Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Morningstar202604/awesome-skillkit --skill api-design-reviewergit clone --depth 1 https://github.com/Morningstar202604/awesome-skillkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/morningstar202604/awesome-skillkit/api-design-reviewer)<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/api-design-reviewer"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/api-design-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/api-design-reviewer"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/api-design-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00176 | $0.03487 |
| Opus 5.5 | $0.00070 | $0.01395 |
| Sonnet 5.5 | $0.00035 | $0.00697 |
| Haiku 4.5 | $0.00018 | $0.00349 |
Grade A, and why
api-design-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to api-design-reviewer — 505 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Design Reviewer / API 设计评审（REST / GraphQL）
用三件工具审查 REST API 设计——对 OpenAPI spec 做规范 lint、检测版本间破坏性变更、给整体设计质量打分——然后附上工具输出汇报发现。本 skill 同时供 software-api-designer 自审与 software-reviewer 门禁评审共用：目标是在写代码前把接口契约钉死——资源边界清晰、HTTP/GraphQL 语义正确、错误模型统一、鉴权与版本策略明确，避免实现阶段反复返工。
这是什么
一份可直接照单勾选的接口评审规程 + 三个自动化工具。它不替代架构师的模块划分，只对「对外暴露的契约」做正确性、一致性、安全性把关。REST 与 GraphQL 两套检查项分列，按需取用：工具负责机械可判定项（命名、方法用法、状态码合规、破坏性变更、质量评分），人工清单负责工具查不出的契约语义、鉴权边界与业务正确性。
何时使用
- software-api-designer 写完 OpenAPI / Schema 草稿，准备交接实现前。
- software-reviewer 在门禁阶段看到 PR 改动了路由、Schema、错误码或鉴权逻辑。
- 审查一个新增或修改 API 端点的 PR、审计现有 API 是否可平滑迁到 v2、为团队建立 API 规范。
- 跨团队对齐接口、或评审一份第三方 API 对接方案。
- 不用于：实现 API 端点或生成客户端 SDK。
方法论：评审核心步骤
- 先定资源再定动作：列出本次涉及的实体（资源）、它们之间的关系（1:1 / 1:N / N:M），确认每个资源有明确命名与生命周期。
- REST 检查：用名词复数建模集合，用嵌套表达从属；动作通过 HTTP 方法表达而非塞进 URL。
- GraphQL 检查：核对 Query/Mutation 边界、类型 nullable、输入用
input类型、分页用 connection/edges 或游标。 - 错误模型统一：所有失败返回同一结构（code / message / trace_id / details），不靠 200 包业务错误。
- 鉴权与版本：逐端点标注谁能调、需要什么 scope；破坏性变更走版本号或 deprecation 头。
- 输出评审结论：按 critical / major / minor 分级，每条给「问题—依据—建议改法」；工具裁决（approved / not approved）见下方工作流步骤 4。
输入清单
| 输入 | 必需 | 说明 |
|---|---|---|
| OpenAPI/Swagger spec（JSON） | 是 | 当前版规范文件路径，如 openapi.json；无 spec 时可用 --sample 内置样例 |
| 旧版 spec | 仅破坏性变更检测时 | 与新版对比的旧规范文件路径 |
| 最低通过等级 | 否 | api_scorecard.py --min-grade A|B|C|D|F，默认无门槛 |
| 输出格式 | 否 | --format text|json，CI 场景用 json |
输入缺失时一次性问齐："请提供：① 待审查的 OpenAPI/Swagger JSON 文件路径；② 若要做破坏性变更检测，旧版 spec 路径；③ 最低通过等级（不填默认 B）。"
前置自检
逐条执行，任一失败 → 按修复处置后 STOP：
# 1. Python 3 可用
python3 --version
# 预期：Python 3.8+。
# 2. 三个工具脚本存在
ls scripts/api_linter.py scripts/breaking_change_detector.py scripts/api_scorecard.py
# 预期：三个文件名（在技能目录内执行）。失败→cd 到技能目录后重试；仍缺→STOP 回报。
# 3. spec 文件可读且为合法 JSON
python3 -c "import json,sys; json.load(open('<spec>'))" && echo OK
# 预期：OK。失败→向用户确认正确的 spec 路径/格式，STOP。
工作流
命令在技能目录（skills/api-design-reviewer/）内执行。无现成 spec 时可用随包样例 examples/spec.json（与 --sample 内置样例同源）。
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +66 lines · +76 tokens per session b62eb42eded2
- 1mo ago Changed · -7 tokens per session e11adf1f4871
- 1mo ago Changed · +6 lines 4986d8d7d18b
- 1mo ago Changed · -305 lines · +37 tokens per session 25d5c23c3104
- 1mo ago First seen · 438 lines · 70 tokens per session scan A 9fd31980f784
api-design-reviewer is a skill published in the GitHub repository Morningstar202604/awesome-skillkit (0 stars, last pushed 28d ago), licensed Apache-2.0. It adds 176 tokens to every session and 3,487 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 88% identical to api-design-reviewer, differing in 505 lines, and is treated as a copy.
Other skills, from other repositories
architecture-quality
Keep web applications, APIs and services readable as they grow: choose feature or domain seams, assign state ownership, enforce dependency direction, keep adapters thin, and verify file shape. Use when starting or extending a web app, backend, frontend, API or multi-page product; when a change makes a module hard to…
codebase-design
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
mem0-oss-to-platform
Plan, then execute, a migration of a project from the mem0 open-source / self-hosted SDK (local Memory class) to the mem0 Platform / hosted SDK (MemoryClient). TRIGGER when: the developer wants to move, switch, or migrate mem0 off OSS/self-hosted to the hosted API, e.g. "migrate my mem0 setup to the platform", "switch…
otto-pr-review-loop
Run Polly and OCR on a PR until all findings settle.
ax-go-flow
Use when writing Go code with github.com/ax-llm/ax/packages/go for flows, nodes, program graphs, nested programs, dynamic options, caching, and optimizer components.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.