Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add an8079/take-skills --skill api-reviewergit clone --depth 1 https://github.com/an8079/take-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/an8079/take-skills/api-reviewer)<a href="https://agentmods.dev/skills/an8079/take-skills/api-reviewer"><img src="https://agentmods.dev/badge/skills/an8079/take-skills/api-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/an8079/take-skills/api-reviewer"><img src="https://agentmods.dev/badge/skills/an8079/take-skills/api-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01168 |
| Opus 5 | $0.00000 | $0.00584 |
| Sonnet 5 | $0.00000 | $0.00234 |
| Haiku 4.5 | $0.00000 | $0.00117 |
Grade A, and why
api-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
api-reviewer
API 质量专项审查技能 — RESTful/GraphQL/WebSocket 接口规范性、安全性、性能审查
触发词
api review, 接口审查, API质量, 接口安全, api-review
概述
作为 api-reviewer，专注于 API 的质量审查，涵盖 RESTful 设计规范、GraphQL schema 设计、WebSocket 协议、安全性和性能问题。
核心审查维度
1. API 设计规范
- RESTful 路由规范（名词复数、层级嵌套限制）
- HTTP 方法正确使用（GET/POST/PUT/DELETE/PATCH）
- 状态码标准使用（200/201/400/401/403/404/500）
- 错误响应格式一致性（error object 结构）
- GraphQL schema 规范（Query/Mutation/Subscription 分离）
2. 接口安全性
- 认证授权检查（JWT 验证、权限校验）
- 敏感数据暴露（密码、token 不应在响应中返回）
- SQL/NoSQL 注入风险
- 参数校验（类型、范围、格式）
- CORS 配置检查
- Rate Limiting 实现检查
3. 接口性能
- N+1 查询问题检测
- 不必要的全量查询
- 分页实现检查
- 缓存头部设置（Cache-Control/ETag）
- 响应体大小（是否压缩）
4. 版本管理
- API 版本控制规范（URL versioning vs Header versioning）
- 破坏性变更标识
- 废弃 API 标识
5. 文档完整性
- OpenAPI/Swagger 文档存在性
- 请求/响应示例完整性
- 字段说明完整性
- 错误码文档
审查检查清单
[ ] RESTful 规范
- [ ] 路由使用名词复数 /users, /orders
- [ ] 正确 HTTP 方法
- [ ] 状态码标准使用
- [ ] 嵌套路由不超过 2 层
[ ] GraphQL（如适用）
- [ ] Query 不应有副作用
- [ ] Mutation 返回有意义数据
- [ ] 避免深度嵌套查询
- [ ] N+1 问题（DataLoader）
[ ] 安全审查
- [ ] 所有变更操作用 POST/PUT/PATCH/DELETE
- [ ] 敏感字段已过滤（password, token）
- [ ] 输入参数校验存在
- [ ] SQL 注入风险评估
[ ] 性能审查
- [ ] 大列表有分页
- [ ] 无 N+1 查询
- [ ] 响应有 ETag/Cache-Control
[ ] 文档审查
- [ ] OpenAPI 文档存在且最新
- [ ] 所有端点有示例
- [ ] 错误码有说明
执行流程
Step 1: 定位 API 代码
# 查找 API 路由文件
find . -name "*.ts" -path "*/routes/*" -o -name "*.py" -path "*/endpoints/*"
find . -name "*.ts" -path "*/api/*" -o -name "*.go" -path "*/handlers/*"
# 查找 GraphQL
find . -name "schema.*" -o -name "*.graphqls"
# 查找 OpenAPI
find . -name "openapi.*" -o -name "swagger.*" -o -name "*.yaml" -path "*/api/*"
Step 2: 分析 API 结构
- 读取路由定义
- 分析输入输出模型
- 检查中间件链
- 审查认证逻辑
Step 3: 安全扫描
- 敏感数据流分析
- 权限模型检查
- 输入验证覆盖度
Step 4: 输出报告
## API 审查报告
### 端点统计: X 个
- RESTful: X | GraphQL: X | WebSocket: X
### 发现问题: X个
| 严重度 | 端点 | 问题 | 建议 |
|--------|------|------|------|
| 🔴 Critical | POST /api/users | 密码明文返回 | 过滤 password 字段 |
| 🟡 Warning | GET /api/orders | 无分页参数 | 添加 ?page=&limit= |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 129 lines · 0 tokens per session scan A cb6cf7a4f6ed
api-reviewer is a skill published in the GitHub repository an8079/take-skills (4 stars, last pushed 5mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,168 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
platform-apex-generate
Primary Apex authoring skill for class generation, refactoring, and review. ALWAYS ACTIVATE when the user mentions Apex, .cls, triggers, or asks to create/refactor a class (service, selector, domain, batch, queueable, schedulable, invocable, DTO, utility, interface, abstract, exception, REST resource). Use this skill…
flow-next-impl-review
Carmack-level implementation review of changes via the configured backend. Use when asked to review code or a diff in a flow-next repo.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
api-contract-review
Use when auditing CloudBase cloud API wrappers, MCP tools, generated action metadata, or related docs for outdated or incorrect action names, parameters, casing, request shapes, or missing contract tests, especially during periodic quality review or before preparing corrective PRs.
api-reviewer
A review of an API contract, the agreed description of how software systems exchange requests, responses, events, or files.
principle-model-the-domain
Apply when writing stateful logic, or when code branches a lot or repeats a shape assumption across files. Encode the domain in a structure instead of scattered conditionals.