# Review Backend APIs for Production Readiness

Backend reviews often miss API contract issues, unsafe error handling, and tangled route logic. This skill guides Claude, Codex, and Claude Code through focused backend review checklists.

## Install

```bash
npx skillstore add danielpodolsky/backend-fundamentals
```

## Metadata

- Status: approved
- Slug: danielpodolsky-backend-fundamentals
- Skillstore revision: r1
- Version status: missing
- Tree hash: 9419c5b0f946cc2aef60a6bc8577c85b835f353fafa5e9d6b563a67f08da6391
- Author: DanielPodolsky
- GitHub username: DanielPodolsky
- License: MIT
- Repository: https://github.com/DanielPodolsky/mentor-spec/tree/main/.claude/skills/fundamentals/backend
- Ref: 34f316ba14ef36c7a620fc09f2676d2429997a77
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/danielpodolsky-backend-fundamentals
- Manifest: https://skillstore.pages.dev/api/skills/danielpodolsky-backend-fundamentals/manifest

## Capabilities

- Reviews API routes for REST naming, HTTP verbs, versioning, and status code choices.
- Checks separation between routes, controllers, services, models, and repositories.
- Prompts review of input validation, authentication, authorization, and rate limiting.
- Highlights backend anti-patterns including fat routes, direct request body use, leaked error details, and missing pagination.
- Provides HTTP status code and architecture layer references for code review conversations.

## Use Cases

- Mentor Backend Reviews: Guide junior engineers through API design, validation, error handling, and architecture questions during review.
- Audit Express Endpoints: Check Express or Node.js routes for REST conventions, middleware placement, status codes, and route bloat.
- Plan Service Refactors: Identify misplaced business logic, data access leaks, and controller responsibilities before restructuring a backend module.

## Prompt Templates

### Review a Route

```
Review this backend route with the backend fundamentals checklist. Focus on REST naming, status codes, validation, and error handling.
```

### Check Layer Boundaries

```
Review these backend files for separation of concerns. Identify route, controller, service, repository, and model boundary issues.
```

### Review Backend Security

```
Review this API flow for validation, authentication, authorization, rate limiting, and leaked internal errors. Ask Socratic questions for each concern.
```

### Design a Refactor Plan

```
Assess this backend module and propose a staged refactor plan. Preserve behavior while improving layers, testability, and API contracts.
```

## Limitations

- Does not run tests, execute code, or inspect behavior outside provided files.
- Focuses on review guidance, not framework-specific implementation details.
- Examples are Node.js oriented, so other stacks may need adaptation.
- Does not replace a full security assessment or threat model.

## Best Practices

- Share relevant route, middleware, service, and model files together for boundary review.
- Ask for concrete review findings with severity, rationale, and suggested next steps.
- Include expected API behavior and user roles when reviewing authorization paths.

## Anti Patterns

- Asking for a complete rewrite before identifying specific backend review risks.
- Reviewing isolated snippets without route context, middleware chain, or data access details.
- Treating the checklist as a replacement for tests, threat modeling, or production observability.

## Security Audit

- Audited at: 2026-07-06T10:36:03.237\+00:00
- Summary: All 12 static findings are false positives caused by Markdown inline code, code fences, JavaScript template literals, or an architecture diagram in SKILL.md. No evidence found for prompt injection, data exfiltration intent, command execution instructions, or unsafe operational behavior. The SQL snippet is a labeled anti-pattern used to teach validation and parameterized access.

## Stats

- Views: 241
- Downloads: 13
- Favorites: 0
- Popularity score: 0