Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Cristhianzl/claude-skills-czl --skill api-designgit clone --depth 1 https://github.com/Cristhianzl/claude-skills-czlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cristhianzl/claude-skills-czl/api-design)<a href="https://agentmods.dev/skills/cristhianzl/claude-skills-czl/api-design"><img src="https://agentmods.dev/badge/skills/cristhianzl/claude-skills-czl/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cristhianzl/claude-skills-czl/api-design"><img src="https://agentmods.dev/badge/skills/cristhianzl/claude-skills-czl/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01796 |
| Opus 5.5 | $0.00000 | $0.00718 |
| Sonnet 5.5 | $0.00000 | $0.00359 |
| Haiku 4.5 | $0.00000 | $0.00180 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Design
A good API is a contract you can evolve without breaking the people who depend on it. Design the contract first, model resources not actions, use HTTP the way it is specified, stay backward-compatible, and make security and operability the default — not an afterthought.
This skill is protocol-agnostic at the workflow level; the canonical detail lives in references/ and is loaded on demand.
Read first (always)
List learnings/ and read every file whose name looks relevant to the current task — the project's versioning policy, its error envelope, its auth model, its naming conventions, and provider-specific webhook quirks live there and override the defaults in this file. If a learning conflicts with this SKILL.md, the learning wins — mention it to the user.
Tradeoff — when to apply, when to lighten up
Apply the full discipline for any API with external or cross-team consumers, or anything that persists state. Lighten the ceremony for a private, single-consumer endpoint you fully control on both sides and can change atomically — but never lighten the security floor (authorization, input validation, no secrets in URLs).
Workflow
-
Choose the protocol deliberately. REST for resource CRUD and broad client reach; GraphQL when clients need flexible, client-shaped queries over a graph; gRPC for low-latency internal service-to-service. Don't default to GraphQL/gRPC because they're new. State the choice and why. → verify: you can name the consumer and why this protocol fits it.
-
Design contract-first. Write the OpenAPI (or proto/SDL) spec before the code; review it, then generate or hand-write handlers against it. Lint the spec in CI (e.g. Spectral) so drift fails the build. → verify: the spec exists and is the source of truth, not reverse-engineered from code.
-
Model resources (nouns), not actions. A resource is a thing with an identity; collections are plural. Unusual operations become sub-resources or state, not verbs in the path. See
references/rest-conventions.md. → verify: no verb in any path.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 83 lines · 0 tokens per session scan A 3d6d69828e28
api-design is a skill published in the GitHub repository Cristhianzl/claude-skills-czl (5 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,796 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
form-strategy
Design forms that convert, validate well, resist spam, and integrate cleanly with downstream systems. Use this skill when designing or auditing any form (contact, signup, checkout, multi-step, embedded), planning validation logic, fighting spam, choosing form tooling, or improving form conversion. Triggers on form…
mcp-server-builder
Use to build, wire up, or debug an MCP (Model Context Protocol) server that gives Claude access to an internal API, database, or SaaS tool. Trigger when the user wants Claude to connect to their own system, asks for an MCP server, needs custom tools for Claude Code or the Claude app, or an existing server's tools are…
api-endpoint-scaffolder
Generate REST API endpoints with proper structure, validation, error handling, and types. Use when creating new API routes, endpoints, or backend services.
netlify-development
Best practices for building and deploying Netlify sites, covering serverless and edge functions, Netlify Blobs storage, the Image CDN, and build configuration. Use when writing Netlify Functions or Edge Functions, configuring netlify.toml or redirects/headers, managing environment variables across deploy contexts…
nextauth-authentication
Guidelines for implementing NextAuth.js (Auth.js v5) authentication in Next.js applications with session management and security best practices.
api-security-best-practices
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities.