What is backend-runtime-check?

A handoff checklist for checking backend changes against a running service rather than only against mocked tests. It uses real requests, logs, database effects, and migrations.

Use it before handing off a changed endpoint, background job, or database migration to exercise the service and record evidence.

It catches wiring, JSON, SQL, migration, and middleware problems before another team tests the change.

backend-runtime-check — Skill for Claude Code and Codex by makifbaysal

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/makifbaysal/tasktrooper

agentmods

npx agentmods add skills/makifbaysal/tasktrooper/backend-runtime-check

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/makifbaysal/tasktrooper/backend-runtime-check/github.svg)](https://agentmods.dev/skills/makifbaysal/tasktrooper/backend-runtime-check)

Your own site

<a href="https://agentmods.dev/skills/makifbaysal/tasktrooper/backend-runtime-check"><img src="https://agentmods.dev/badge/skills/makifbaysal/tasktrooper/backend-runtime-check/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/makifbaysal/tasktrooper/backend-runtime-check"><img src="https://agentmods.dev/badge/skills/makifbaysal/tasktrooper/backend-runtime-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 40 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,091 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00040	$0.01091
Opus 5.5	$0.00016	$0.00436
Sonnet 5.5	$0.00008	$0.00218
Haiku 4.5	$0.00004	$0.00109

Measured 5d ago against content hash 6817218faee1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

backend-runtime-check scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

4. **Send requests.** `curl -sS -i -X POST localhost:18080/... -H 'content-type: application/json' -d '...'` — see the request matrix below for which ones.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

4. **Send requests.** `curl -sS -i -X POST localhost:18080/... -H 'content-type: application/json' -d '...'` — see the request matrix below for which ones.

catalog/agents/backend-developer/skills/backend-runtime-check/SKILL.md · 65 lines

How it starts

The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Exercise the Service Before Hand-off

Overview

Unit tests run against mocks. They prove your logic, not that the route is wired behind the right middleware, the JSON field names match the contract, the SQL actually runs, or the migration applies cleanly. The first time any of that gets checked for real is usually QA — this skill moves that check earlier, into your own run, where it's cheap to fix.

Core principle: before you hand off a change a client or a job can reach, prove it against the running service, once, with evidence in your closing message.

Procedure

Learn how it runs. get_project_brief, README, Makefile, docker-compose, .env.example — don't guess ports or env vars.
Bring up dependencies. docker compose up -d db if the repo has one, or docker run -d --rm --name tt-pg -e POSTGRES_PASSWORD=pg -p 55432:5432 postgres:18; then run the repo's migrate command.
Build a binary, don't go run. run_terminal can send SIGTERM at a timeout, and that can orphan a child process started by go run. Build first:
```
mkdir -p /tmp/tt-<task key> && go build -o /tmp/tt-<task key>/svc$(go env GOEXE) ./cmd/<api>
(PORT=18080 /tmp/tt-<task key>/svc$(go env GOEXE) > /tmp/tt-<task key>/dev.log 2>&1 & echo $! > /tmp/tt-<task key>/svc.pid)
sleep 3; tail -n 30 /tmp/tt-<task key>/dev.log
```
Java: ./mvnw -q -DskipTests package && (java -jar target/quarkus-app/quarkus-run.jar > /tmp/tt-<task key>/dev.log 2>&1 & echo $! > /tmp/tt-<task key>/svc.pid), or the Spring Boot fat jar equivalent.
Send requests. curl -sS -i -X POST localhost:18080/... -H 'content-type: application/json' -d '...' — see the request matrix below for which ones.
Scan the log. grep -nE 'ERROR|panic|Exception|level":"error' /tmp/tt-<task key>/dev.log — a 200 with a stack trace behind it is a finding, not a pass.
Check the side effect. psql "$DATABASE_URL" -c 'select ...' — confirm the row actually landed the way the response claimed.
Stop the process. kill $(cat /tmp/tt-<task key>/svc.pid) on macOS/Linux; on Windows stop it by its port (see Host machine) — never leave it running at the end of the run.

Read the full file on GitHub · 65 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago Changed 6817218faee1
8d ago First seen · 65 lines · 40 tokens per session scan B dd5259a09848

Subscribe to this mod's changes

backend-runtime-check is a skill published in the GitHub repository makifbaysal/tasktrooper (113 stars, last pushed yesterday), licensed Apache-2.0. It adds 40 tokens to every session and 1,091 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.

Autonomous Agents Backend and APIs Claude Code Testing agentic-ai ai-agents claude coding-agents quality

code-review

Use this skill to systematically review code changes for correctness, security, performance, maintainability, and test coverage. Activates after implementation, before merging, or when asked to review a pull request or code change. Produces a structured review report with findings categorized by severity.

karthikrshet/aiskills · 56 tokens

tdd

Use this skill to practice test-driven development — writing tests before implementation, using tests to drive design, and validating implementation against pre-written tests. Activates when implementing new functionality, refactoring code, or fixing bugs where regression coverage is needed.

karthikrshet/aiskills · 53 tokens

backend-runtime-check