Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add the-open-agent/oss-skills --skill api-designgit clone --depth 1 https://github.com/the-open-agent/oss-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/the-open-agent/oss-skills/api-design)<a href="https://agentmods.dev/skills/the-open-agent/oss-skills/api-design"><img src="https://agentmods.dev/badge/skills/the-open-agent/oss-skills/api-design.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.02347 |
| Opus 5 | $0.00053 | $0.01174 |
| Sonnet 5 | $0.00021 | $0.00469 |
| Haiku 4.5 | $0.00011 | $0.00235 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Design
The difference between an internal API and a public one is that you can fix an internal one on a Tuesday. Every public symbol is a promise you will be asked to keep for years.
The core discipline: export less
Everything exported is a maintenance obligation. Everything private is free.
- Start with the smallest surface that solves the problem. Adding an export later is a minor release; removing one is a major release plus a migration guide.
- Explicit export lists.
export { a, b } from './x'— neverexport *, which silently promotes every future internal symbol into your public API. - Mark internals unmistakably.
_private,internal/directories,#[doc(hidden)],@internal. Users will still reach in; the marking is what makes it their problem when it breaks. - Audit before 1.0. List every exported symbol and justify each one out loud. In most codebases this deletes 30–50% of the surface, and none of the deletions are ever missed.
# TypeScript: see the real public surface
npx api-extractor run --local
# Python: what does `from pkg import *` actually give?
python -c "import pkg; print([s for s in dir(pkg) if not s.startswith('_')])"
# Rust
cargo public-api
# Go
go list -f '{{.Name}}: {{.GoFiles}}' ./...
Wire a public-API snapshot into CI. A diff in that snapshot forces a conscious decision at review time instead of an accidental breaking change at release time.
Function signatures
Arguments. More than three positional parameters, or any boolean parameter, means
switch to an options object / keyword arguments. connect(host, 5432, true, false) is
unreadable at the call site and impossible to extend without breaking.
// Bad — unextendable, unreadable at call site
connect('db.local', 5432, true, false, 30)
// Good — self-documenting, additive
connect({ host: 'db.local', port: 5432, tls: true, timeoutMs: 30_000 })
Defaults. Every option gets a sensible default. The zero-config path must work for the common case; configuration is for the exceptions. If your quickstart needs six options set, the defaults are wrong.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 198 lines · 107 tokens per session scan A d02847bbda0b
api-design is a skill published in the GitHub repository the-open-agent/oss-skills (5 stars, last pushed 29d ago), licensed Apache-2.0. It adds 107 tokens to every session and 2,347 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cn-check
Install and run the Continue CLI (cn) to execute AI agent checks on local code changes. Use when asked to "run checks", "lint with AI", "review my changes with cn", or set up Continue CI locally.
convex-reviewer
Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.
mindos
MindOS: local knowledge assistant & shared KB. Keeps decisions, notes, SOPs, debugging lessons, research findings, preferences across sessions/agents. Core: save notes, search KB, organize files, run workflows, review, append CSV, hand off context, distill lessons. NOT for app source or paths outside KB. Triggers…
superlint
This skill describes the mandatory standard operating procedure for using our internal SuperLint tool. Use this when tasks require fixing code quality issues according to corporate standards.
api-design-reviewer
Use when reviewing API designs for consistency, usability, versioning, error semantics, security, backward compatibility, and developer experience before implementation or release.
pr-review
Review a GitHub pull request and post one formal review — advance the existing discussion and give precision-first, high-signal feedback. Judgement on the diff, not a build gate — CI validates that it builds, and a targeted probe is allowed as evidence. Use when asked to review a PR or on a cron PR scan.