CtrlK
BlogDocsLog inGet started
Tessl Logo

api-endpoint-builder

Builds production-ready REST API endpoints with validation, error handling, authentication, and documentation. Follows best practices for security and scalability.

39

Quality

37%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/api-endpoint-builder/SKILL.md

The canonical home for this skill is api-endpoint-builder in sickn33/agentic-awesome-skills

SKILL.md
Quality
Evals
Security

Quality

Content

42%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill provides highly actionable, executable code examples for building REST API endpoints, which is its main strength. However, it is significantly over-verbose, explaining many concepts Claude already knows (HTTP status codes, CRUD conventions, basic security practices) and packing everything into a single monolithic file. The workflow lacks explicit validation checkpoints for verifying the built endpoint works correctly.

Suggestions

Remove content Claude already knows: HTTP status codes, CRUD conventions, basic security principles. Focus only on project-specific patterns and conventions.

Split detailed patterns (pagination, filtering, testing, documentation template) into separate reference files and link to them from a concise overview.

Add an explicit build-and-verify workflow: e.g., 1. Create route → 2. Add validation → 3. Implement handler → 4. Run test suite to verify → 5. Check response format matches convention.

Condense the 'Key Principles' and 'Security Checklist' sections into a single brief checklist, or remove them entirely since they restate standard REST API best practices.

DimensionReasoningScore

Conciseness

Extremely verbose for what it teaches. The HTTP status codes list, security checklist, response format patterns, CRUD conventions, and key principles are all things Claude already knows well. The skill is ~200 lines of content that could be condensed to ~50 lines of project-specific conventions and patterns.

1 / 3

Actionability

All code examples are fully executable JavaScript/Express code that can be directly used. Validation, handler implementation, pagination, filtering, testing, and documentation examples are all concrete and copy-paste ready.

3 / 3

Workflow Clarity

The 'What You'll Build' section lists components to create and the numbered sections (1-3) provide a sequence, but there's no explicit validation workflow or feedback loop for verifying the endpoint works correctly after building it. For a skill involving building production APIs, a verify/test step in the workflow would be expected.

2 / 3

Progressive Disclosure

This is a monolithic wall of content with everything inline. The common patterns, testing, documentation template, pagination, and filtering sections could all be split into separate reference files. The 'Related Skills' section at the end hints at cross-references but the main content is not structured for progressive disclosure.

1 / 3

Total

7

/

12

Passed

Description

32%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear domain (REST APIs) and lists relevant concerns but remains at a high level without specifying concrete actions or frameworks. The biggest weakness is the complete absence of explicit trigger guidance ('Use when...'), which makes it harder for Claude to know when to select this skill. Adding trigger terms and more specific actions would significantly improve selection accuracy.

Suggestions

Add an explicit 'Use when...' clause with trigger phrases like 'Use when the user asks to create API routes, build REST endpoints, set up CRUD operations, or implement API authentication.'

Include more specific concrete actions such as 'generates CRUD endpoints, implements JWT/OAuth authentication, creates OpenAPI/Swagger documentation, adds input validation middleware.'

Add natural keyword variations users might say: 'API route', 'HTTP endpoint', 'web service', 'backend route', 'Express/FastAPI/Flask', 'Swagger', 'OpenAPI'.

DimensionReasoningScore

Specificity

Names the domain (REST API endpoints) and lists some actions/concerns (validation, error handling, authentication, documentation), but these read more like feature categories than concrete actions. It doesn't specify particular operations like 'create CRUD endpoints', 'generate OpenAPI specs', or 'implement JWT auth'.

2 / 3

Completeness

Describes what it does (builds REST API endpoints with various features) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2, and the 'when' is not even implied strongly, so this scores at 1.

1 / 3

Trigger Term Quality

Includes relevant terms like 'REST API', 'endpoints', 'authentication', 'validation' that users might mention, but misses common variations like 'API route', 'HTTP endpoint', 'CRUD', 'middleware', 'Express', 'FastAPI', 'swagger', or file extensions. Coverage of natural user language is incomplete.

2 / 3

Distinctiveness Conflict Risk

The focus on REST API endpoints provides some specificity, but terms like 'validation', 'error handling', 'authentication', and 'security' are broad enough to overlap with general backend development, web framework, or security-focused skills.

2 / 3

Total

7

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

10

/

11

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.