Wanbinyu
UserCanonical Agent Skills collection for API contract evolution: breaking changes, compatibility, deprecation, idempotency, webhooks, and OpenAPI.
Categories
Indexed Skills (18)
api-changelog
Write a consumer-facing API changelog from OpenAPI or code diffs. Use when shipping API changes, drafting release notes for partners/SDKs, summarizing breaks vs additive changes, or when the user says "/api-changelog", "API changelog", "release notes for the API", or in Chinese "接口变更日志", "API 发布说明", "给调用方写 changelog", "版本更新说明". Prefer pairing with breaking-change-review deltas. Not a git commit message skill and not a marketing blog post.
breaking-change-review
PR-grade breaking change audit for shipped HTTP APIs. Use on PRs touching OpenAPI, public DTOs/handlers, status codes, or auth; on field removals/renames; or when the user asks "is this breaking?", "/api-break", "breaking change review", "can we merge this API change", or in Chinese "破坏性变更", "有没有 break", "能不能合并这个接口", "兼容吗", "字段删了行不行". Requires migration notes or an explicit waiver.
compatibility-matrix
Build a consumer blast-radius matrix for an API change. Use when asking who breaks if a field, endpoint, status code, or auth changes; planning migrations; or "/api-compat", "blast radius", "consumer impact", or in Chinese "谁会挂", "影响面", "兼容矩阵", "调用方影响". This is impact analysis, not API style design.
deprecation-playbook
Dated API deprecation plan with dual-track and consumer communication. Use when sunsetting endpoints or fields, migrating v1 to v2, or when the user says "/api-deprecate", "sunset", "deprecation plan", or in Chinese "弃用计划", "下线接口", "平滑迁移", "双轨运行". Not a same-PR delete checklist.
idempotency-and-retries
Design idempotent mutations and safe retry policies. Use for create/payment/order endpoints, client timeouts, double-submit, Idempotency-Key, "/api-idempotent", "retry-safe", "exactly-once", or in Chinese "幂等", "重试", "重复下单", "防重复提交". Reliability design - not REST resource naming.
secure-api-surface
Product-oriented HTTP API security review (object/function authz, oversharing, mass assignment). Use for public or authenticated APIs, "/api-secure", "BOLA", "BFLA", "IDOR", "API security review", or in Chinese "接口安全", "越权", "水平越权", "垂直越权", "过量数据暴露". Defensive findings only - not red-team exploits or binary audit workflows.
using-api-platform-skills
Route API work to the right API Platform skill. Use when the user mentions APIs, OpenAPI, versioning, breaking changes, deprecation, webhooks, idempotency, contract tests, ship-check, or is unsure which skill to load. Also when they say "/api-ship-check", "which API skill", "api platform", or in Chinese "接口审查", "兼容性", "破坏性变更", "弃用", "幂等", "Webhook", "变更日志", "该用哪个 skill". Do NOT use for pure REST naming/style (plural nouns only).
consumer-driven-contract
Capture consumer expectations and turn them into provider CI gates (CDC / Pact-style). Use for multi-client APIs, contract tests, "/api-cdc", "consumer contract", "Pact", or in Chinese "消费者契约", "契约测试", "Pact". Prefer minimal consumer assertions over cloning the entire OpenAPI into a test.
webhook-design
Design signed, retry-safe outbound webhooks. Use for callbacks, partner event posts, "/api-webhook", "event delivery", "signed webhooks", or in Chinese "Webhook 设计", "回调签名", "事件推送". Focus on event identity, HMAC, at-least-once delivery - not generic REST CRUD style.
agent-tool-eval
Define a minimal evaluation set for agent tool use. Use when measuring if tools or prompts improved, regression after schema changes, or Chinese "tool 评测", "agent 回归", "工具调用评估". Lightweight task packs - not a full ML platform.
human-approval-gates
Design human-in-the-loop approval for high-risk agent tools. Use when tools delete data, spend money, send messages externally, change prod, or user says "human approval", "confirm before run", or Chinese "人审", "二次确认", "危险操作确认".
mcp-tool-surface-review
Review an existing MCP server's tool surface for safety and clarity. Use when auditing tools/list output, third-party MCP installs, or Chinese "审查 MCP 工具", "MCP 安全面", "tools/list 审计". Does NOT teach how to scaffold a new MCP server (use official mcp-builder).
skill-vs-mcp-choice
Decide whether to use an Agent Skill, an MCP server, both, or neither. Use when choosing architecture for agent capabilities, or Chinese "skill 还是 MCP", "用 skill 还是 tool", "要不要做 MCP". Decision skill - not an implementation tutorial.
tool-contract-design
Design high-quality agent tool / function-calling / MCP tool contracts. Use when defining tools, writing tool descriptions, JSON schemas for parameters, error shapes, or when the user says "design this tool", "tool schema", "function calling contract", or Chinese "设计 tool", "工具描述", "function schema", "MCP 工具设计". Focus on contract quality for agents - not scaffolding an MCP server project.
tool-idempotency-and-retries
Design idempotent agent tools under retries and timeouts. Use when tools create payments/orders/messages, agents re-call tools after timeout, or user says "tool idempotency", "retry safe tool", or Chinese "工具幂等", "agent 重试", "重复调用".
tool-permission-matrix
Build a permission and blast-radius matrix for agent tools. Use when deciding which tools an agent may call, least privilege, or Chinese "工具权限", "爆炸半径", "最小权限", "tool 白名单". Defensive product control - not penetration testing.
tool-schema-breaking-review
Review breaking changes to agent tool schemas or MCP tool lists. Use on PRs that rename tools/params, change types, add required fields, or change side effects; or when the user says "is this tool change breaking?", "/tool-break", or Chinese "tool 破坏性变更", "改了 schema 能合并吗", "工具改名". Requires migration notes or waiver.
using-ai-surface-skills
Route agent-tool / MCP work to the right AI Surface skill. Use when the user mentions tools, function calling, MCP tools, tool schema, permissions, human approval, agent retries, skill vs MCP, tool eval, or ship-check for tools. Also Chinese: "tool 契约", "MCP 工具面", "人审", "工具权限", "该用哪个 skill", "skill 还是 MCP". Do NOT use for REST OpenAPI evolution (use api-platform-skills) or MCP server scaffolding tutorials.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.