What is api-contract-review?

A review workflow for checking whether CloudBase cloud API wrappers, MCP tools, generated action details, and documentation still match the documented API contract.

Use it to audit CloudBase integrations, separate confirmed contract bugs from guesses, and verify that API changes have suitable tests and documentation.

It helps catch incorrect action names, parameters, capitalization, request shapes, and missing contract tests before stale behavior ships.

api-contract-review — Skill by TencentCloudBase

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/tencentcloudbase/cloudbase-ai-toolkit/api-contract-review

Any agent

npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill api-contract-review

Clone the repo

git clone --depth 1 https://github.com/TencentCloudBase/CloudBase-AI-Toolkit

Made for: Claude Code, Codex.

Or install cloudbase-ai-toolkit, the plugin that ships this one along with the rest of its 39 skills, 3 commands, 2 MCP servers, 2 plugins.

Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,267 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00054	$0.01267
Opus 5	$0.00027	$0.00633
Sonnet 5	$0.00011	$0.00253
Haiku 4.5	$0.00005	$0.00127

Measured 3d ago against content hash 13b00588a9db, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

api-contract-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/api-contract-review/SKILL.md · 138 lines

How it starts

The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.

API Contract Review

Review CloudBase cloud API integrations for contract correctness before the repository ships stale, guessed, or undocumented behavior.

When to use this skill

Use this skill when you need to:

Review CloudBase cloud API wrappers or MCP tools for outdated or incorrect action or interface names
Check whether request parameters, casing, nesting, or request shape drifted away from documentation
Audit whether a CloudBase API change is backed by the right contract tests
Run a periodic API correctness review before opening corrective PRs
Separate confirmed contract bugs from vague "maybe this API changed" speculation

Do NOT use for:

General code smell review without a contract-correctness question
Regular SDK usage that does not touch CloudBase control-plane or documented API contracts
Guessing undocumented behavior from naming intuition
Shipping a fix when the documentation still does not support the proposed action or parameter shape

Workflow

Phase 1 — Scope and evidence

Read references/review-checklist.md first.
Identify the review surface:
- mcp/src/tools/*
- related tests
- generated action metadata
- user-facing docs that describe the same API behavior
Record the exact action, interface, or payload being reviewed before forming conclusions.

Phase 2 — Documentation-first verification

Before judging any implementation, you must read the relevant official documentation first.

Required entry points:

CloudBase API overview: https://cloud.tencent.com/document/product/876/34809
Dependency-resource API docs when relevant: https://cloud.tencent.com/document/product/876/34808
CloudBase Manager SDK docs before approving direct Cloud API usage: https://docs.cloudbase.net/api-reference/manager/node/introduction

Verify the documented contract, not your memory:

exact action or interface name
required and optional parameters
parameter casing and nesting
request shape
auth model and caller context
response shape, task model, and documented limits

Read the full file on GitHub · 138 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/review-checklist.md 1.7 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 138 lines · 54 tokens per session scan A 13b00588a9db

Subscribe to this mod's changes

api-contract-review is a skill published in the GitHub repository TencentCloudBase/CloudBase-AI-Toolkit (1,087 stars, last pushed 2d ago), licensed MIT. It adds 54 tokens to every session and 1,267 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Code review agent-skills ai aicoding claude-code cloudbase cursor

human-approval

Request human approval before performing a SAFETY-CRITICAL, IRREVERSIBLE, or SCOPE-EXPANDING action — submit a structured context (action, scope, risk, consequence) plus options, then STOP the current turn. The platform redispatches the agent after the human decides. NEVER use for routine deliverables (writing docs /…

Prismer-AI/PrismerCloud · 168 tokens

firebase-analytics

Use when logging analytics events, setting user properties, configuring default event parameters, building funnels, or adding screen-view tracking.

evanca/flutter-ai-rules · 28 tokens

firebase-remote-config

Use when implementing feature flags, running A/B tests, setting parameter defaults, fetching/activating config, or enabling real-time config updates.

evanca/flutter-ai-rules · 33 tokens

git-master

MUST USE whenever a task needs a commit or git-history investigation. Covers atomic commits, staging, commit-message style, rebase, squash, fixup/autosquash, blame, bisect, reflog, git log -S/-G, and questions like who wrote this or when was this added. Do not use for ordinary code edits unless the user asks for git…

code-yeongyu/oh-my-openagent · 81 tokens

setup

This skill should be used when user encounters "Azure MCP error", "Azure authentication failed", "az login required", "Azure CLI not found", or needs help configuring Azure MCP integration.

fcakyon/claude-codex-settings · 39 tokens

mongodb-natural-language-querying

Generate read-only MongoDB queries (find) or aggregation pipelines using natural language, with collection schema context and sample documents. Use this skill whenever the user asks to write, create, or generate MongoDB queries, wants to filter/query/aggregate data in MongoDB, asks "how do I query...", needs help with…

mongodb/agent-skills · 162 tokens