Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Insajin/autopus-adk --skill api-designgit clone --depth 1 https://github.com/Insajin/autopus-adkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/insajin/autopus-adk/api-design)<a href="https://agentmods.dev/skills/insajin/autopus-adk/api-design"><img src="https://agentmods.dev/badge/skills/insajin/autopus-adk/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/insajin/autopus-adk/api-design"><img src="https://agentmods.dev/badge/skills/insajin/autopus-adk/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 20 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.00801 |
| Opus 5.5 | $0.00007 | $0.00320 |
| Sonnet 5.5 | $0.00004 | $0.00160 |
| Haiku 4.5 | $0.00002 | $0.00080 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
API Design Skill
확장 가능하고 일관된 API를 설계하는 스킬입니다.
RESTful API 설계 원칙
URL 설계
GET /api/v1/users # 목록 조회
GET /api/v1/users/:id # 단건 조회
POST /api/v1/users # 생성
PUT /api/v1/users/:id # 전체 수정
PATCH /api/v1/users/:id # 부분 수정
DELETE /api/v1/users/:id # 삭제
규칙:
- 복수형 명사 사용 (
users,orders) - 동사 금지 (
/getUsers→/users) - 계층 관계는 중첩 (
/users/:id/orders) - 최대 2단계 중첩 (그 이상은 쿼리 파라미터)
HTTP 상태 코드
| 코드 | 의미 | 사용 시점 |
|---|---|---|
| 200 | OK | 성공 (GET, PUT, PATCH) |
| 201 | Created | 리소스 생성 (POST) |
| 204 | No Content | 삭제 성공 (DELETE) |
| 400 | Bad Request | 요청 데이터 오류 |
| 401 | Unauthorized | 인증 필요 |
| 403 | Forbidden | 권한 없음 |
| 404 | Not Found | 리소스 없음 |
| 409 | Conflict | 상태 충돌 |
| 422 | Unprocessable | 유효성 검증 실패 |
| 500 | Internal Error | 서버 에러 |
에러 응답 형식
{
"error": {
"code": "VALIDATION_FAILED",
"message": "입력값이 유효하지 않습니다",
"details": [
{"field": "email", "reason": "이메일 형식이 아닙니다"}
]
}
}
페이지네이션
GET /api/v1/users?page=2&per_page=20
응답 헤더:
X-Total-Count: 150
Link: <...?page=3>; rel="next", <...?page=1>; rel="prev"
gRPC 설계
Proto 파일 구조
syntax = "proto3";
package api.v1;
service UserService {
rpc GetUser(GetUserRequest) returns (User);
rpc ListUsers(ListUsersRequest) returns (ListUsersResponse);
rpc CreateUser(CreateUserRequest) returns (User);
}
message User {
string id = 1;
string name = 2;
string email = 3;
}
사용 시점
- 마이크로서비스 간 내부 통신
- 높은 처리량, 낮은 지연시간 필요 시
- 양방향 스트리밍 필요 시
API 버전 관리
URL 버전 (권장)
/api/v1/users
/api/v2/users
호환성 규칙
- 필드 추가: 호환 (기존 클라이언트 영향 없음)
- 필드 제거: 비호환 (새 버전 필요)
- 필드 타입 변경: 비호환 (새 버전 필요)
- 필수 → 선택: 호환
- 선택 → 필수: 비호환
설계 체크리스트
- 일관된 URL 패턴
- 적절한 HTTP 메서드/상태 코드
- 표준화된 에러 응답
- 페이지네이션 지원
- 버전 관리 전략 결정
- 인증/인가 설계
- Rate limiting 고려
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 116 lines · 18 tokens per session scan A 1c36016b54ce
api-design is a skill published in the GitHub repository Insajin/autopus-adk (111 stars, last pushed 1mo ago), licensed MIT. It adds 18 tokens to every session and 801 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-interface-design
Use when designing public APIs, module boundaries, provider adapters, tool schemas, or data contracts.
fastapi
Use when building, reviewing, testing, securing or shipping a FastAPI / async Python service — routers, Pydantic v2 schemas, dependency injection, async SQLAlchemy 2.0, OAuth2/JWT, ASGITransport tests, production wiring. NOT language-level Python or packaging (that is python), NOT engine-level SQL (that is…
gamedev-multiplayer
Use when adding multiplayer or netcode to a game — client-server vs P2P, server authority and anti-cheat, state replication vs RPCs, prediction and reconciliation, lag compensation, plus Godot 4 / Unity NGO / Unreal wiring. NOT single-player gameplay (that is godot, unity, unreal), NOT matchmaking or server hosting…
go
Use when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog, project layout, table-driven tests, Go hardening. NOT language-agnostic threat modeling (that is secure-coding), NOT Dockerfile/CI shipping…
csharp-dotnet
Use when writing, reviewing, testing, or shipping C# / .NET code — ASP.NET Core APIs (minimal APIs vs controllers), EF Core data access, async correctness, solution layout in .cs/.csproj/.sln. NOT a Java/Spring backend (that is spring-boot), NOT a Node/TypeScript backend (that is nestjs), NOT framework-neutral REST…
django
Use when building, reviewing, securing, testing or shipping a Django app — models, migrations, QuerySets/managers, FBV/CBV views, forms, the admin, settings split, and Django REST Framework (serializers, ModelViewSet, permissions). NOT async FastAPI/Pydantic services (that is fastapi), NOT Postgres schema/index work…