Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jdanigo/hydraia/api-designnpx skills add jdanigo/hydraia --skill api-designgit clone --depth 1 https://github.com/jdanigo/hydraiaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jdanigo/hydraia/api-design)<a href="https://agentmods.dev/skills/jdanigo/hydraia/api-design"><img src="https://agentmods.dev/badge/skills/jdanigo/hydraia/api-design.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.00636 |
| Opus 5 | $0.00031 | $0.00318 |
| Sonnet 5 | $0.00012 | $0.00127 |
| Haiku 4.5 | $0.00006 | $0.00064 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Design — the contract IS the spec
Contract-first: write the machine-readable contract, review it like code, implement to it. Never code-first with docs generated after.
Style selection (decision table — pick ONE, record an ADR)
| Use case | Style |
|---|---|
| Public/partner API, resource-shaped, broad client base | REST + OpenAPI 3.1 |
| Product frontend with many views over the same graph, client-driven field selection | GraphQL + SDL |
| Internal service-to-service, low latency, strong typing across languages | gRPC + proto3 |
Ambiguous → one question to the human with the trade-off, never two styles at once without justification.
REST rules (OpenAPI 3.1)
- Contract file in-repo:
api/openapi.yaml(or the repo's existing convention). Reviewed in the same PR discipline as code. - Resources are plural nouns; no verbs in paths (
POST /orders, not/createOrder). Consistent casing (pick kebab or snake for paths, camel for JSON; record it). - Methods carry semantics: GET safe, PUT/DELETE idempotent, POST for creation/actions. Idempotency keys for payment-shaped POSTs.
- Errors: RFC 9457
application/problem+json— every operation lists its error responses in the contract. No bare 500s as design. - Pagination: cursor-based by default; offset only with a written justification (deep-page cost). Filtering/sorting as documented query params.
- Versioning: choose URL prefix (
/v1) or header once, record the ADR, never mix. - AuthN/authZ in the contract: securitySchemes + per-operation scopes/roles. An operation without a declared auth requirement is a finding, not an oversight.
GraphQL rules (SDL)
- Schema file in-repo. Nullability is design: non-null by intent, not by default.
- Typed errors (union results or errors interface) over throwing strings.
- Pagination: Relay-style connections. N+1: name the dataloader plan at design time.
- Depth/complexity limits stated in the contract docs (abuse surface).
gRPC rules (proto3)
- Proto files versioned in-repo; packages versioned (
v1). - Field numbers are forever: reserve removed numbers, never reuse.
- Deadlines/timeouts and idempotency noted per RPC; streaming only with a stated reason.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 46 lines · 0 tokens per session scan A fd11db1d17b4
api-design is a skill published in the GitHub repository jdanigo/hydraia (8 stars, last pushed 14d ago), licensed MIT. It adds 62 tokens to every session and 636 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
frame-macos-notification
拟真 macOS 通知 banner + app icon + 标题正文, 适合 video overlay / 产品发布预告.
deck-course-module
暖纸背景 + Playfair, 左侧学习目标常驻, 含 MCQ 自测页.
deck-pitch
10 页融资 deck, 白底 + 蓝紫渐变 hero, traction 柱状, $X.XM ask.
argent-tv-interact
Control and inspect TV apps via argent — Apple TV (tvOS), Android TV (leanback), and Amazon Fire TV (Vega). Boot the target, read focus, navigate with the D-pad remote, type, screenshot, and on Vega debug the JS runtime (evaluate, console logs, network inspector). Use when a task targets a TV (runtimeKind "tv", or…
review-offered-task
Review a task that has been offered to you and decide whether to accept or reject it.
company-hiring-intelligence
Reverse-engineer what a company is building by scraping their job postings, careers page, LinkedIn Jobs, and engineering blog using TinyFish web agents. Use whenever a user wants to understand a company's strategic direction from hiring signals, do competitive intelligence, figure out a tech stack from job…