Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add psenger/ai-agent-skills --skill review-api-designgit clone --depth 1 https://github.com/psenger/ai-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/psenger/ai-agent-skills/review-api-design)<a href="https://agentmods.dev/skills/psenger/ai-agent-skills/review-api-design"><img src="https://agentmods.dev/badge/skills/psenger/ai-agent-skills/review-api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/psenger/ai-agent-skills/review-api-design"><img src="https://agentmods.dev/badge/skills/psenger/ai-agent-skills/review-api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01799 |
| Opus 5 | $0.00058 | $0.00899 |
| Sonnet 5 | $0.00023 | $0.00360 |
| Haiku 4.5 | $0.00012 | $0.00180 |
Grade A, and why
review-api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
REST API Design Review
Review the following API design: $ARGUMENTS
If no design was provided above, ask for an API design to review (OpenAPI spec, endpoint list, or verbal description).
This skill vets API designs before implementation — during the planning phase. It reviews contracts, endpoint structures, and architectural decisions against proven best practices. Reviews are constructive but thorough — challenging the design, flagging gaps, and surfacing trade-offs.
When This Skill Activates
- An OpenAPI/Swagger specification (YAML or JSON)
- A list of endpoints with descriptions
- A verbal description of an API being planned
- A diagram or document describing API architecture
- Questions about how to design specific API aspects
Workflow
Step 1: Understand the Context
Before reviewing, gather context. Ask about anything not already clear:
- Domain — What business domain does this API serve?
- Consumers — Who will call this API? (frontend, mobile, third-party, internal services)
- Scale — Expected traffic volume and growth trajectory
- Auth requirements — What authentication/authorization is planned?
- Deployment — Where will this run? (cloud provider, on-prem, serverless)
- Existing systems — Does this integrate with legacy systems or other APIs?
- Team — How experienced is the team with REST API development?
Do not ask all of these mechanically. Read what was already provided and only ask what's missing and relevant. If given an OpenAPI spec, extract most of this from the spec itself.
When the input is a vague verbal description (no concrete endpoints, no spec, no endpoint list — just "I'm building an API for X"), asking clarifying questions is mandatory before producing any review. A vague description does not contain enough information to assign severity levels or make specific recommendations. Ask 3-5 targeted questions, wait for answers, then proceed to Step 2. Do not produce a full review from a verbal description alone.
What ships with it
21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .skillignore 12 B
- .workspace/evals/evals.json 2.9 KB
- .workspace/iteration-1/eval-1/with_skill/outputs/review.md 16 KB
- .workspace/iteration-1/eval-1/without_skill/outputs/review.md 7.4 KB
- .workspace/iteration-1/eval-2/with_skill/outputs/review.md 15 KB
- .workspace/iteration-1/eval-2/without_skill/outputs/review.md 7.1 KB
- .workspace/iteration-1/eval-3/with_skill/outputs/review.md 20 KB
- .workspace/iteration-1/eval-3/without_skill/outputs/review.md 16 KB
- .workspace/iteration-1/grading.md 7.0 KB
- .workspace/trigger-eval.json 2.4 KB
- references/api-communication-patterns.md 16 KB
- references/api-gateways.md 5.5 KB
- references/design-extensibility.md 9.5 KB
- references/design-principles.md 9.0 KB
- references/human-aspect.md 2.7 KB
- references/payloads-errors.md 5.5 KB
- references/pragmatism.md 2.5 KB
- references/resilience.md 11 KB
- references/security-auth.md 15 KB
- references/security-defense.md 15 KB
- references/sources.md 6.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 162 lines · 116 tokens per session scan A d68e70ad4fee
review-api-design is a skill published in the GitHub repository psenger/ai-agent-skills (10 stars, last pushed 3mo ago), licensed MIT. It adds 116 tokens to every session and 1,799 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sdd-apply
Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.
design-patterns
Agents should invoke this skill when choosing patterns, designing traits/interfaces/components, deciding abstraction boundaries, evaluating dependency injection/callbacks, or comparing implementation approaches in Rust, TypeScript/React, or Django/Python.
mcp-builder
Guide the creation of high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when the user wants to build an MCP server to integrate an external API or service, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
argot-suggest-rules
Turn a convention argot has already discovered into a scripted custom rule. Runs argot conventions, surfaces the repo's mined placement conventions (where a kind of code lives — "validation in schema files", "DB access only in migrations", "business logic in the service layer, not views") and internal-API vocabulary…
mold
Turn a high-leverage design decision into an approved spec through grounded dialogue. Use it when a leverage trigger fires (auth, irreversible effects, concurrency, contracts, destructive ops, a new slice, a cross-slice dependency, an invariant gap) or when the user asks for a spec or design. Typical phrases include…
boundary-validation
This skill should be used when the user asks to "validate input", "parse request data", "handle form data", "add Zod schema", "sanitize user input", or creates API endpoints and system boundaries. Provides parse-don't-validate patterns with schema validation for type-safe boundary enforcement and hostile input defense.