jwb-api-review SKILL.md skillA
This file is byte-identical to the first copy the registry indexed. Same content hash, so the same checks give both the same grade.
jwb-api-review from chenxiang6663635/job-workbench is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add chenxiang6663635/job-workbench/jwb-api-review@v26.11.0Pins v26.11.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- chenxiang6663635/job-workbench
- Path
skills/jwb-api-review/SKILL.md- Versions recorded
- 6
- Latest version
- v26.11.0, committed Nov 1, 2026
- First version recorded
- Sep 14, 2026
- Size
- 3,709 bytes
- Repository stars
- 16
- License
- MIT
Use when 审查或新增求职工作台后端 API 时，需要按本仓库的错误码契约、状态码语义、两段式写入与安全边界逐条核对。English triggers：API review, REST design, error codes, AIP-193, Zalando API guidelines, two-phase write.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 后端 API 审查清单 外部参考：Google AIP-193（错误）、AIP-158（分页）、Zalando RESTful API Guidelines。 本文件是本仓库的**落地口径**——与既有代码 / 测试冲突时以测试为准。 ## 错误：加法而非替换 - 每个错误必须同时带 `detail`（人读中文原文）与 `error_code`（稳定语义标识）， 用户可见的动态值进 `error_params`； - 命名 `<域>.<语义>`，域与路由对齐（ws / app / status / approval / sys / …）； **同一语义跨路由必须复用同一个 code**； - 前端语言包按 code 出一份文案——改 code 等于破坏前端文案，要当契约对待； - 新增 code 必须同步：两个语言包 + 自动校验（判定脚本会扫全部 ApiError 调用， 校验 code ↔ 文案 ↔ 参数三者的对齐）。 ## 状态码语义（本仓库口径） | 码 | 用于 | |---|---| | 400 | 值层面拒绝：未知键、越界的目标、非法路径 | | 404 | 记录 / 工作区不存在 | | 409 | 冲突：预览后数据变了、乐观并发失败（重试前必须重新读取） | | 422 | 语义校验失败（格式、枚举、终态不回退）；令牌不可用 | | 200 + ok:false | MCP 工具层的「可读拒绝」形态（宿主不当异常处理） | ## 写入：两段式与安全边界 - 写端点先预览（不落盘）→ 一次性令牌 → apply；「要写什么、写到哪里」在令牌里， **不在请求里**——apply 不接收路径 / 载荷参数； - apply 的落盘段必须持资源锁（「读最新 → 重校验 → 写」整段互斥；锁在领域层的 落盘函数里，不在 web 层单点加——CLI / MCP 走同一条路）； - 工作区参数只收相对名，`realpath` 后校验在允许根之内；越界拒绝而非警告； - 路径经安全拼接；错误响应不得泄露未授权位置的信息。 ## 形状与分页 - 资源名用复数、动作由 HTTP 方法承载；响应字段 camelCase；与 CSV 列名对齐的 数据字段保持原样（中文列名不翻，展示层再映射）； - 列表响应：`items` + `total`；大集合设上限并提示「另有 N 条」（返回体不随 数据量膨胀）； - 时间用 ISO 8601 字符串；「未提供」用 null，不用空字符串表达。 ## 审查动作（逐条走） 1. 列出本 PR 的全部写端点：每个都有预览 + 令牌吗？落盘锁在哪一层？ 2. 扫 ApiError 调用：code 是否与既有同义 code 重复定义？参数是否齐全？ …
Read the whole file at its exact version.
How to install
mdr add chenxiang6663635/job-workbench/jwb-api-review@sha256:6d1fd2e552e63c4eThe line at the top of this page pins the label v26.11.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_sneo3tvd4lfp72dd)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 6 versions of this file, between Sep 14, 2026 and Nov 1, 2026, about one every 10 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v26.11.0 latest | 2026-11-01 | c62388d | 3,709 B | A | view · diff |
| v26.10.0 | 2026-10-06 | 0f9cfd8 | 3,709 B | A | view · diff |
| v26.9.0 | 2026-09-25 | 0f7cde1 | 3,708 B | A | view · diff |
| v26.9.15 | 2026-09-23 | f4ef6f2 | 3,709 B | A | view · diff |
| git:20260915.c01fcc9 | 2026-09-15 | c01fcc9 | 3,667 B | A | view · diff |
| git:20260914.894f343 | 2026-09-14 | 894f343 | 3,666 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3709 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
chenxiang6663635/job-workbench · 16 stars · license MIT · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_sneo3tvd4lfp72dd GET https://markdownregistry.com/api/v1/resolve?ref=chenxiang6663635/job-workbench/jwb-api-review GET https://markdownregistry.com/api/v1/blob/6d1fd2e552e63c4efe2c79218f94cb7f4c6aa8494a439490bfac6df282a13238
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from chenxiang6663635/job-workbench
Every file in chenxiang6663635/job-workbench