api-error-checklisted

Statically checks a web API's error-handling surface for conformance against the project's own declared error contract — uniform error-body shape, populated required fields, a dynamically-generated error/correlation id, correct HTTP status-code semantics, and no internal-detail leakage (stack traces, raw driver messages, rendered queries, secrets). Detects the web framework (FastAPI / Flask / Django REST / Express / NestJS / Spring and comparable) and the error contract from project signals, falling back to RFC 9457 defaults only when none is declared. Invoke after adding or changing endpoints, before a release, or as a pre-PR error-handling gate; also on requests like "check the API error handling", "audit error responses", or equivalent German-language requests. Read-only: reports and recommends, never edits handler code. Don't use for the whole-codebase security audit (code-security-reviewer) or general code review (review skill).
nolte/claude-shared · ★ 0 · API & Backend · score 76

Install: claude install-skill nolte/claude-shared

# API Error-Handling Conformance Check Statically check a web API's error-handling surface against the project's own error contract, and produce a single severity-sorted report. This skill reports and recommends; it never edits handler code. Implements `spec/project/api-error-handling/` — the spec defines the conformance dimensions, severity mapping, and discovery rules. This skill binds those rules to the on-disk procedure. When the spec and this skill disagree, the spec wins. ## German trigger phrases This skill also triggers on equivalent German-language requests, including: - "API-Fehlerbehandlung prüfen" - "Fehlerantworten auditieren" - "Leaken die Endpunkte interne Details?" ## User-language policy Detect the user's language from their message and respond in it. The report itself uses English section headings (so downstream tooling can parse it reliably); prose around the report is localised. ## Inputs - **Target**: an explicit handler/router file or directory path, or a requirement/feature identifier the project uses to group endpoints (for example `REQ-013`). Default is the current working directory's API source root. - **Severity floor**: defaults to `info` (report every finding). Caller may narrow to `warning` or `critical` to de-noise a release gate. ## Operations ### 1. Resolve the target and discover project conventions - If the target is a path, read it directly. If it is a requirement/feature identifier, resolve it to the owning handler files throug