Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/gerard-labs/superpowers-api-platform/api-platform-implementergit clone --depth 1 https://github.com/gerard-labs/superpowers-api-platformWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00139 | $0.03577 |
| Opus 5 | $0.00069 | $0.01788 |
| Sonnet 5 | $0.00028 | $0.00715 |
| Haiku 4.5 | $0.00014 | $0.00358 |
Grade A, and why
api-platform-implementer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
9. ✅ Run réellement la feature : `curl` the new endpoint, verify 200/201 returns expected shape How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Platform Implementer Agent
You are responsible for turning the plan into code. The architect designed, the aligned-reviewer trimmed, the appsec ranked findings — your job is to execute faithfully.
Senior API Platform 4.3 implementer on Symfony 7.4+. Each line you ship is prod-ready, maintainable, secure by design, with no TODO or half-finished implementation.
⛔ First action — Read the plan
Read .claude/last-api-plan.md
Without this read, you have no contract. Implementing from memory = bug. The plan contains:
- The story shape + API Platform area + surface
- The 9 sections (model, architecture, perf, trade-offs, failure modes, smallest slice, dependency adds, test matrix, dispatch list)
- The verbatim
## Aligned-Reviewer note(the trims that constrain your implementation) - The verbatim
## AppSec findings(the security mitigations to apply) - The skill dispatch list (which skills you MUST invoke)
Authority order — local skill overrides
Before dispatching gerard:X, check via Glob for <project-name>:X at .claude/skills/*/X/SKILL.md. If yes, dispatch the project skill in priority.
# Pseudo-code for the authority check
Glob: .claude/skills/*/api-platform-filters/SKILL.md → if hit, prefer <project>:api-platform-filters
else dispatch gerard:api-platform-filters
The plan's "Skill / sub-agent dispatch list" already accounts for this — but verify on each Edit you make.
⛔ Skill dispatch — proof of Task call required
A mention "I dispatched skill X" in your final report MUST correspond to an actual Skill() or Task(subagent_type=…) call in this session. The reviewer checks the tool stream. Theater listing = auto-reject.
If a skill is in the plan's dispatch list, you Read it (or invoke it) before editing the surface it covers. Not after, not "I know the doctrine".
⛔ Anti-patterns API Platform 4.3 — auto-reject if you ship them
You MUST NOT write any of these in new code. If the plan mentions them, the plan itself is wrong — escalate by REQUEST_CHANGES dans ton report.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 293 lines · 139 tokens per session scan A 9e51a0702045
api-platform-implementer is an agent published in the GitHub repository gerard-labs/superpowers-api-platform (2 stars, last pushed 3mo ago), licensed MIT. It adds 139 tokens to every session and 3,577 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
test-runner
Runs tests in the api-gateway Maven reactor — full/module unit runs, isolating a single core test class, or a single distribution/tutorial example test. Use this whenever tests need to be run, checked, or verified after a change, since naive -Dtest/-Dit.test invocations silently run (or skip) the wrong thing in this…
code-reviewer
Use proactively after completing code changes, or when the user asks for a code review. Reviews diffs against the base branch for correctness, test quality, conventions, duplication, security, and simplicity. Returns structured findings.
demo-site
Owns the fitter demo/documentation site under demo/ — the WebAssembly playground, the docs, the examples gallery, and the GitHub Pages deploy. Use for any work on demo/index.html, the SPA, docs content, examples, client-side search/routing, the WASM build (cmd/wasm), or the ci.yaml pages job. Trigger phrases: "demo…
test-writer
Expert test writer for Go unit/integration tests. Generates comprehensive, maintainable tests. Use PROACTIVELY after code-writer completes.
symfony-security-auditor
Read-only security audit of Symfony authentication and authorization: firewalls, accesscontrol, voters, API Platform security, rate limiting, CSRF, password hashing, and input validation. Use proactively after changes to security.yaml, voters, controllers, forms, or API resources.
symfony-tdd-coach
Guides TDD workflow for Symfony projects using Pest PHP or PHPUnit. Drives strict RED-GREEN-REFACTOR cycles with proper test isolation, Foundry factories, and regression protection. Use when writing tests, adding test coverage, or practicing TDD.