Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add perniemann/pnCore --skill pn-openapi-designgit clone --depth 1 https://github.com/perniemann/pnCoreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/perniemann/pncore/pn-openapi-design)<a href="https://agentmods.dev/skills/perniemann/pncore/pn-openapi-design"><img src="https://agentmods.dev/badge/skills/perniemann/pncore/pn-openapi-design.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01294 |
| Opus 5 | $0.00026 | $0.00647 |
| Sonnet 5 | $0.00010 | $0.00259 |
| Haiku 4.5 | $0.00005 | $0.00129 |
Grade A, and why
pn-openapi-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenAPI design
When to use
- Designing a new API before writing implementation code (contract-first)
- Generating a spec from existing TypeScript types or Zod schemas
- Producing client SDKs, server stubs, or typed fetch clients from a spec
- Reviewing API design for REST conformance, versioning, or schema consistency
- Setting up interactive API documentation (Swagger UI, Redoc, Scalar)
Core principles
- Spec is the contract — the OpenAPI document is the authoritative source of truth; implementation must conform to it, not the other way around.
- Contract-first, not code-first — write or review the spec before writing handlers; this forces deliberate API design and catches breaking changes early.
- One spec, many consumers — a single spec generates server types, client SDKs, mock servers, and docs; treat it as a build artifact.
- Explicit over implicit — every field in request/response schemas must have a type, description, and
example; avoidadditionalProperties: trueat boundaries. - Version at the URL — use
/api/v1/path prefix; document deprecation notices ininfo.x-deprecatedorx-sunsetheader.
Workflow
Contract-first with Zod (TypeScript)
// 1. Define schema with Zod
import { z } from "zod";
export const CreateUserBody = z.object({
email: z.string().email().describe("User email address"),
name: z.string().min(1).max(100).describe("Display name"),
});
export const UserResponse = z.object({
id: z.string().uuid(),
email: z.string().email(),
name: z.string(),
createdAt: z.string().datetime(),
});
// 2. Register with zod-to-openapi
import { OpenAPIRegistry, OpenApiGeneratorV31 } from "@asteasolutions/zod-to-openapi";
const registry = new OpenAPIRegistry();
registry.registerPath({
method: "post",
path: "/users",
summary: "Create a user",
request: { body: { content: { "application/json": { schema: CreateUserBody } } } },
responses: {
201: { description: "Created", content: { "application/json": { schema: UserResponse } } },
422: { description: "Validation error" },
},
});
// 3. Generate spec
const generator = new OpenApiGeneratorV31(registry.definitions);
const spec = generator.generateDocument({ openapi: "3.1.0", info: { title: "API", version: "1.0.0" } });
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 133 lines · 51 tokens per session scan A 7ab66062d7fe
pn-openapi-design is a skill published in the GitHub repository perniemann/pnCore (0 stars, last pushed today), licensed MIT. It adds 51 tokens to every session and 1,294 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
architecture-patterns
Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or…
event-store-design
Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.
chat-sdk
Build multi-platform chat bots with Chat SDK (chat npm package). Use when developers want to (1) Build a Slack, Teams, Google Chat, Discord, Telegram, GitHub, Linear, or WhatsApp bot, (2) Use Chat SDK to handle mentions, direct messages, subscribed threads, reactions, slash commands, cards, modals, files, or AI…
developing-genkit-tooling
Best practices for authoring Genkit tooling, including CLI commands and MCP server tools. Covers naming conventions, architectural patterns, and consistency guidelines.
stripe-best-practices
Guides Stripe integration decisions across API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatictax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment…
output-dev-workflow-cost
Calculate and display the cost of an Output SDK workflow execution run. Use when checking LLM token costs, API service costs, or total spend for a specific workflow run.