Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add adtn0810/truestack --skill truestack-api-designgit clone --depth 1 https://github.com/adtn0810/truestackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adtn0810/truestack/truestack-api-design)<a href="https://agentmods.dev/skills/adtn0810/truestack/truestack-api-design"><img src="https://agentmods.dev/badge/skills/adtn0810/truestack/truestack-api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adtn0810/truestack/truestack-api-design"><img src="https://agentmods.dev/badge/skills/adtn0810/truestack/truestack-api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00256 | $0.02797 |
| Opus 5 | $0.00128 | $0.01399 |
| Sonnet 5 | $0.00051 | $0.00559 |
| Haiku 4.5 | $0.00026 | $0.00280 |
Grade A, and why
truestack-api-design scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
REST/JSON over HTTP is the default for a self-hosted single server: debuggable with `curl`, How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
truestack-api-design
Own the contract — the promise the API makes to its callers — and get it right before a line of it is implemented. The contract is the artifact; the code conforms to it, not the reverse. Accuracy and stability over cleverness: a boring REST endpoint that every proxy, cache, and client already understands beats a clever one that re-invents what HTTP gave you free.
Read project memory first — CLAUDE.md is auto-loaded (Principles + Boundaries); consult
.ai/memory/ for the stack, existing API conventions, and the reverse proxy in front of the
box. If none exists, run truestack-project-memory. Keep the code↔memory tally balanced: when you
lock a convention (casing, versioning scheme, error type URIs), record it in the same change.
A public-facing or versioned API contract is a high-risk, hard-to-reverse decision — once a
client depends on a shape, you own it. Route the contract through truestack-architecture-planning's
approval gate before it ships, and let truestack-quality-control gate it before "done". Don't guess on a
coin-flip: if more than one reasonable contract fits, clarify with a short, capped round of
questions-with-defaults first.
Auto-research, don't recall: the rules below cite living standards (RFC 9457, RFC 9745/8594, the IETF Idempotency-Key and RateLimit drafts, OWASP API Top 10). Confirm the current status and exact member/header names from the authoritative source before asserting them — drafts advance and status codes have edge cases.
Where this skill sits (seams):
truestack-api-designowns the interface contract;truestack-backend-developmentimplements it (owner-scoped auth, validation, the idempotency table). Define the shape here, build it there.truestack-architecture-planningdoes system design (modules, data flow, services); this skill designs the interface between a service and its callers.- This skill owns the authorization rules in the contract (BOLA/BOPLA below) — the design
discipline.
truestack-quality-controlruns the one-shot SAFETY pass that checks a given change against OWASP; it doesn't author the contract. truestack-application-securityowns the app-wide authz model (RBAC/ABAC, deny-by-default) and the auth flows themselves; this skill specifies object-ownership and field allow-lists inside the contract schema — the interface's slice of that model, not its replacement.truestack-mcp-integrationowns untrusted tool output crossing into the app; this skill owns the request/response schema that validates client input at the edge.truestack-observabilityowns PII redaction in telemetry; keep PII out of URLs/query strings here so it never reaches a log in the first place, but the redaction policy is theirs.truestack-ci-and-deliveryruns the spec lint + backward-compat diff as a CI gate; this skill defines what "breaking" means so that gate has a rule to enforce.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 157 lines · 256 tokens per session scan A d2cdf36f09e1
truestack-api-design is a skill published in the GitHub repository adtn0810/truestack (2 stars, last pushed 2mo ago), licensed MIT. It adds 256 tokens to every session and 2,797 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fastapi-patterns
FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production readiness.
stripe-projects
Provision SaaS services + sync creds via Stripe Projects.
omni-mcp
Connect to the OmniRoute MCP server (110 tools, 3 transports: SSE/stdio/HTTP). Covers routing, cache, compression, memory, skills, providers, and audit tools across 33 permission scopes.
event-store-design
Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.
gemini-api-agent-platform
Guides the usage of the Gemini API on Agent Platform with the Google Gen AI SDK for enterprise AI applications. Covers SDK usage (Python, JS/TS, Go, Java, C#), capabilities like Live API, tools, multimedia generation, caching, and batch prediction.
cqrs-implementation
Implement Command Query Responsibility Segregation for scalable architectures. Use when separating read and write models, optimizing query performance, or building event-sourced systems.