review-api-compat

review-api-compat is a skill for Claude Code, Codex from paultyng/skill-issue. It costs 69 tokens per session (2,185 once invoked), scanned A, original, MIT.

A review guide for checking whether changes to APIs remain compatible with existing users. An API is an interface that lets software systems communicate; the review covers formats such as Protocol Buffers, OpenAPI, and sometimes GraphQL.

In plain words
What is it for?
Use it for breaking-change reviews of protobuf services, OpenAPI definitions, gRPC interfaces, or applicable GraphQL schemas, especially in a pull request or branch diff.
Why use it?
It helps identify changes that could break data exchange, expected behavior, or compatibility rules. It compares a changed API with an earlier version and suggests safer ways to evolve it.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: reads .claude/ paths; mentions subagents.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/paultyng/skill-issue/review-api-compat
Any agent
npx skills add paultyng/skill-issue --skill review-api-compat
Clone the repo
git clone --depth 1 https://github.com/paultyng/skill-issue

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-api-compat

README.md
[![agentmods](https://agentmods.dev/badge/skills/paultyng/skill-issue/review-api-compat.svg)](https://agentmods.dev/skills/paultyng/skill-issue/review-api-compat)
Your own site
<a href="https://agentmods.dev/skills/paultyng/skill-issue/review-api-compat"><img src="https://agentmods.dev/badge/skills/paultyng/skill-issue/review-api-compat.svg" alt="Measured on agentmods" height="20"></a>
Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,185 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00069 $0.02185
Opus 5 $0.00034 $0.01092
Sonnet 5 $0.00014 $0.00437
Haiku 4.5 $0.00007 $0.00218

Measured 5d ago against content hash 255c27ae45da, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

review-api-compat scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directorieslowAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

- Findings must cite probed evidence (`path:line`, grep output, command result), not pattern-matched suspicion. Per `~/.claude/rules/probe-not-assume.md`.

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

skills/review-api-compat/SKILL.md · 167 lines

How it starts

The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.

API Compatibility Review

Structured review of API contract evolution. Detects breaking changes in protobuf services, OpenAPI specs, and (where applicable) GraphQL schemas; classifies them as wire-breaking, behavior-breaking, or policy-breaking; recommends remediation (deprecate-then-remove, version bump, new field).

Out of scope (defer to siblings):

  • Internal Go API surface (function signatures, struct fields) — review-code covers this through SOLID/coupling lens
  • New field validation correctness — review-code / review-security
  • Protobuf style / lint pass-fail (naming, comments, package layout) — review-code runs buf lint

review-api-compat is the diff-aware counterpart: same proto/OpenAPI files, but compared against a base ref to catch what changed.

Workflow

1. Scope and explore

  • Confirm scope with the user: changed files (PR or branch diff — the default), explicit paths to a previous version (e.g. a tag), or full codebase against main.
  • Resolve scope. This skill is fundamentally diff-based:
    • Default: base_ref is main (or the PR base). Compute changed files via git diff --name-only --diff-filter=d <base>...HEAD. Filter to API spec files (see below).
    • PR: use gh pr view <num> --json baseRefName -q .baseRefName for the base, gh pr diff <num> --name-only for changed files.
    • Tag-vs-tag: user supplies <from-tag>...<to-tag>; same diff machinery.
  • If invoked from review-all: receive file_list, has_changes, base_ref, REVIEW_DIR, and pr_url. If has_changes is false, exit early with status "no API spec changes in scope" — there is nothing to compare.

File classification:

  • Protobuf: *.proto files; presence of buf.yaml / buf.gen.yaml / buf.lock confirms a buf workspace.
  • OpenAPI: openapi.yml, openapi.yaml, openapi.json, swagger.yml, swagger.yaml, swagger.json, files with top-level openapi: or swagger: keys.
  • GraphQL (lighter coverage): *.graphql, *.gql, files with schema { ... } or type Query { ... }.

Read the full file on GitHub · 167 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 167 lines · 69 tokens per session scan A 255c27ae45da

Subscribe to this mod's changes

review-api-compat is a skill published in the GitHub repository paultyng/skill-issue (9 stars, last pushed 25d ago), licensed MIT. It adds 69 tokens to every session and 2,185 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.