design-api

design-api is a skill for Claude Code, Codex from kensaurus/cursor-kenji. It costs 63 tokens per session (2,192 once invoked), scanned A, original, MIT.

A planning guide for REST and GraphQL APIs, including resource names, versions, errors, authentication, and pagination. APIs are the interfaces through which software exchanges data.

In plain words
What is it for?
Use it to define API endpoints, response contracts, error formats, and decisions between REST and GraphQL.
Why use it?
It helps prevent inconsistent endpoint names, conflicting response formats, missing access rules, and lists that return too much data at once.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to define API endpoints, response contracts, error formats, and decisions between REST and GraphQL.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/kensaurus/cursor-kenji/design-api
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add kensaurus/cursor-kenji --skill design-api
Clone the repo
git clone --depth 1 https://github.com/kensaurus/cursor-kenji

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for design-api

README.md
[![agentmods](https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/design-api/github.svg)](https://agentmods.dev/skills/kensaurus/cursor-kenji/design-api)
Your own site
<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/design-api"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/design-api/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for design-api

Your own site · 80×15
<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/design-api"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/design-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 63 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,192 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Tool Misuse · line 98
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00063 $0.02192
Opus 5 $0.00032 $0.01096
Sonnet 5 $0.00013 $0.00438
Haiku 4.5 $0.00006 $0.00219

Measured 5d ago against content hash a0847ff47299, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

design-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/design-api/SKILL.md · 383 lines

How it starts

The opening of the file, as written. The whole thing — 383 lines — stays where its author put it; the contents beside it link to each section on GitHub.

API Design Skill

Degree of freedom: MIXED. Resource model, error shape, and REST vs GraphQL [HIGH freedom]; pre-design docs/schema/grep [LOW freedom — run exactly].

Design clean, consistent, and developer-friendly APIs.

How to reason

  1. Survey — existing docs, schema, and similar endpoints
  2. Model — resources, relations, REST vs GraphQL
  3. Contract — paths, statuses, error shape, auth, pagination
  4. Check — naming matches this repo; no duplicate endpoint

Worked example

Survey: orders has user_id; no GET /users/:id/orders; clients use useQuery. Model: order is a nested user resource, not a /getUserOrders RPC. Contract: GET /users/:id/orders{ data, meta }; shared { error: { code, message, details } }. Check: plural kebab-case; list paginated; 401/404/422 only from the status table.

Self-critique before reporting

  • Pre-design stated — docs, schema, and similar endpoints were checked out loud
  • One error shape — every failure uses { error: { code, message, details } }
  • Lists paginate — no unbounded GET /resources
  • Right owner — live 4xx/5xx repro → debug-fe-be-integration; product scope still fuzzy → design-prd

MANDATORY: Pre-Design Checks [LOW freedom — run exactly]

BEFORE designing any API, you MUST:

1. Check Existing API Documentation

http://localhost:8080/api-docs (if backend running)
http://localhost:8080/naming-conventions (naming standards)
src/api/_api-README.md (frontend API layer docs)

2. Verify Database Schema

Use Supabase MCP to understand existing data structure:

-- Check table schema
SELECT column_name, data_type, is_nullable
FROM information_schema.columns WHERE table_name = 'your_table';

-- Check enum values
SELECT enum_range(NULL::your_enum_name);

-- Check foreign keys
SELECT tc.constraint_name, kcu.column_name, ccu.table_name AS foreign_table
FROM information_schema.table_constraints tc
JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name
JOIN information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name
WHERE tc.table_name = 'your_table' AND tc.constraint_type = 'FOREIGN KEY';

Read the full file on GitHub · 383 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 383 lines · 63 tokens per session scan A a0847ff47299

Subscribe to this mod's changes

design-api is a skill published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 10d ago), licensed MIT. It adds 63 tokens to every session and 2,192 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

firebase-auth

Use when setting up auth, managing auth state, implementing email/password or social sign-in, handling auth errors, or managing users.

evanca/flutter-ai-rules · 29 tokens

firebase-cloud-functions

Use when calling callable functions (httpsCallable), passing data to server-side logic, handling function errors/timeouts, configuring regions, or testing with the Emulator Suite.

evanca/flutter-ai-rules · 36 tokens

031-architecture-adr-functional-requirements

Facilitates conversational discovery to create Architectural Decision Records (ADRs) for functional requirements covering CLI, REST/HTTP APIs, or both. Use when the user wants to document command-line or HTTP service architecture, capture functional requirements, create ADRs for CLI or API projects, or design…

jabrena/plinth · 115 tokens

302-frameworks-spring-boot-rest

Use when you need to design, review, or improve REST APIs with Spring Boot — including HTTP methods, resource URIs, status codes, DTOs, versioning, deprecation and sunset headers, content negotiation (JSON and vendor media types), ISO-8601 instants in DTOs, pagination/sorting/filtering, Bean Validation at the…

jabrena/plinth · 177 tokens

305-frameworks-spring-boot-modulith

Use when you need to design, review, or improve modular monoliths with Spring Modulith in Spring Boot applications - including application module package structure, ApplicationModules verification, named interfaces, allowed dependencies, domain events, @ApplicationModuleTest, Scenario-based module tests, generated…

jabrena/plinth · 130 tokens

401-frameworks-quarkus-core

Use when building or reviewing core Quarkus applications with CDI beans and scopes, SmallRye Config and profiles, lifecycle, interceptors and events, virtual threads, and test-friendly design. This should trigger for requests such as Review Java code for Quarkus application structure and CDI; Apply best practices for…

jabrena/plinth · 117 tokens