メニュー
API design conventions for projects with API surfaces. Covers REST and GraphQL standards, versioning, error formats, pagination, documentation as code, and backwards compatibility. Applied when designing, implementing, or reviewing APIs.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | mav-bp-api-design |
| description | API design conventions for projects with API surfaces. Covers REST and GraphQL standards, versioning, error formats, pagination, documentation as code, and backwards compatibility. Applied when designing, implementing, or reviewing APIs. |
| user-invocable | false |
| disable-model-invocation | true |
Ensure all APIs (REST, GraphQL, or any other surface) are consistent, predictable, documented as code, and backwards compatible by default.
Deprecation/Sunset headers, log usage, communicate a timeline, remove only at zero usage.code (a string constant, not the HTTP status), user-safe message, optional field-level details, and a correlationId. Never expose stack traces, internal paths, or implementation details.cursor + limit params, documented maximum); offset-based only for small, stable datasets needing random page access.429, include X-RateLimit-* and Retry-After headers, apply per-tier limits, document them.PUT/DELETE idempotent by design; POST operations that must be idempotent (e.g., payments) require an Idempotency-Key header with cached-response replay and a TTL. Document which endpoints support it.mav-bp-application-security.Check for docs/maverick/skills/api-design/SKILL.md. If present, read it and follow it — it wins on specifics (library, config, conventions). If missing, proceed with these standards and note the gap in your summary.
When reviewing code, flag these patterns:
| Pattern | Issue | Fix |
|---|---|---|
Verbs in URL paths (/getUser, /createOrder) | REST anti-pattern | Use nouns with HTTP methods |
200 OK returned for error conditions | Incorrect status code | Use appropriate 4xx/5xx codes |
| No input validation on request handlers | Security and data integrity risk | Validate at the boundary |
| Stack traces or internal paths in error responses | Information disclosure | Use standard error format, log details server-side |
| Inconsistent field naming (camelCase vs snake_case) | Breaks predictability | Pick one convention and apply everywhere |
| Missing pagination on list endpoints | Performance risk at scale | Add cursor or offset pagination |
| Breaking change without version bump | Backwards compatibility violation | Bump version or make the change additive |
| No rate limiting on public endpoints | Abuse and availability risk | Implement rate limiting with appropriate headers |
| No idempotency on payment/financial endpoints | Duplicate processing risk | Require idempotency keys |
| API docs maintained separately from code | Documentation drift | Generate docs from source (OpenAPI, introspection) |
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.