Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcoguillermaz/Tierward --skill api-designgit clone --depth 1 https://github.com/marcoguillermaz/TierwardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcoguillermaz/tierward/api-design)<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/api-design"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/api-design"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03990 |
| Opus 5.5 | $0.00000 | $0.01596 |
| Sonnet 5.5 | $0.00000 | $0.00798 |
| Haiku 4.5 | $0.00000 | $0.00399 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 251 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scope: endpoint naming, HTTP verbs, resource modeling, response shapes, error codes, field naming, filtering/sorting conventions, pagination, validation, auth/authz boundary clarity.
Out of scope: auth implementation → /security-audit | performance → /perf-audit | DB schema → /skill-db.
Default mode: audit (no code changes). Modes: audit | remediation (propose plan, no changes) | apply (make focused fixes).
All audit findings are persisted to docs/refactoring-backlog.md via the backlog write-once protocol (.claude/rules/backlog-protocol.md).
Configuration
| Placeholder | Description | Example |
|---|---|---|
[SITEMAP_OR_ROUTE_LIST] |
File listing all API routes with method, path, roles, and grouping | docs/sitemap.md, docs/routes.md |
Unfilled behavior: if [SITEMAP_OR_ROUTE_LIST] is not filled, the skill discovers routes by scanning the project's route handler directories. Announce the discovered routes before proceeding.
Status code reference (source: MDN + RFC 9457)
- 400 - malformed request: bad JSON, schema validation failure, missing required field
- 401 - not authenticated (no valid session)
- 403 - authenticated but lacks permission
- 404 - resource not found
- 409 - valid request conflicts with current server state (e.g., approving an already-approved record, duplicate unique value)
- 422 - semantically invalid data that passes schema validation but violates a business rule
- 500 - unexpected server error (no internal details in response)
Step 0 - Target and mode resolution
Parse $ARGUMENTS for target: and mode: tokens.
Target:
| Pattern | Meaning |
|---|---|
target:section:export |
Only export/bulk routes (example) |
target:section:<other> |
Resolve by reading [SITEMAP_OR_ROUTE_LIST] API routes section, filtering for routes whose path or group label contains <other>. Announce the resolved route list before proceeding. |
| No argument | Full audit - ALL API routes across the entire codebase. Maximum depth. |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed b791d5d9827d
- 13d ago Changed · +1 lines c88b5349ff6e
- 1mo ago First seen · 250 lines · 0 tokens per session scan A 837140d75ebb
api-design is a skill published in the GitHub repository marcoguillermaz/Tierward (4 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,990 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
nodejs
Use when building or operating a plain Node.js / Express 5 backend service: project layout, async correctness, central error middleware, fail-fast config, graceful shutdown on SIGTERM. NOT DI modules/providers/guards (that is nestjs), NOT the type system or tsconfig (that is typescript), NOT REST contract design (that…
schema-check
Check a proposed API or data contract against the current contract, real sample payloads, and a compatibility policy, and gate publication behind a refusable verdict with native digest evidence.
phoenix
Quick reference for Phoenix and Elixir development patterns. For comprehensive documentation, see REFERENCE.md.
dotnet-framework
Framework: .NET 8+ with ASP.NET Core For Agent: backend-developer Purpose: Fast lookup of common .NET patterns and conventions.
NestJS Framework
Node.js/TypeScript backend framework with dependency injection and modular architecture.
developing-with-laravel
Laravel framework patterns for PHP applications including Eloquent ORM, migrations, routing, queues, and Blade templates. Use when building Laravel applications or working with Laravel projects.