Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcoguillermaz/Tierward --skill api-contract-auditgit clone --depth 1 https://github.com/marcoguillermaz/TierwardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcoguillermaz/tierward/api-contract-audit)<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/api-contract-audit"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/api-contract-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/api-contract-audit"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/api-contract-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.03950 |
| Opus 5.5 | $0.00031 | $0.01580 |
| Sonnet 5.5 | $0.00016 | $0.00790 |
| Haiku 4.5 | $0.00008 | $0.00395 |
Grade A, and why
api-contract-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Read Glob Grep Bash(curl:*) Bash(git:*) How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scope for v1
- Static analysis only. Parses OpenAPI spec files on disk or auto-generated output captured from the running dev server. Does not execute request traffic against endpoints, does not diff runtime responses, does not validate live SLAs.
- Richardson Maturity Model L0-L3. L0 (RPC over HTTP), L1 (resource URLs), L2 (correct HTTP verbs), L3 (HATEOAS). L3 detection is best-effort via response-schema inspection for
_links,rel,href, JSON:API, or HAL patterns. - Spec diff requires git history. Breaking-change detection compares the current spec vs the previous committed version via
git show HEAD~1:<spec-path>. Falls back to no-diff mode when git history is unavailable.
Configuration (adapt before first run)
Replace these placeholders:
[OPENAPI_SPEC_PATH]- location of the OpenAPI spec if committed on disk (e.g.openapi.yaml,api/openapi.json,docs/openapi.yaml). Leave empty to rely on framework auto-gen.[API_SOURCE_PATH]- path to API route handlers (e.g.src/routes/,app/api/,src/controllers/).[DEV_SERVER_URL]- optional, for framework auto-gen fallback (e.g.http://localhost:3000). Leave empty to skip runtime spec fetch.
Step 0 - Target and mode resolution
Parse $ARGUMENTS for target: and mode: tokens.
| Pattern | Meaning |
|---|---|
target:spec:<path> |
Audit a specific spec file (target:spec:api/v2.yaml) |
target:endpoint:<path> |
Audit a single endpoint path (target:endpoint:/users/{id}) |
mode:drift |
Run only AC1-AC3 (endpoint / schema / status drift) |
mode:richardson |
Run only AC8 (Richardson Maturity scoring) |
mode:all / no argument |
Full audit (AC1-AC8). |
STRICT PARSING: derive target ONLY from explicit text in $ARGUMENTS. Do NOT infer from conversation context.
Announce: Running api-contract-audit - scope: [FULL | target: <resolved>] - mode: <resolved>
Step 1 - Spec discovery
Attempt sources in this order. First hit wins.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago Changed · +1 lines d19faef92bc3
- 1mo ago First seen · 280 lines · 78 tokens per session scan A 482c2370d445
api-contract-audit is a skill published in the GitHub repository marcoguillermaz/Tierward (4 stars, last pushed 2d ago), licensed MIT. It adds 78 tokens to every session and 3,950 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codebase-design
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
nodejs
Use when building or operating a plain Node.js / Express 5 backend service: project layout, async correctness, central error middleware, fail-fast config, graceful shutdown on SIGTERM. NOT DI modules/providers/guards (that is nestjs), NOT the type system or tsconfig (that is typescript), NOT REST contract design (that…
github-pr-review
Review one exact GitHub pull-request head from bounded changed-file patches and check evidence, producing source-line findings without posting or claiming tests ran.
schema-check
Check a proposed API or data contract against the current contract, real sample payloads, and a compatibility policy, and gate publication behind a refusable verdict with native digest evidence.
security-audit
Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.
argot-suggest-rules
Turn a convention argot has already discovered into a scripted custom rule. Runs argot conventions, surfaces the repo's mined placement conventions (where a kind of code lives — "validation in schema files", "DB access only in migrations", "business logic in the service layer, not views") and internal-API vocabulary…