CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

fix-api-contract

Fix API and webhook bugs — wrong status codes, 5xx on bad input, missing validation, broken idempotency, pagination errors, leaked fields, serialization mistakes — at the contract boundary with schema validation and an allow-list serializer. Use for any REST, GraphQL, or webhook defect.

71

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary lean instruction-only skill: terse, dense, and specific, with explicit exit criteria gating the workflow. As an instruction-only skill, the absence of code is appropriate, and its concrete details (status codes, field names, tooling) make it highly actionable. The only gaps are the unspecified contract-diff mechanism and the implicit rather than explicit fix-and-retry loop.

Suggestions

Specify how to perform the contract diff in step 6 (e.g., a tool or command to compare response shapes before and after), and include the Schemathesis invocation in step 7 so both are directly executable.

Add one explicit feedback-loop line such as 'If fuzzing or the contract diff fails, fix and re-run until the exit criteria pass' to make the error-recovery loop explicit rather than implied.

DimensionReasoningScore

Conciseness

Every line is a dense, executable directive ("clamp `limit`, reject negative offsets, stable ordering"; "set state, don't increment it") with zero padding and no explanation of concepts Claude already knows. Lean and efficient; every token earns its place.

5 / 5

Actionability

Guidance is highly concrete — exact status codes ("400/422 with a plain message, never 500"), a specific field ("`event_id`"), "integer cents", and a named tool ("Schemathesis") — but step 6 gives no mechanism for comparing response shapes and step 7 gives no invocation command. Mostly executable with minor gaps; not 5, which would require fully executable, copy-paste-ready guidance covering the common cases with no unspecified mechanisms.

4 / 5

Workflow Clarity

Clear 7-step sequence with explicit validation (step 7 re-runs fuzzing and contract tests) and an Exit criteria gate ("no 5xx and no schema violations, and the contract diff is empty or explicitly approved"). Not 5: the fix-and-retry feedback loop when fuzzing fails is implicit rather than spelled out (e.g., "if fuzzing finds a 5xx, fix and re-run").

4 / 5

Progressive Disclosure

Under 50 lines, well-organized into Procedure and Exit criteria sections, with no external references needed and no bundle files. Per the under-50-lines guideline, well-organized sections alone merit a 5.

5 / 5

Total

18

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that pairs a comprehensive, concrete defect taxonomy with an explicit 'Use for' trigger clause covering REST, GraphQL, and webhook contexts. Voice and tone match the good examples, and it avoids padding entirely. The only weaknesses are a few missing natural synonyms (e.g., 'endpoint', 'error handling') and slight breadth in the 'any defect' trigger phrasing.

DimensionReasoningScore

Specificity

Lists seven concrete defect categories ("wrong status codes, 5xx on bad input, missing validation, broken idempotency, pagination errors, leaked fields, serialization mistakes") plus two named techniques ("schema validation and an allow-list serializer"), giving comprehensive coverage of the API-contract bug domain. Not 4: the anchor-4 example tolerates coverage gaps, but this description has no significant gaps.

5 / 5

Completeness

Explicitly answers both: what ("Fix API and webhook bugs ... at the contract boundary with schema validation and an allow-list serializer") and when ("Use for any REST, GraphQL, or webhook defect") with concrete trigger phrases. Not 4: the 'when' clause is explicit and trigger-specific, not merely present-but-vague.

5 / 5

Trigger Term Quality

Good natural keyword coverage with synonyms ("API", "webhook", "REST", "GraphQL", "status codes", "5xx", "idempotency", "pagination") that users would plausibly say. Not 5: common user phrasings like "endpoint", "HTTP error", or "error handling" are absent.

4 / 5

Distinctiveness Conflict Risk

Clear niche (contract-boundary API defects) with specific triggers, but "Use for any REST, GraphQL, or webhook defect" claims broad territory that could overlap with generic debugging or API-design/performance skills. Not 5: minor overlap risk with closely related skills remains; not 3: the defect list and boundary framing make it far more distinct than a generic 'works with documents' claim.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

itsablabla/qa-bug-agent-skills

Path

skills/fix-api-contract/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.