Skill · App Builders
App Builder Guardian
An evidence-based audit of an AI-built app: ranked issues with reproduction steps, fix prompts with acceptance checks, and a ship or no-ship verdict.
When to use
- You built an app in Google AI Studio, with Gemini in chat, or with another AI builder, and plan to share it with a team or the public.
- The app works in demos, but you do not know how it behaves with bad input, many users or a failing API.
- You want a short, ranked fix list instead of general advice.
When not to use
- As a substitute for a professional security review of an app that handles payments, health data or children's data. Use this audit to prepare for that review.
- You cannot share code or at least a detailed description of screens, inputs and external calls: an audit without evidence is guesswork.
- You want a design or usability review: this audit covers correctness, safety and cost.
Example
User: AI Studio app: users upload a CV, Gemini rewrites it, results are saved in Firestore. Public. Code attached.
Result (excerpt):
SCORES
| Security | 1 | Gemini API key in src/api.js:4, shipped to the browser |
| Errors | 2 | rewriteCv() in src/App.jsx:88 has no catch; a failed call spins forever |
TOP ISSUES
| 1 | Exposed API key | Open the browser's developer tools, search the loaded scripts for the key | Critical |
| 2 | Anyone can read every saved CV | firestore.rules:3 allows read for all; fetch /cvs without logging in | Critical |
| 3 | No upload limit | Upload a 40 MB PDF; the request hangs with no message | High |
Fix 1: Exposed API key
"Move the Gemini call from src/api.js into a server function that reads the key
from an environment variable. The browser calls only that function, which allows
each signed-in user 10 rewrites per day."
Accept when: - no script served to the browser contains the key - a rewrite still works
VERDICT for the public: NO-SHIP. Blockers: rotate the key and move the call to the
server; lock the CV collection to its owner.Illustrative example; your output will differ.
What is inside
The full skill has these sections. The ones marked “in the pack” come with the download.
- When to use on this page
- When not to use on this page
- Inputs to ask for in the pack
- Workflow in the pack
- Rules in the pack
- Output format in the pack
- Example on this page
- Model notes (Oct 2026) in the pack
- Troubleshooting in the pack
- Paste-in version (for chats without skill support) in the pack
Get App Builder Guardian
The full skill is a SKILL.md folder you install once and reuse: the workflow, the checklist and the answer format written out, with notes for each model. It comes in the App Builders pack (3 prompts · 11 skills · 1 free), with a QUICKSTART, setup notes in every item and 12 months of updates.
All-Access 39 € vs 7 packs × 12 € = 84 € · less than buying 4 or more packs one by one
Stuck? Email support@meevra.com — we'll help you set it up.