Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add athola/skrills --skill api-designergit clone --depth 1 https://github.com/athola/skrillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/skrills/api-designer)<a href="https://agentmods.dev/skills/athola/skrills/api-designer"><img src="https://agentmods.dev/badge/skills/athola/skrills/api-designer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.00247 |
| Opus 5 | $0.00008 | $0.00123 |
| Sonnet 5 | $0.00003 | $0.00049 |
| Haiku 4.5 | $0.00002 | $0.00025 |
Grade A, and why
api-designer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
API Designer
Expert guidance for designing clean, consistent REST APIs.
REST Principles
- Use nouns for resources, verbs for actions
- Follow HTTP method semantics (GET, POST, PUT, DELETE)
- Return appropriate status codes
- Support content negotiation
URL Design
- Use plural nouns for collections (/users, /posts)
- Nest resources logically (/users/123/posts)
- Use query parameters for filtering and pagination
- Keep URLs readable and predictable
Response Format
- Use consistent JSON structure
- Include metadata for collections (total, page, etc.)
- Provide helpful error messages
- Support partial responses when needed
Versioning
- Include version in URL or header
- Maintain backward compatibility
- Document breaking changes clearly
- Deprecate gracefully with notice periods
Security
- Use HTTPS everywhere
- Implement proper authentication
- Validate all inputs
- Rate limit API endpoints
- Log security-relevant events
Documentation
- Provide OpenAPI/Swagger specs
- Include request/response examples
- Document error codes and meanings
- Keep docs updated with changes
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 46 lines · 15 tokens per session scan A 992f236c6ab8
api-designer is a skill published in the GitHub repository athola/skrills (69 stars, last pushed 2d ago), licensed MIT. It adds 15 tokens to every session and 247 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
neo-rabbitmq
Use this skill when a request involves RabbitMQ message-topology design, reliability analysis, Broker operations, cluster or security configuration, monitoring, troubleshooting, or performance optimization. Use stable RabbitMQ 4.3 by default and keep development guidance language-neutral. Do not use this skill for…
neo-dotnet-minimal-apis
Use this skill when building, debugging, refactoring, or reviewing ASP.NET Core Minimal APIs, lightweight endpoints, route groups, endpoint filters, typed results, OpenAPI metadata, or high-performance .NET API services without controllers.
neo-dotnet-mvc
Use this skill when building, debugging, refactoring, or reviewing ASP.NET Core MVC apps with Razor views, controllers, ViewModels, validation, Tag Helpers, View Components, layouts, or server-rendered workflows.
neo-dotnet-webapi
Use this skill when building, debugging, refactoring, or reviewing controller-based ASP.NET Core Web APIs, including ControllerBase, ActionResult , Problem Details, API versioning, global exception handling, DTOs, and OpenAPI behavior.
swagger-to-mcp
Convert OpenAPI v3 specifications into MCP servers using HAPI CLI. Supports local, Docker, and Cloudflare Workers deployment. Zero code required. Use when you need to expose API functionality as MCP tools or deploy API-based services to multiple hosting platforms.
offensive-api-abuse
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query…