Install
$ agentstack add skill-hsienw-ai-agent-engineering-playbook-api-and-interface-design ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
API and Interface Design
Skill Interface
- Name: api-and-interface-design.
- Description: Guide stable API and interface design for public module boundaries, REST or GraphQL endpoints, event contracts, SDK methods, data transfer objects, error envelopes, and cross-team interfaces.
- Parameters: Target interface or contract, expected consumers, request and response shapes, error model, compatibility requirements, versioning expectations, and available schema or test commands.
- Instructions: Use this skill before implementing or changing a public contract. Define the contract first, check backward compatibility, make runtime validation explicit, and verify behavior with contract or schema tests.
Design contracts before implementation. Treat every public shape as something another caller may depend on, even if the current codebase has only one caller.
Process
- Identify consumers, owners, and compatibility expectations.
- Define the request, response, event, error, and versioning contract.
- Separate domain types from transport types.
- Validate untrusted input at runtime.
- Add unknown-field and future-version behavior.
- Write examples for success, validation failure, upstream failure, timeout,
cancellation, and permission denial.
- Verify the implementation against the contract, not against incidental
current behavior.
Design Rules
- Prefer additive changes over renames or removals.
- Use explicit discriminators for unions and state machines.
- Return stable error codes with human-readable messages as secondary detail.
- Avoid making display text, log messages, or exception names part of the
machine contract.
- Do not encode natural-language understanding as keyword maps in an API layer.
- Keep idempotency, pagination, sorting, filtering, and retry semantics explicit.
- Make ownership of defaults clear: server default, client default, or product
default.
Compatibility Review
Before changing an interface, answer:
- Which callers can break?
- Is the change backward compatible?
- Can old and new clients coexist?
- What happens to unknown enum values or event types?
- Is migration or deprecation required?
Verification
Use contract tests or schema tests for:
- Valid request and response.
- Missing required fields.
- Unknown fields.
- Unknown enum or union variants.
- Error envelope shape.
- Version mismatch.
- Timeout and cancellation propagation.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: HsienW
- Source: HsienW/ai-agent-engineering-playbook
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.