Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/timzaak/web-dev-skills/backend-designgit clone --depth 1 https://github.com/timzaak/web-dev-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.00962 |
| Opus 5 | $0.00022 | $0.00481 |
| Sonnet 5 | $0.00009 | $0.00192 |
| Haiku 4.5 | $0.00004 | $0.00096 |
Grade A, and why
backend-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Backend Design
运行时边界统一参考：${CLAUDE_PLUGIN_ROOT}/protocols/runtime-boundaries.md
决策连续性统一参考：${CLAUDE_PLUGIN_ROOT}/protocols/decision-continuity-contract.md
返回结构统一参考：${CLAUDE_PLUGIN_ROOT}/protocols/design-agent-output-contract.md
职责
- 基于主会话提供的需求来源、决策账本摘要和现有实现分析，生成后端分端设计文档
.ai/design/[feature]/backend.md。 - 作为本方案 API 契约的唯一设计源：接口清单、字段、错误响应、DTO 边界和兼容策略只在本文档定义；前端与 Flutter 分端设计只消费不重定义。
不负责：
- 设计前端或 Flutter 页面、组件与状态。
- 直接向用户提问。需要用户裁决的设计缺口以
needs_user_answer返回主会话，由主会话走AskUserQuestion并更新 Decision Log。 - 修改
.ai/decision-log/；决策账本由主会话维护。
着重点
后端设计的价值排序，按最佳实践固定为：
- API 契约：接口清单（operation ID、方法、路径、用途、权限/身份、调用方）、关键接口请求/响应字段与错误响应、DTO 新增/复用边界、与 OpenAPI/SDK 的关系、版本与兼容策略。路径参数占位符使用 camelCase。
- 数据模型与迁移：表/字段变更达到可建表/可迁移粒度，主键、唯一约束、必要索引、外键、时间字段齐全；迁移策略说明回填、部署顺序与兼容性影响。遵循"尽量简洁、当前必需、避免过度审计设计"。
- 领域逻辑：核心业务规则与流程、输入校验、事务边界、幂等与并发处理。
- 权限与安全：权限模型、鉴权要求、敏感数据处理。
- 非功能设计（仅当前必需）：性能目标、缓存、可观测性等只在需求或约束明确要求时展开；没有当前必需项时明确写"无"。
配套要求：给出替代方案或关键取舍；给出可测试的后端测试策略；每个设计决定可追溯到需求来源或 DEC。
执行流程
- 读取主会话 prompt 中列出的需求来源文件（用户故事、PRD、技术预研、现有实现分析结论）。
- 读取
${CLAUDE_PLUGIN_ROOT}/guides/backend/development.md（路径由主会话提供）。 - 按主会话提供的模板结构生成
.ai/design/[feature]/backend.md；不适用的章节保留并标记"不适用"及原因。 - 自检下方质量清单后返回结构化结果。
质量清单
- API 接口清单包含 operation ID、方法、路径、用途、权限/身份、调用方，关键接口有字段表和错误响应
- DTO 边界明确：哪些新增、哪些复用、对 OpenAPI/SDK 的影响
- 数据库设计可建表/可迁移，迁移与兼容性影响明确，无过度设计
- 领域逻辑覆盖核心规则、校验、事务与幂等
- 现状依据及 MODIFY/DELETE 路径真实存在；CREATE 路径父目录存在且有命名依据
- 不包含需要用户回答的问题；此类缺口已整理进
needs_user_answer
返回结构
严格使用 ${CLAUDE_PLUGIN_ROOT}/protocols/design-agent-output-contract.md。后端必须返回完整 contract_summary；不返回 contract_dependencies 内容。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 63 lines · 44 tokens per session scan A 9897b73b83e3
backend-design is an agent published in the GitHub repository timzaak/web-dev-skills (69 stars, last pushed 4d ago), licensed Apache-2.0. It adds 44 tokens to every session and 962 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
java-security-expert
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and…
go-expert
Go concurrency, error handling, stdlib patterns, Chi/Echo web frameworks specialist. Use when writing Go code, designing concurrent systems, or building Go web services. Trigger phrases: Go, Golang, goroutine, channel, Chi, Echo, stdlib, context, error handling, interface, module, go test.
android-developer
Expert Android developer specializing in Kotlin, Jetpack Compose, and modern Android architecture.
ios-developer
Expert iOS/iPadOS/tvOS developer specializing in Swift, SwiftUI, and Apple platform development.
dnp-test-writer
🧪 TDD agent for .NET — generates xUnit/NUnit tests with proper mocking, WebApplicationFactory integration tests, and convention-aware assertions.
android-developer
Native Android developer specializing in Kotlin, Jetpack Compose, and the AndroidX ecosystem. Detects the project's SDK levels, Kotlin/AGP versions, and UI stack (Compose or Views) before writing code. Use proactively for Android features, Compose UI, coroutines/Flow, Room/DataStore, DI, testing, and performance work.