Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hautc-it/cil --skill api-designgit clone --depth 1 https://github.com/hautc-it/cilWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hautc-it/cil/api-design)<a href="https://agentmods.dev/skills/hautc-it/cil/api-design"><img src="https://agentmods.dev/badge/skills/hautc-it/cil/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hautc-it/cil/api-design"><img src="https://agentmods.dev/badge/skills/hautc-it/cil/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01092 |
| Opus 5.5 | $0.00019 | $0.00437 |
| Sonnet 5.5 | $0.00009 | $0.00218 |
| Haiku 4.5 | $0.00005 | $0.00109 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: API Design
A public contract is forever. Cheap to add a field; impossible to remove one.
Project Context
Existing project
- Read
CLAUDE.md— API conventions, versioning rules, or auth patterns already decided take priority. - Check existing routes — read 2–3 existing endpoints. Match their URL structure, naming convention, HTTP method usage, and response envelope shape.
- Find the error format — search for existing error responses. Use the exact same shape — never introduce a second error schema.
- Check auth middleware — how is authentication done in existing routes? Apply the same pattern (middleware, guard, decorator) — don't invent a new one.
- Check pagination — does the project already use cursor or offset pagination? Don't mix styles.
- Search memory —
memory_search("api design [resource] convention")— retrieve prior decisions on versioning, naming, or error format. - Consistency with the established contract beats theoretical perfection.
Greenfield project
No API exists yet — you are setting the contract others will depend on:
- Choose transport — use the Decision table below. Default to REST unless there's a concrete reason not to.
- Define the error shape once — write it down before the first endpoint. Every endpoint returns this exact shape — no exceptions.
- Set versioning strategy — pick one approach (URL prefix, header, or media type) and document it in
CLAUDE.md. Don't let each endpoint invent its own. - Decide auth approach — stateless token, session, or API key. Pick one that matches the deployment model. Document token lifetime and refresh/revocation strategy.
- Set pagination style — cursor-based for any collection that grows; offset only for truly static or small data. Mixing styles later is a breaking change.
- Write
CLAUDE.mdentries for each decision so contributors don't re-litigate them. - Store the decisions:
memory_store("decision", "api: transport=[x], error shape=[x], versioning=[x], auth=[x], pagination=[x]", ["api", "conventions"])
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 86 lines · 47 tokens per session scan A 1652913e1b39
api-design is a skill published in the GitHub repository hautc-it/cil (1 stars, last pushed 2mo ago), licensed MIT. It adds 47 tokens to every session and 1,092 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
api-design
Designs REST, GraphQL, and gRPC APIs (OpenAPI/schema/proto output) and reviews existing APIs for consistency, best practices, and breaking change risks.
architecture-design
Designs new systems from requirements: C4 model diagrams, service boundaries, API contracts, data design, failure modes, and cross-cutting concerns.
tools-unity-unitask
UniTask async/await patterns for Unity including cancellation, lifecycle binding, and coroutine interop.
tools-unity-vcontainer
VContainer dependency injection patterns for Unity including lifecycle management, scoped registrations, and common pitfalls.
mcp-builder
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
configure
Configure Matrix channel credentials (homeserver URL, access token, bot user ID). Use when the user wants to set up or update their Matrix connection.