Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jayrha/agentskills/api-designernpx skills add JayRHa/AgentSkills --skill api-designergit clone --depth 1 https://github.com/JayRHa/AgentSkillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00125 | $0.02123 |
| Opus 5 | $0.00063 | $0.01061 |
| Sonnet 5 | $0.00025 | $0.00425 |
| Haiku 4.5 | $0.00013 | $0.00212 |
Grade A, and why
api-designer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Designer
Overview
This skill helps you design HTTP/REST and GraphQL APIs that are predictable, evolvable, and pleasant to consume. It covers resource modeling, URI design, HTTP semantics, versioning, pagination, filtering/sorting, error contracts, idempotency, concurrency control, auth, rate limiting, and writing machine-readable contracts.
Keywords: REST, GraphQL, OpenAPI, Swagger, API design, endpoint, resource, versioning, pagination, cursor, idempotency, ETag, RFC 9457, Problem Details, rate limit, contract, HATEOAS, webhook.
Apply this skill whenever the user is creating, extending, or reviewing an API surface — not when they are merely calling an existing third-party API.
Decision: REST vs GraphQL vs RPC
Pick the style before designing details.
- REST — default for resource-oriented CRUD, public APIs, heavy caching needs, file uploads/downloads, and broad client tooling. Plays well with HTTP caching, CDNs, and standard status codes.
- GraphQL — choose when clients need flexible, nested data selection, when you have many client types with divergent data needs, or to avoid over/under-fetching. Costs: caching, rate limiting, and observability are harder; needs query-depth/complexity limits.
- gRPC / JSON-RPC — choose for internal service-to-service, low-latency, streaming, or strongly-typed contracts where browser reach is not required.
When unsure, default to REST and expose a small GraphQL layer later if client flexibility becomes a real pain point. See references/rest-checklist.md and references/graphql-checklist.md.
Workflow
Follow these steps in order. Do not jump to URLs or schemas before modeling resources.
- Identify the domain nouns (resources). List the core entities and their relationships. Resources are nouns, not verbs. Group them into collections and members.
- Define the resource representation. For each resource, decide its fields, types, which are read-only/required/nullable, and identifiers (prefer opaque string IDs over leaking DB primary keys).
- Map operations to HTTP methods (REST) or queries/mutations (GraphQL). Use the safe/idempotent matrix in
references/http-semantics.md. Avoid verbs in REST paths; model actions as sub-resources or status transitions. - Design the URL structure / schema. Lowercase, kebab-or-snake consistent, plural collections, nested only one level deep. See naming rules below.
- Choose pagination, filtering, and sorting. Default to cursor pagination for large/changing datasets. Standardize query parameters.
- Define the error contract. Adopt RFC 9457 Problem Details. One consistent shape across all endpoints. See
references/error-design.md. - Add reliability semantics. Idempotency keys for unsafe-but-retryable POSTs, ETag/If-Match for optimistic concurrency, conditional requests for caching.
- Specify cross-cutting concerns. AuthN/AuthZ, rate limiting + headers, versioning strategy, deprecation policy, CORS.
- Write the contract. Produce OpenAPI 3.1 (REST) or SDL (GraphQL) as the source of truth. Use
templates/openapi-3.1-template.yamlortemplates/graphql-schema-template.graphql. - Validate. Run
scripts/lint_openapi.pyon the OpenAPI file to catch common design smells before review.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/orders-api.md 3.0 KB
- references/error-design.md 3.1 KB
- references/graphql-checklist.md 2.2 KB
- references/http-semantics.md 3.8 KB
- references/idempotency.md 2.8 KB
- references/rest-checklist.md 3.1 KB
- references/versioning.md 2.4 KB
- scripts/lint_openapi.py 6.1 KB runs code
- templates/graphql-schema-template.graphql 2.0 KB
- templates/openapi-3.1-template.yaml 6.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 98 lines · 125 tokens per session scan A 884733b1bd4f
api-designer is a skill published in the GitHub repository JayRHa/AgentSkills (4 stars, last pushed 1mo ago), licensed MIT. It adds 125 tokens to every session and 2,123 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
reverse-engineering-tools
Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks, protected binaries, or debugging security-sensitive game…
curating-bgs-modpack
Use when planning or building the whole Bethesda modpack incrementally — batch strategy, rollback point, naming convention, separator discipline, attribution, and declaring 风格 before adding mods. Triggers - "build a modpack", "plan the pack", "batch strategy", "rollback point", "naming convention", "declare 风格"…
evaluating-bgs-mods
Use when deciding whether a mod belongs in a modpack — judging mod quality, fit, risk, and pack-value BEFORE download/install. Triggers - "should I add this mod", "is this mod good", "评估这个mod", "这个mod值得装吗", "is this mod worth it", "this mod looks too good to be true", "compare these mods", "does this mod fit my pack".…
writing-modpack-changelog
Use when cutting a modpack release. Creates /docs/release-changelog.md if absent; appends a new version section with grouped changes. Triggers - 'cut a release', 'release notes', 'changelog', 'v1.2.3 changes', 'what changed since last version'.
agent-newbie-guide
Skill "agent-newbie-guide" from hashgraph-online/awesome-codex-plugins, covering codex 新手引导, 🚫 新手术语过滤（绝对禁止）, 统一行为规范（内嵌）, 📍 阶段位置 and 启动自检.
review-work
Quality gate: verify each acceptance criterion of a completed task/work unit, run quality checks, and create follow-up tasks for gaps. Use before merging or to audit delivered work. Invoked as /agiflow:review-work . Uses getworkunit, gettask, updatetask, createtask, createtaskcomment.