api-convention SKILL.md skillA
api-convention from univers42/claude-deal-with-the-devil is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add univers42/claude-deal-with-the-devil/api-convention@git:20260930.dc5adefPins git:20260930.dc5adef in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- univers42/claude-deal-with-the-devil
- Path
skills/api-convention/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260930.dc5adef, committed Sep 30, 2026
- Size
- 1,940 bytes
- Repository stars
- 4
- License
- none declared
REST API conventions: resource-oriented and versioned routes, auth and access control on every surface, and one error shape. Use when editing routes, handlers, controllers or router files.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# API Conventions
*REST API conventions — endpoints, auth, access control, errors.*
## Shape
- Resource-oriented, plural-noun paths under a version prefix (`/v1/<resource>`).
- Versioned — never break a shipped contract; add, don't mutate.
- JSON in/out; document every public route in the project's OpenAPI / API spec.
## Auth & access control
- Authenticate every request; resolve the caller's identity from the credential, not from a path `{id}`.
- Authorize per request — scope every read and write to the caller; never trust client-supplied ownership.
- No cross-owner access by construction — derive the owner from the credential, not the request body.
## Errors
- Correct HTTP status: 400 bad input, 401 unauthenticated, 403 denied, 404 not-found, 409 conflict, 429 rate-limit.
- One consistent error envelope; never leak internals (stack traces, SQL, DSNs, file paths) in the body.
- Actionable: what failed, why, what the caller can do.
## Pagination & idempotency
- List endpoints paginate by default (cursor or limit/offset) — never return an unbounded set.
- Mutations are idempotent where the verb implies it (`PUT`/`DELETE`); accept an idempotency key for unsafe retries.
…Read the whole file at its exact version.
How to install
mdr add univers42/claude-deal-with-the-devil/api-convention@sha256:fa62b0e1816b1cdeThe line at the top of this page pins the label git:20260930.dc5adef, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_j6g3xjvouktp2gob)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 30, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1940 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
univers42/claude-deal-with-the-devil · 4 stars · license none declared · pushed 2026-10-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_j6g3xjvouktp2gob GET https://markdownregistry.com/api/v1/resolve?ref=univers42/claude-deal-with-the-devil/api-convention GET https://markdownregistry.com/api/v1/blob/fa62b0e1816b1cdef2a0a78e5e6713dae69e7bc3453ed3406792231d311003b2
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.