Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CCDawn/codex-skills --skill briefbound-api-contractgit clone --depth 1 https://github.com/CCDawn/codex-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccdawn/codex-skills/briefbound-api-contract)<a href="https://agentmods.dev/skills/ccdawn/codex-skills/briefbound-api-contract"><img src="https://agentmods.dev/badge/skills/ccdawn/codex-skills/briefbound-api-contract/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccdawn/codex-skills/briefbound-api-contract"><img src="https://agentmods.dev/badge/skills/ccdawn/codex-skills/briefbound-api-contract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01036 |
| Opus 5.5 | $0.00026 | $0.00414 |
| Sonnet 5.5 | $0.00013 | $0.00207 |
| Haiku 4.5 | $0.00007 | $0.00104 |
Grade A, and why
briefbound-api-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Briefbound API Contract
目标
保护对外契约面:接口、schema、事件和 CLI 参数的每一次变更都有兼容性判定、版本策略和消费者影响评估。它负责契约设计与审查,不负责实施方案、代码实现或 PR 审查。
Briefbound task contract
- Context Boundary: 契约面清单(端点/schema/事件/参数)、现有版本与消费者、拟议变更、兼容性约束和弃用政策。
- Output Contract: 契约设计或变更说明、兼容性判定、破坏点清单、版本与迁移路径、消费者影响。
- Allowed Action: 只读审查现有契约并起草新契约;不直接修改实现代码或数据库数据。
- Success Evidence: 每个破坏点有对照依据(旧定义 vs 新定义);消费者影响可枚举;迁移步骤可执行。
- Stop Condition: 消费者清单不明、契约事实源缺失、变更目标与业务约束冲突,或需先做产品决策。
- Route Out: 实施方案
briefbound-planning;契约测试落地briefbound-test-strategy;PR 审查briefbound-pr-review;briefbound-router或 BLOCKED。
统一调用契约
- 只处理 Briefbound task contract 范围;不匹配时回
briefbound-router或更具体 owner,复合任务不吞其他 owner。 - 用户可见内容默认中文,先给判定结论再列破坏点;契约字段、类型、状态码和版本号保留原文;Route Out 仅以 Briefbound task contract 为准,有自然闸门时末行
下一步建议: <一个具体动作>,否则继续已授权工作。
激活闸门
变更触及对外可见的契约面,或用户要求 API/schema/事件设计评审、兼容性评估、版本或迁移规划时进入。内部函数签名、模块边界和私有数据结构不进本 skill;一般实施方案交 briefbound-planning。
破坏性识别
逐项检查拟议变更,以下均为 BREAKING(对至少一个真实消费者):
- 删除或重命名字段、端点、事件或参数。
- 收紧类型/枚举/取值范围/必填约束。
- 改变默认值、单位、排序、幂等或错误语义。
- 放宽输入(接受更多)通常兼容;收紧输入必破坏。
- 改状态码、错误结构或分页语义。
判定输出三档:BREAKING(存在破坏点,列全)、COMPATIBLE(可加不可破:只加可选字段、新端点、新事件)、DEPRECATED(旧面保留但标记弃用并给出移除条件)。“应该没人用这个字段”不构成兼容性证据;未知消费者按存在处理。
版本化与迁移
- BREAKING 变更走显式版本(URL 前缀、Accept 头或 schema 版本),新旧版本并存一个迁移窗口。
- 给出迁移路径:变更映射表、双写或适配层、弃用时间线、消费者检查清单。
- DB schema 优先可扩展演进(加列/加表/默认值),破坏性迁移单独列出回滚代价。
- 迁移窗口内旧契约的行为保持可预测,不静默改变响应。
契约测试建议
把兼容性判定转成可执行证据:新字段不破坏旧解析、枚举收紧有负例、事件消费者能忽略未知字段。具体测试落地交 briefbound-test-strategy,本 skill 只提出契约级断言清单。
输出
判定: BREAKING / COMPATIBLE / DEPRECATED
破坏点: <旧定义 -> 新定义及受影响消费者>
版本与迁移: <版本策略、窗口与步骤>
契约断言建议: <交给 test-strategy 的清单>
下一步建议: <有自然闸门时的一个具体动作;否则声明继续已授权工作>
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 63 lines · 66 tokens per session scan A 9703c8f97d22
briefbound-api-contract is a skill published in the GitHub repository CCDawn/codex-skills (6 stars, last pushed 1mo ago), licensed MIT. It adds 66 tokens to every session and 1,036 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
supabase-node
Express/Hono with Supabase and Drizzle ORM.
nodejs-backend
Node.js backend patterns with Express/Fastify, repositories.
ring:using-lib-systemplane
Using lib-systemplane, the hot-reload runtime-config plane (Postgres LISTEN/NOTIFY or MongoDB change streams), in two modes. Sweep Mode detects DIY config reload (SIGHUP, fsnotify, viper, pgx LISTEN), manual tenant-scoping, hand-built admin CRUD, and v4 residue. Reference Mode catalogs client lifecycle and…
firebase
Use when building on Firebase — Firestore data modeling, Security Rules, Auth and custom claims, Cloud Functions, Storage, modular Web/Admin SDK imports — including symptoms like a database open to the internet, a query rejected by rules, or a doc stuck at 1 write/sec. NOT managed-Postgres BaaS with SQL and RLS (that…
ring:using-outbox
Using the transactional-outbox pattern across lib-streaming (writer) and lib-commons/v5/commons/outbox (repository + relay), in two modes. Sweep Mode detects DIY outbox tables, hand-rolled relay loops, send-and-pray emits, missing WithOutboxTx wrapping, and broker calls inside DB transactions. Reference Mode catalogs…
notion-connector
Use when wiring server code or a cron job to Notion as an ops backend over its HTTP API: pushing or mirroring database rows, two-way sync without duplicates, page blocks, or an integration broken by the 2025-09-03 data-source split. NOT generic REST wiring (that is api-connector-builder), NOT inbound Notion webhook…