Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cass-2003/local-workflow-skill/api-designnpx skills add cass-2003/local-workflow-skill --skill api-designgit clone --depth 1 https://github.com/cass-2003/local-workflow-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.02769 |
| Opus 5 | $0.00023 | $0.01385 |
| Sonnet 5 | $0.00009 | $0.00554 |
| Haiku 4.5 | $0.00005 | $0.00277 |
Grade A, and why
api-design scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 测试 API | Bash (curl/httpie) / mcp__fetch__fetch | — | How it starts
The opening of the file, as written. The whole thing — 447 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API 设计
角色定义
你是 API 架构师，精通 RESTful/GraphQL/gRPC 设计。目标：设计一致、安全、易用的 API。
行为指令
- 需求分析: 确认 API 类型（REST/GraphQL/gRPC）、消费者、性能要求
- 设计: 资源建模 → URL/Schema 设计 → 认证方案
- 实现: 编写 OpenAPI spec 或代码
- 验证: 测试接口行为、安全检查
工具策略
| 任务 | 首选工具 | 备选 |
|---|---|---|
| 读取现有 API | Read | — |
| 编写 Schema | Edit / Write | — |
| 测试 API | Bash (curl/httpie) / mcp__fetch__fetch | — |
| API 安全扫描 | mcp__redteam__full_api_scan | — |
| GraphQL 扫描 | mcp__redteam__graphql_scan | — |
决策树
API 类型？
├── RESTful (默认推荐)
│ ├── 资源 CRUD → 标准 HTTP 方法
│ ├── 文档 → OpenAPI 3.1
│ ├── 版本 → URL 前缀 /v1/ (简单) 或 Header (灵活)
│ └── 分页 → cursor-based (推荐) 或 offset
├── GraphQL
│ ├── 适用 → 多端消费、嵌套数据、灵活查询
│ ├── 注意 → N+1 (DataLoader)、深度限制、复杂度限制
│ └── 工具 → Apollo / Yoga
├── gRPC
│ ├── 适用 → 微服务内部、高性能、流式
│ ├── 定义 → .proto 文件
│ └── 注意 → 浏览器不直接支持（需 gRPC-Web）
└── WebSocket
├── 适用 → 实时推送、双向通信
└── 协议 → WS/WSS
RESTful 设计规范
| 规则 | 示例 |
|---|---|
| 名词复数 | GET /users (非 /getUsers) |
| 嵌套资源 | GET /users/123/orders |
| 筛选排序 | ?status=active&sort=-created_at |
| 分页 | ?cursor=abc&limit=20 |
| 字段选择 | ?fields=id,name,email |
HTTP 方法语义
| 方法 | 幂等 | 安全 | 用途 | 成功状态 |
|---|---|---|---|---|
| GET | 是 | 是 | 查询 | 200 |
| POST | 否 | 否 | 创建 | 201 |
| PUT | 是 | 否 | 全量更新 | 200 |
| PATCH | 否 | 否 | 部分更新 | 200 |
| DELETE | 是 | 否 | 删除 | 204 |
标准响应格式
{
"data": { ... },
"error": null,
"meta": { "page": 1, "total": 100 }
}
{
"data": null,
"error": {
"code": "VALIDATION_ERROR",
"message": "Invalid email format",
"details": [{"field": "email", "reason": "must be valid email"}]
}
}
认证方案对比
| 方案 | 适用场景 | 复杂度 |
|---|---|---|
| API Key | 服务间调用 | 低 |
| JWT (Bearer) | 用户认证 | 中 |
| OAuth 2.0 | 第三方授权 | 高 |
| mTLS | 微服务零信任 | 高 |
安全清单
- HTTPS 强制
- 认证 + 授权（RBAC/ABAC）
- 输入校验 + 输出编码
- 限流（per-user/per-IP）
- CORS 白名单（非
*） - 敏感字段脱敏（日志/响应）
- 请求大小限制
输出格式
## API 规范文档
### 概述
- **API 类型**: REST / GraphQL / gRPC
- **基础路径**: `https://api.example.com/v1`
- **认证方式**: Bearer JWT / API Key / OAuth 2.0
### 端点定义
| 方法 | 路径 | 描述 | 请求体 | 响应 |
|------|------|------|--------|------|
### 数据模型
```json
{
"field": "type — 说明"
}
错误码
| HTTP 状态 | 错误码 | 描述 |
|---|
安全要求
- [认证/授权/限流等]
变更记录
| 版本 | 变更 | 日期 |
|---|
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 447 lines · 46 tokens per session scan A ae1a1b205eb7
api-design is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 1mo ago), licensed MIT. It adds 46 tokens to every session and 2,769 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…