Skills api-designer
📦
api-designer
Content revision r3 Safe ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access
Design Production-Ready APIs
Inconsistent API contracts create integration errors and costly migrations. This skill guides REST, GraphQL, OpenAPI, authentication, versioning, validation, and documentation decisions.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "api-designer" from https://skillstore.io/skills/autumnsgrove-api-designer.md and its manifest at https://skillstore.io/api/skills/autumnsgrove-api-designer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "api-designer". Design user and order REST resources for a commerce service.
Expected outcome:
- Resource map covering users, orders, order items, and payment references.
- Endpoint table with methods, permissions, status codes, pagination, and idempotency requirements.
- Consistent validation and error response guidance.
Using "api-designer". Review an OpenAPI contract for authentication and consistency.
Expected outcome:
- Findings grouped by authentication, naming, schemas, errors, and compatibility.
- Recommended OAuth scopes, reusable security definitions, and response corrections.
- A prioritized list of contract changes and unresolved assumptions.
Using "api-designer". Plan the migration from a legacy user endpoint to version two.
Expected outcome:
- A compatibility plan with parallel versions and an adapter period.
- Deprecation milestones, client communication, telemetry, and removal criteria.
- Rollback conditions and tests for old and new clients.
Security Audit
Safev14 • 7/23/2026 Open versioned report
All 146 static findings are false positives caused by Markdown syntax, example URLs and credentials, validation text, and intended local file output. The Python helper does not spawn commands, read environment variables, access certificate files, or make network requests. No prompt injection, exfiltration intent, or other semantic security issue was found.
9
Files scanned
5,100
Lines analyzed
0
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (50)
examples/openapi_spec.yaml:760 scripts/api_helper.py:230 scripts/api_helper.py:238 scripts/api_helper.py:262 scripts/api_helper.py:270 scripts/api_helper.py:277 SKILL.md:65-81 SKILL.md:81-88 SKILL.md:88 SKILL.md:89 SKILL.md:92-95 SKILL.md:95-105 SKILL.md:105-124 SKILL.md:124 SKILL.md:125 SKILL.md:128-140 SKILL.md:140-147 SKILL.md:147-162 SKILL.md:162-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-179 SKILL.md:179-190 SKILL.md:190-193 SKILL.md:193-205 SKILL.md:205-207 SKILL.md:207-215 SKILL.md:215-234 SKILL.md:234-240 SKILL.md:240-258 SKILL.md:258-264 SKILL.md:264-281 SKILL.md:281-283 SKILL.md:283-290 SKILL.md:290-296 SKILL.md:296-299 SKILL.md:299-306 SKILL.md:306-309 SKILL.md:309-313 SKILL.md:313-318 SKILL.md:318-329 SKILL.md:329-332 SKILL.md:332-334
🌐 Network access (37)
examples/openapi_spec.yaml:20 examples/openapi_spec.yaml:24 examples/openapi_spec.yaml:27 examples/openapi_spec.yaml:29 examples/openapi_spec.yaml:31 references/authentication.md:189 references/authentication.md:190 references/authentication.md:244 references/authentication.md:245 references/common-patterns.md:296 references/common-patterns.md:173 references/common-patterns.md:183 references/common-patterns.md:193 references/common-patterns.md:509 references/rest_best_practices.md:376 references/rest_best_practices.md:491 references/rest_best_practices.md:648 references/rest_best_practices.md:658 references/rest_best_practices.md:659 references/rest_best_practices.md:711 references/rest_best_practices.md:720 references/rest_best_practices.md:785 references/rest_best_practices.md:786 references/rest_best_practices.md:787 references/rest_best_practices.md:788 references/versioning-strategies.md:20 references/versioning-strategies.md:21 references/versioning-strategies.md:22 references/versioning-strategies.md:311 references/versioning-strategies.md:316 references/versioning-strategies.md:331 references/versioning-strategies.md:380 references/versioning-strategies.md:381 scripts/api_helper.py:306 scripts/api_helper.py:307 SKILL.md:399 SKILL.md:513
🔑 Env variables (4)
📁 Filesystem access (2)
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/autumnsgrove-api-designer/audits/14?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/autumnsgrove-api-designer?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/autumnsgrove-api-designer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/autumnsgrove-api-designer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/autumnsgrove-api-designer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AutumnsGrove. (2026). api-designer security audit report (audit version 14) [Author version unspecified]. Skillstore. https://skillstore.io/skills/autumnsgrove-api-designer/audits/14BibTeX citation
@techreport{autumnsgrove-autumnsgrove-api-designer-2026,
author = {AutumnsGrove},
title = {api-designer security audit report (audit version 14)},
institution = {Skillstore},
year = {2026},
number = {14},
url = {https://skillstore.io/skills/autumnsgrove-api-designer/audits/14},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-designer security audit report (audit version 14)"
version: "unspecified"
type: report
authors:
- name: "AutumnsGrove"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/autumnsgrove-api-designer/audits/14"
identifiers:
- type: other
value: "skillstore:autumnsgrove-api-designer:audit:14"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 82
Architecture
85
Maintainability
87
Content
71
Community
78
Spec Compliance
What You Can Build
Design a Service Contract
Define resources, operations, schemas, errors, pagination, and authentication for a new backend service.
Establish API Governance
Standardize naming, versioning, deprecation, compatibility, and security rules across multiple services.
Improve Developer Documentation
Turn an OpenAPI specification into structured Markdown and identify missing examples or descriptions.
Try These Prompts
Design a Basic REST API
Design a REST API for [product]. List resources, endpoints, methods, request fields, response fields, status codes, and a consistent error format.
Review an Existing API
Review this API design: [paste design]. Identify inconsistent naming, HTTP semantics, pagination, error handling, and security gaps. Propose specific corrections.
Create an OpenAPI Contract
Create an OpenAPI 3.0 contract for [service]. Include authentication, reusable schemas, validation constraints, pagination, errors, and realistic examples. State assumptions.
Plan a Version Migration
Plan a backward-compatible migration from [current API] to [target API]. Define versioning, deprecation headers, compatibility layers, rollout stages, monitoring, and client communication.
Best Practices
- Provide domain rules, actors, permissions, data sensitivity, and expected traffic before requesting a design.
- Ask for explicit assumptions and review them before adopting the generated contract.
- Validate generated specifications with production tooling and test representative client workflows.
Avoid
- Do not expose credentials, private keys, production tokens, or confidential payloads in prompts.
- Do not treat example URLs, identifiers, or security settings as production defaults.
- Do not release breaking changes without a versioning, deprecation, migration, and monitoring plan.
Frequently Asked Questions
Does this skill support REST and GraphQL?
Yes. It covers REST resource design and GraphQL types, queries, mutations, inputs, and pagination.
Can it create OpenAPI specifications?
It can design OpenAPI 3.0 content. The helper generates a sample, validates basic structure, and creates Markdown documentation.
Does the helper make network requests?
No. It reads local specification files and writes requested output files.
Will it implement my API?
No. It designs contracts and guidance, but does not build handlers, resolvers, storage, or deployment infrastructure.
How complete is the included validator?
It checks selected required fields, paths, methods, responses, schemas, and security definitions. Use a dedicated validator for full conformance.
What information should I provide?
Provide domain entities, operations, actors, permissions, data sensitivity, scale expectations, compatibility constraints, and preferred output format.
Developer Details
Author
AutumnsGroveLicense
MIT
Skillstore revision
r3
Version notice
The author did not declare a version.
Ref
89edfdc710d0846129dcee6a929477b04f08052c
Maintenance freshness
7/24/2026
Usage
34 downloads · 267 views
File structure