Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sungurerdim/dev-skills/ds-backendnpx skills add sungurerdim/dev-skills --skill ds-backendgit clone --depth 1 https://github.com/sungurerdim/dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sungurerdim/dev-skills/ds-backend)<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-backend"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-backend.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.04502 |
| Opus 5 | $0.00023 | $0.02251 |
| Sonnet 5 | $0.00009 | $0.00900 |
| Haiku 4.5 | $0.00005 | $0.00450 |
Grade A, and why
ds-backend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ds-backend
AI-generated APIs ship with inconsistent naming, missing pagination, no auth strategy, schemas that don't survive first migration, and data pipelines that double-process on retry. Skill designs all four layers correctly from start.
Backend Design — API design, database schema, authentication, and data-pipeline architecture in a single skill.
Completion Evidence — applies to every phase: Report
done/OKonly with the machine-checkable evidence the gates name — the exact command run and its observed output (orfile:linediff). Missing evidence → reportINCOMPLETEplus what is missing. Self-assessment is never evidence. (This band repeats at file end by design — both copies are normative.)
Triggers
User runs /ds-backend, or asks to design/review an API, database schema, auth flow, or data pipeline.
Triggers — INVOKE / DON'T INVOKE
| INVOKE | DON'T INVOKE |
|---|---|
| "design REST API", "design database schema" | "implement the endpoint code" (→ manual / ds-fix) |
| "review OpenAPI spec", "audit DB migration" | "audit OWASP / regulatory security" (→ ds-compliance --security) |
| "design auth flow with OAuth/RBAC" | "deploy auth service to production" (→ ds-deploy) |
| "audit the data pipeline (ingest/ETL/cleaning/retention)" | "optimize one pipeline metric via experiments" (→ ds-tune) |
| "audit API/DB/auth/data-pipeline design conformance" | "generic code quality review (readability, duplication)" (→ ds-review) |
Contract
Dimensions: B5 (API ergonomics), D3, D4, D5, A10 (OpenAPI spec), A9 (conditional ecosystem rules), C1 (secure-by-design, conditional messaging), D10 (admin API + stats), A11 (webhook/export/embed) Framework alignment (advisory): Google SRE PRR (D3, D4), OpenAPI Specification 3.1+ (A10), OWASP ASVS 5.0 (C1).
- Covers five scopes: API design, database design, authentication, data pipelines (ingest → clean → merge → store → serve), and LLM/AI features (conditional — only when the project integrates an LLM/AI provider).
- Generates specifications, not implementation — produces OpenAPI specs, migration files, auth flow diagrams.
- Only well-established patterns — no experimental or untested approaches.
- Minimal liability + maximum privacy + minimum deps: auth prioritizes managed services over DIY; data minimization in every schema (responses expose only required fields); prefer platform-native auth over third-party SDKs.
- Standalone. Uses blueprint profile or
ds/audit/findings.mdwhen available; own analysis when absent. - State-exempt: audit is regenerable from source; applied fixes land in the working tree — git is the record.
- Full accounting enforced: every finding and planned check ends in an explicit disposition (fixed / skipped + reason / only you can do); summary totals balance.
- Pre-existing / out-of-scope errors detected during work are NOT skipped — fixed inline or escalated with concrete blocker.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · -151 lines cfb097098a16
- 6d ago First seen · 349 lines · 45 tokens per session scan A 277d0ff1e5a8
ds-backend is a skill published in the GitHub repository sungurerdim/dev-skills (1 stars, last pushed 3d ago), licensed MIT. It adds 45 tokens to every session and 4,502 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ring:using-lib-systemplane
Using lib-systemplane, the hot-reload runtime-config plane (Postgres LISTEN/NOTIFY or MongoDB change streams), in two modes. Sweep Mode detects DIY config reload (SIGHUP, fsnotify, viper, pgx LISTEN), manual tenant-scoping, hand-built admin CRUD, and v4 residue. Reference Mode catalogs client lifecycle and…
ring:using-outbox
Using the transactional-outbox pattern across lib-streaming (writer) and lib-commons/v5/commons/outbox (repository + relay), in two modes. Sweep Mode detects DIY outbox tables, hand-rolled relay loops, send-and-pray emits, missing WithOutboxTx wrapping, and broker calls inside DB transactions. Reference Mode catalogs…
ring:mapping-service-resources
Mapping a Go service's Service -> Module -> Resource hierarchy for dispatch-layer registration: detects modules and per-module PostgreSQL/MongoDB/RabbitMQ resources, database names, and shared databases, generates MongoDB index migration pairs (.up.json/.down.json), detects existing Postgres migrations, emits an HTML…
performance-audit
Full-stack performance health check across 12 dimensions. Rendering, bundles, assets, API/network, algorithms, memory, database, caching, Web Vitals, backend runtime, concurrency, and framework-specific pathologies. Evidence-based Impact Models with confidence tiers and a prioritized optimization roadmap. Switches…
cqrs-event-sourcing-designer
Designs Command Query Responsibility Segregation (CQRS) and Event Sourcing models with projection rebuilders.
supabase-node
Express/Hono with Supabase and Drizzle ORM.