Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add d4rkNinja/arcforge --skill api-contractsgit clone --depth 1 https://github.com/d4rkNinja/arcforgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/d4rkninja/arcforge/api-contracts)<a href="https://agentmods.dev/skills/d4rkninja/arcforge/api-contracts"><img src="https://agentmods.dev/badge/skills/d4rkninja/arcforge/api-contracts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/d4rkninja/arcforge/api-contracts"><img src="https://agentmods.dev/badge/skills/d4rkninja/arcforge/api-contracts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.02599 |
| Opus 5.5 | $0.00035 | $0.01040 |
| Sonnet 5.5 | $0.00017 | $0.00520 |
| Haiku 4.5 | $0.00009 | $0.00260 |
Grade A, and why
api-contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Think Through API & Client Contracts
Overview
Production guidance for API surfaces and their clients. Each reference paper captures the contract work that first drafts skip: request lifecycle and deadlines, validation edge cases, error taxonomies that do not leak internals, stable pagination under concurrent writes, deprecation windows, webhook signature verification, and realtime reconnection semantics.
Core principle: An API is a compatibility promise. Every endpoint, error, cursor, and webhook is a contract with real clients — including old clients you no longer control.
Domain Law
NO API OR CLIENT CONTRACT CHANGE WITHOUT:
1. the minimum required primary paper(s) for the surface selected from the context table;
2. the paper's pre-change questions
answered, or each open point labeled as an assumption;
3. "Existing-codebase checks" run when changing an existing API;
4. every applicable MUST mapped to a decision, a test, or a documented
exception — never silently downgraded.
When to Use
Use this skill when thinking through, reviewing, changing, or verifying:
- REST, RPC, gRPC, or GraphQL endpoints and resource/command design;
- request parsing, body limits, content-type handling, and input validation;
- error architecture: codes, HTTP status mapping, public vs internal detail;
- pagination (offset/cursor), filtering, sorting, and query complexity limits;
- bulk and batch operations with partial-failure reporting;
- API versioning, deprecation, sunset windows, and breaking-change detection;
- data serialization choices and precision/compatibility pitfalls;
- webhooks: registration, signing, timestamp/replay validation, retries, dead-lettering;
- realtime communication: WebSockets/SSE, presence, reconnection, ordering;
- SDK/client libraries and CLI-backend interactions;
- security headers for browser-facing APIs.
When Not to Use
- Whole-system architecture design: use
system-architecture-harness. - Authentication, authorization, API keys: use
auth-access. - Queue delivery semantics, events, outbox: use
async-messaging. - Database schema evolution sequencing: use
migration-evolution(070 overlaps at the contract level). - Rate limiting and quotas mechanics: use
resilience-flow-control(038, 039).
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 278 B
- examples/worked-example-orders-list-api.md 4.1 KB
- references/papers/011-request-lifecycle.md 36 KB
- references/papers/012-input-validation.md 40 KB
- references/papers/013-error-architecture.md 36 KB
- references/papers/014-api-design.md 33 KB
- references/papers/015-api-versioning-and-compatibility.md 32 KB
- references/papers/016-pagination.md 37 KB
- references/papers/017-filtering-sorting-query-apis.md 37 KB
- references/papers/049-webhooks.md 38 KB
- references/papers/050-realtime-communication.md 35 KB
- references/papers/110-sdk-client-design.md 33 KB
- references/papers/111-cli-backend-interaction.md 31 KB
- references/papers/115-web-security-headers.md 34 KB
- references/papers/116-data-serialization.md 33 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +8 lines 0a7417aee153
- 1mo ago First seen · 149 lines · 87 tokens per session scan A b568863a4952
api-contracts is a skill published in the GitHub repository d4rkNinja/arcforge (17 stars, last pushed 1mo ago), licensed MIT. It adds 87 tokens to every session and 2,599 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
frontmcp-guides
Tutorials, end-to-end walkthroughs, and complete reference projects for FrontMCP. Use when you want a getting-started guide, a full worked example, or to learn best practices by following a step-by-step build rather than a single API reference. Includes a beginner weather-API server (tool plus static resource, Zod…
architecture-paradigm-domain-driven
Models a business in its own language. Use when the domain has real business rules to capture.
api-design-patterns
Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices.
architecture-paradigm-microservices
Applies microservices for independent deployment and per-service scaling. Use when teams need autonomous release cycles with distinct capability scaling needs.
architecture-paradigm-cqrs-es
Applies CQRS and Event Sourcing for read/write separation and audit trails. Use when designing systems with complex domain logic or full state-change history.
architecture-paradigm-functional-core
Applies Functional Core, Imperative Shell to isolate logic from side effects. Use when business logic is entangled with I/O or unit tests are slow and brittle.