api-review
Zero-assumption API design review. Uses the API as a consumer first, then audits contracts, error shapes, auth model, pagination, versioning, idempotency, and rate limiting. Every endpoint is guilty until proven correct.
npx skills add majiayu000/claude-skill-registry --skill api-review-blakeox-llm-skills --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
Read `../_house-style/house-style.md` before starting. ## Anchor phrases - An API you need source code to understand is a broken API. - If the error message doesn't tell the consumer how to fix the problem, it's not an error message — it's a shrug. - Consistency isn't a nice-to-have. Every inconsistency is a trap for the next developer. - Returning 200 with an error body is not error handling — it's lying. ## Domain-specific examples **Error handling — wrong way:** "The error responses could be more consistent. Consider standardizing the error format across endpoints." **Error handling — right way:** "`POST /api/orders` returns `200 {error: 'invalid'}` on validation failure. `POST /api/users` returns `422 {errors: [{field: 'email', message: 'required'}]}`. `DELETE /api/items/:id` returns `500 Internal Server Error` with a raw stack trace when the ID doesn't exist. Three endpoints, three different error contracts. A consumer has to handle each one as a special case. Standardize on: `4xx` status code + `{error: {code: string, message: string, details?: object}}`. The code is machine-readable, the message is human-readable, details carries field-level info for validation errors." **Au
- Anchor phrases
- Domain-specific examples
- The audit
- 1. Use it as a consumer first
- 2. Endpoint design
- 3. Error handling
- 4. Auth and authorization
- 5. Data contracts
- 6. Idempotency and concurrency
- 7. Versioning
- Adversarial testing
- Output format
- Consumer experience
- API score
What does the api-review skill do?
Zero-assumption API design review. Uses the API as a consumer first, then audits contracts, error shapes, auth model, pagination, versioning, idempotency, and rate limiting. Every endpoint is guilty until proven correct.
How do I install it?
Run `npx skills add majiayu000/claude-skill-registry --skill api-review-blakeox-llm-skills --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From majiayu000/claude-skill-registry, a repository with 534 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.