Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cass-2003/local-workflow-skill/api-design-2npx skills add cass-2003/local-workflow-skill --skill api-design-2git clone --depth 1 https://github.com/cass-2003/local-workflow-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cass-2003/local-workflow-skill/api-design-2)<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/api-design-2"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/api-design-2.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.03496 |
| Opus 5 | $0.00042 | $0.01748 |
| Sonnet 5 | $0.00017 | $0.00699 |
| Haiku 4.5 | $0.00008 | $0.00350 |
Grade A, and why
api-design-2 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API工程师技能 (API Engineer Skill)
快速规则（日常开发时自动加载，只需读到这里）
[API核心清单] ① 资源用名词复数+≤2层嵌套，❌动词URL ② 统一
{code,data,message}响应，列表必须分页(默认20最大100) ③ 新端点默认需认证，CRUD必须验资源所有权 [幂等三条] POST用Idempotency-Key防重复，PUT/DELETE天然幂等，支付类必须服务端去重 [安全三禁] ❌直接返回DB模型(用DTO) ❌返回密码hash/内部ID ❌500返回堆栈
写/改API端点时，强制遵守：
- URL规范：资源用名词复数(
/users)，嵌套≤2层，❌禁止动词URL(/getUser)（动词URL破坏REST语义，导致端点爆炸且无法统一缓存/权限策略） - HTTP方法：GET读(无副作用) POST创建 PUT替换 PATCH更新 DELETE删除，❌禁止POST做所有操作（丢失HTTP语义=无法利用缓存/幂等性/安全性约定，客户端无法预判行为）
- 认证授权：新端点默认需认证，CRUD必须验证资源所有权(防IDOR)，批量操作逐个验权
- 响应格式：统一
{code, data, message}，列表带分页(默认20最大100)，空列表返回[]非null - 错误处理：400参数错误(含字段详情) / 401未认证 / 403无权限 / 404不存在 / 422业务拒绝 / 500+唯一ID
- 幂等安全：POST创建必须有幂等键(Idempotency-Key)，支付类必须服务端去重
- 性能：列表必须分页，批量操作有上限，N+1查询→批量查询，大导出→异步+下载链接
- 安全：❌禁止直接返回DB模型(用DTO)（DB模型新增字段会意外暴露敏感数据） ❌禁止返回密码hash/内部ID（攻击者可离线破解或枚举内部资源） ❌禁止500返回堆栈（堆栈暴露框架版本/文件路径/SQL结构）
新增端点前：Grep确认无重复端点 → 确认命名风格一致 → 确认已加认证中间件
完整审查流程（手动 /api-design 或专项审查时执行）
Phase 1: API现状扫描
-
扫描所有API端点（Grep路由定义/Controller/Handler）：
- 列出所有路由：HTTP方法 + 路径 + Handler函数 + 中间件
- 识别端点完成度：已实现 / TODO占位 / 废弃未删除
- 用MCP工具(desc_table/read_query)检查API关联的数据模型
-
检查API一致性：
- URL命名风格是否统一（kebab-case? camelCase? snake_case?）
- 响应格式是否统一（所有端点是否用相同的响应结构）
- 认证方式是否统一（JWT? Session? API Key? 混用?）
- 错误格式是否统一（错误码体系是否一致）
Phase 2: RESTful设计规范审查
-
URL设计：
- 资源用名词复数：
/users不是/getUser或/user - 嵌套关系：
/users/{id}/orders（不超过2层嵌套） - 查询过滤：
/users?status=active&sort=-created_at - ❌ 禁止：动词URL(
/getUsers//deleteUser)、深层嵌套(>2层)、无意义ID暴露（动词破坏统一性，深嵌套增加耦合度，暴露内部ID助力枚举攻击）
- 资源用名词复数：
-
HTTP方法：
- GET：读取，无副作用，可缓存
- POST：创建新资源
- PUT：完整替换资源
- PATCH：部分更新资源
- DELETE：删除资源
- ❌ 禁止：用POST做所有操作、GET请求有副作用（POST做所有=丢失HTTP语义约定；GET有副作用=爬虫/预加载会触发数据变更）
-
状态码规范：
| 状态码 | 含义 | 使用场景 |
|---|---|---|
| 200 | 成功 | GET/PUT/PATCH/DELETE成功 |
| 201 | 已创建 | POST创建成功 |
| 204 | 无内容 | DELETE成功且无返回体 |
| 400 | 请求错误 | 参数验证失败、格式错误 |
| 401 | 未认证 | 未登录、Token过期 |
| 403 | 无权限 | 已认证但无权访问该资源 |
| 404 | 不存在 | 资源不存在 |
| 409 | 冲突 | 资源已存在、版本冲突 |
| 422 | 无法处理 | 参数合法但业务逻辑不允许 |
| 429 | 请求过多 | 速率限制 |
| 500 | 服务器错误 | 未预期的内部错误 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 260 lines · 83 tokens per session scan A 6b8fa18eb3d4
api-design-2 is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 1mo ago), licensed MIT. It adds 83 tokens to every session and 3,496 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…