layer competing with sharper local instructions.
The recommended pattern:
- Greenfield / no local skills yet → install the whole pack; it's a strong default.
- Mature app with its own skills → keep your local skills authoritative. Cherry-pick from this pack only where you have a genuine gap (migration safety, security-review checklists, Hotwire conventions, bug→regression discipline are common ones to lift).
- Conflicts? Your project conventions win. If you're on Minitest + system/E2E verification rather than RSpec + strict test-first, follow your own loop — the patterns here transfer, the ceremony is optional.
Think of it as a senior Rails dev's default instincts, not a process you must adopt wholesale.
Philosophy
These skills lean DHH: Majestic Monolith, fat models, Hotwire by default, Solid Queue/Cache/Cable on Rails 8. Where the Rails community legitimately disagrees, we state our position with rationale and acknowledge the alternative. We don't both-sides every decision.
Contributing
We need skills for everything in PLAN.md under v0.2 and v0.3. Pick one, copy skills/_TEMPLATE/, follow the conventions in CLAUDE.md, and open a PR.
Skills under v0.1 are the maintainer's responsibility — they set the quality bar. PRs welcome on v0.2+.
License
MIT — use it anywhere. If it saves your team time, a star is the only thanks needed.