Menu
Build or change API behavior in api/ using Express routers, middleware, CustomError, model instances, and camelCase JSON responses.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Review backend and frontend template code for real defects, boundary violations, security gaps, and missing tests. Auto-invoke for code reviews or bug investigations. Triggers: "bug review", "review code", "find bugs", "security audit", "check defects".
Implement OOP API entities in api/model/ using the shared Model base class and relation helper.
Maintain the api/helpers/postgres.js SQL boundary, CRUD helper surface, and safe filter conventions.
Update project-local agent guidance when architecture, workflows, commands, or conventions change. Auto-invoke when user or agent output indicates a reusable workflow or durable rule. Triggers: "update docs", "update skill", "create new skill", "update agent instructions", "document recurring pattern", "capture reusable workflow".
Add accurate JSDoc and focused comments when changing template code. Auto-invoke during code writing or refactoring. Triggers: "document code", "jsdoc", "code comments", "add comments", "explain logic".
Keep human docs, agent guidance, and touched code comments aligned with the real web/api implementation, compose workflow, and validation commands. Auto-invoke when auditing docs or after major architectural changes. Triggers: "audit docs", "check context", "documentation maintenance", "audit documentation", "verify docs".
| name | api-development |
| description | Build or change API behavior in api/ using Express routers, middleware, CustomError, model instances, and camelCase JSON responses. |
Use this skill for changes under api/.
api/app.js.api/route/ and export an Express router.api/helpers/postgres.js directly.CustomError(status, message, code, data) for expected request or domain failures, providing a machine-readable error code string (e.g. NAME_REQUIRED, INVALID_CREDENTIALS).api/middleware/error.js include { error: true, status, type, code, message, data }.toJSON()) use the entity's 14-character public_id for id and publicId.GET /items/:id) resolve records using getBy('public_id') (or new Model({ public_id: req.params.id }).getBy('public_id')).GET, POST, PUT, and DELETE for ordinary REST resources.Cookies.set(res, SESSION_COOKIE_NAME, token) for setting HttpOnly session cookies on authentication endpoints.auth() middleware (api/middleware/auth.js), which handles HttpOnly session cookies and Bearer tokens.GoogleAuthHelper.verifyToken(idToken) (api/helpers/google-auth.js) and issue signed session JWTs with signJwt (api/helpers/jwt.js).Use unit tests for isolated route validation and integration tests for database-backed behavior.