Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LerianStudio/ring --skill designing-api-contractsgit clone --depth 1 https://github.com/LerianStudio/ringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lerianstudio/ring/designing-api-contracts)<a href="https://agentmods.dev/skills/lerianstudio/ring/designing-api-contracts"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/designing-api-contracts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lerianstudio/ring/designing-api-contracts"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/designing-api-contracts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 114 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 116 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.01476 |
| Opus 5 | $0.00057 | $0.00738 |
| Sonnet 5 | $0.00023 | $0.00295 |
| Haiku 4.5 | $0.00011 | $0.00148 |
Grade A, and why
ring:designing-api-contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Contract Design — Producing the OpenAPI Spec
When to use
- TRD passed Gate 3 validation
- System exposes APIs (internal or external) that components or clients consume
- Large Track workflow (2+ day features)
Skip when
- Small Track workflow → skip to ring:writing-plans
- No API surface (batch job, library, internal worker) → skip to Data Model
- TRD not validated → complete Gate 3 first
Sequence
Runs before: ring:designing-data-model Runs after: ring:writing-trds
The deliverable is a REAL, machine-consumable OpenAPI 3.1 spec — not markdown tables. Implementation agents generate handlers, clients, and tests directly from this file. If it doesn't lint, the gate doesn't pass.
Phase 0: API Standards Discovery (MANDATORY)
Check if organizational naming standards exist. See shared-patterns/standards-discovery.md for the complete workflow.
AskUserQuestion: "Do you have a data dictionary or API field naming standards to reference?"
- "No — Use industry best practices"
- "Yes — URL to document"
- "Yes — File path"
If standards provided: WebFetch or read the document and extract:
- Field naming convention (camelCase vs snake_case)
- Standard field names across APIs (createdAt, updatedAt, isActive)
- Data type formats (dates, IDs, amounts)
- Validation patterns (email, phone)
- Standard error codes
- Pagination fields
Save to docs/pre-dev/{feature}/api-standards-ref.md.
If no standards: Use Lerian/industry defaults and record them in api-standards-ref.md:
- Field naming: camelCase
- IDs: UUID v4
- Timestamps: ISO 8601 UTC
- Pagination:
items,page,limit,next_cursor,prev_cursor
Mandatory Workflow
| Phase | Activities |
|---|---|
| 1. Surface Discovery | From TRD: identify every API-exposing component; list resources and operations; map auth requirements per surface |
| 2. Spec Authoring | Write openapi.yaml: info, servers, tags, paths with full operations, components (schemas, parameters, responses, securitySchemes); apply naming from api-standards-ref.md |
| 3. Validation | Lint the spec; run the Gate 4 checklist |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 143 lines · 114 tokens per session scan A be4aa683964f
ring:designing-api-contracts is a skill published in the GitHub repository LerianStudio/ring (211 stars, last pushed 19d ago), licensed Apache-2.0. It adds 114 tokens to every session and 1,476 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ds-backend
Backend architecture — API design, database schema, authentication, data pipelines. Use when designing or reviewing a backend, REST/GraphQL APIs, data models, auth flows, or ingest/ETL pipelines.
execution/backend-executor
Internal: Backend Executor. Implements API routes, services, business logic, auth. Read spec and segment. Write evidence on completion.
execution/integration-executor
Internal: Integration Executor. Wires components together, connects external APIs, handles plumbing. Write evidence on completion.
sdd-apply
Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.
memstack-development-api-designer
Use this skill when the user says 'design API', 'API endpoints', 'REST API', 'API designer', 'route structure', 'API architecture', or is designing RESTful API routes, request/response schemas, and endpoint organization. Do NOT use for API security audits or database design.
memstack-security-api-audit
Use this skill when the user says 'audit API', 'check API security', 'API routes security', 'endpoint audit', 'check my routes', or needs to verify API route protection. Reviews API endpoints for authentication, authorization, and input validation gaps. Do NOT use for frontend security headers or dependency scanning.