Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/seed-forge/harness-ai-kit/devlab-contract-web-servernpx skills add seed-forge/harness-ai-kit --skill devlab-contract-web-servergit clone --depth 1 https://github.com/seed-forge/harness-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-contract-web-server)<a href="https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-contract-web-server"><img src="https://agentmods.dev/badge/skills/seed-forge/harness-ai-kit/devlab-contract-web-server.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.01431 |
| Opus 5 | $0.00060 | $0.00715 |
| Sonnet 5 | $0.00024 | $0.00286 |
| Haiku 4.5 | $0.00012 | $0.00143 |
Grade A, and why
devlab-contract-web-server scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
devlab-contract-web-server
用途
为大型前后端分离项目建立并守护"契约层"：前端与服务端就接口结构、字段类型、序列化形态、错误码、配置边界达成显式契约，避免靠口头约定导致的联调返工与线上事故。
定位：devlab-contract-* 技能簇的首个成员，处于 devlab-srv-*（服务端）与 devlab-web-*（前端）之间的交界地带。
适用场景
- 前后端分离、多人协作、接口频繁演进的中大型项目。
- 联调阶段反复出现"字段对不上/类型不匹配/序列化不一致"。
- 需要把接口从"约定俗成"升级为"可校验契约"。
不适用场景
- 单体、无独立前端的项目。
- 一次性脚本/内部工具（契约成本大于收益）。
输入
- 现有接口清单/文档（OpenAPI、代码里的 DTO/schema 等）。
- 前后端技术栈与序列化方式。
- 已发生的契约类问题（可选）。
输出
- 契约规范文档（字段命名/类型/可空性/枚举/时间格式约定）。
- 契约校验建议（schema 校验、契约测试落点）。
- 联调防错清单。
核心规范
1. 字段类型契约
- 每个字段显式定义：类型、可空性、枚举取值、单位、时间/数字格式。
- 类型一致性：同一字段跨前后端类型必须一致（典型坑：
id服务端 int、前端传 string → 解析失败）。 - 数组元素结构显式声明（典型坑：
groupBy期望字符串数组，前端传对象数组[{field: x}]）。
2. 序列化契约
- 统一约定 null/空值/缺省字段的语义（省略 vs null vs 空串）。
- 显式约定大整数/精度/日期的序列化（避免 JS number 精度、时区歧义）。
- MIME/编码显式声明（响应体类型不靠猜）。
3. 错误契约
- 统一错误码 + 错误体结构；区分业务错误与系统错误。
- 前端按错误码分支，不靠 message 文本判断。
4. 配置分层与"不过度"
- 配置分层：与某子系统强相关的配置归其命名空间（如 LLM 配置与排序配置分离），避免大杂烩。
- "既不过度也不缺失"：每个真实可变项可配，不为不存在的需求预埋开关。
- 敏感配置（密钥）不进前端，前端只按构建工具约定前缀暴露非敏感变量。
5. 契约校验落点
- 服务端入参用 schema 校验（类型/必填/枚举），错误要可读（不是裸 500）。
- 有条件时用 OpenAPI/JSON Schema 作单一事实源，前后端各自生成/校验。
- 契约变更 → 契约测试先失败 → 双方同步 → 再合入（破坏性变更同步调用侧）。
工作流
Phase 1: 盘点接口与现存契约问题
Phase 2: 定义契约规范（字段/序列化/错误/配置）
Phase 3: 落地校验（schema 校验 + 契约测试落点）
Phase 4: 防错清单 + 变更流程（破坏性变更同步调用侧）
联调防错清单
- 关键字段类型前后端一致（尤其 id/数字/布尔/枚举）。
- 数组元素结构一致（对象数组 vs 标量数组）。
- null/缺省/空值语义已约定。
- 时间/时区/数字精度格式已约定。
- 错误码结构统一，前端按码分支。
- 敏感配置未进前端；环境变量前缀正确。
- 契约变更走"契约测试先行 + 同步调用侧"。
与其他 devlab-* Skill 的关系
| Skill | 关系 | 说明 |
|---|---|---|
devlab-srv-* |
邻接（服务端侧） | 服务端接口实现与入参校验 |
devlab-web-* |
邻接（前端侧） | 前端接口调用与类型定义 |
devlab-contract-*（簇） |
同簇 | 未来可扩展 contract-service-service、contract-event 等 |
devlab-ai-agent-engineering |
调用方 | AI 应用前后端交互契约引用本技能 |
约束
- 契约是双方共识，任何一方单改必须走"契约测试先行 + 同步对侧"。
- 不硬编码具体 URL/端口/凭据；示例字段不含真实隐私数据。
- 规范要可校验，避免只写文档不落校验。
推荐触发方式
用 devlab-contract-web-server 帮我把这几个接口的前后端契约固化并加校验
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 106 lines · 119 tokens per session scan A 71684451d442
devlab-contract-web-server is a skill published in the GitHub repository seed-forge/harness-ai-kit (21 stars, last pushed 3d ago), licensed Apache-2.0. It adds 119 tokens to every session and 1,431 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
auth-web-cloudbase
CloudBase Web Authentication Quick Guide for frontend integration after auth-tool has already been checked. Provides concise and practical Web authentication solutions with multiple login methods and complete user management.
browse-and-evaluate
Use when exploring the ai-agent-skills catalog to find, compare, and evaluate skills before installing. Always use --fields to limit output size and --dry-run before committing to an install.
loop-engineering
Shared loop-engineering reference for COG skills - the agent loop, deterministic verifiers, termination conditions, in-loop context management, and named patterns. Invoke when designing or debugging a skill that iterates (search-verify-retry, scan-until-dry, fetch-retry-gate).
telnyx-messaging-hosted-curl
Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.
render-airdrop-carousel
Assemble a viral iOS "AirDrop" notification-carousel video ad (≈6–8s, 9:16) from a brand line plus 6–16 real product photos — a native AirDrop share-sheet card ("Brand would like to share a · Decline / Accept") springs up and its preview window CYCLES through the products, landing on a range/lineup payoff with an…
render-3d-product-showcase
Assemble a premium 3D product-showcase ad from a config — four beat clips (an orbiting hero rotation, a macro push-in, a physics reveal, a typographic close) normalized to the brand-color canvas, hard-concatenated in order, closed on a deterministic Playwright brand end card, and mixed under one instrumental bed at…