api-patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited api-patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reason about API design from first principles. The goal is judgment for your situation, not a template to paste.
These notes are split into focused files. Open only the one that maps to the question in front of you instead of reading everything at once. The table below is your index.
| File | Covers | Open it when |
|---|---|---|
api-style.md | Picking REST vs GraphQL vs tRPC | Deciding the paradigm |
rest.md | Resource names, verbs, status codes | Laying out a REST surface |
response.md | Payload shape, errors, paging | Shaping what you return |
graphql.md | Schema modeling, fit, hardening | Weighing GraphQL |
trpc.md | Typed TS client/server | Full-stack TypeScript work |
versioning.md | URI / header / query schemes | Planning for change |
auth.md | Tokens, sessions, OAuth, keys | Picking how callers prove identity |
rate-limiting.md | Quotas and throttling | Shielding the service |
documentation.md | OpenAPI and reference docs | Writing the docs |
security-testing.md | OWASP API risks, authz checks | Reviewing for security |
| If you also need | Reach for |
|---|---|
| To actually build the endpoints | @[skills/nodejs-best-practices] |
| To model the underlying data | @[skills/database-design] |
| A deeper security pass | @[skills/vulnerability-scanner] |
Run through these before committing to a design:
Stop doing this:
/fetchUsers)Do this instead:
| Script | What it does | How to run |
|---|---|---|
scripts/api_validator.py | Scans endpoints and specs for gaps | python scripts/api_validator.py <project_path> |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.