api-audit

Files (3)

• SKILL.md
• api-audit.eval.yaml
• eval.yaml

SKILL.md (first lines)

# API Audit Skill

Comprehensive auditing of API designs, contracts, error handling strategies, versioning approaches, and integration patterns.

## USE FOR

- Reviewing API endpoint definitions and route structures
- Validating request and response contracts (OpenAPI, schemas)
- Assessing HTTP status code usage and error handling patterns
- Evaluating API versioning strategies and deprecation practices
- Analyzing documentation completeness and accuracy
- Reviewing authentication and authorization patterns
- Assessing rate limiting, throttling, and quota strategies
- Evaluating consistency across API endpoints
- Identifying breaking changes and integration risks
- Creating structured audit findings with recommendations

## DO NOT USE FOR

- Creating or revising API contracts, including design-focused contract reviews (use `api-design`)
- Implementing API endpoints or request handlers (use `backend-dev`)
- Writing other backend code
- Database schema design
- Frontend development or client implementation
- Infrastructure provisioning
- General code review (use `code-review` skill)

## Audit Checklist

- **Endpoint Design**: Naming conventions, HTTP verbs, parameter placement
- **Contracts**: Request/response schemas, type definitions, examples
- **Error Handling**: Status codes, error responses, failure scenarios
- **Versioning**: Strategy, deprecation policy, migration path
- **Documentation**: Completeness, accuracy, usability
- **Security**: Authentication, authorization, data protection
- **Performance**: Caching headers, pagination, filtering
- **Consistency**: Patterns, naming, response structure uniformity
- **Integration**: Backwards compatibility, changelog, client guidance

## Related Skills

- `api-design` — Designing API contracts and conducting design-focused contract reviews
- `backend-dev` — Implementing API endpoints, request handlers, and backend services
- `backend-audit` — Reviewing backend implementation quality
- `api-security` — Security-focused API assessment
- `contract-testing` — Contract testing and verification

From ivegamsft/basecoat, MIT.

More from ivegamsft/basecoat