Api review
Skill MuhammedZohaib/patchman/plugins/patchman/skills/api-review
Review an authorized API surface for access control, mass assignment, schema validation, rate limiting, SSRF, error leakage, webhook verification, and unsafe defaults. Use for REST, GraphQL, RPC, and webhook handlers.From its SKILL.md
npx -y skills add MuhammedZohaib/patchman --skill api-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
0.6 KB, 69 tokens by cl100k_base, as published. Nobody here has run it
API Review
Focus
- route, resolver, and webhook authorization
- object scoping and tenant filters
- request validation and mass assignment
- response leakage and error behavior
- rate limiting and abuse resistance
- server-side fetch and callback verification
Output rule
Prioritize externally reachable issues and admin-facing paths first.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most quality gates skills give in 69 tokens
Counted across 1,524 of the 2,830 authors here whose files we hold, read 2026-09-06
- Read full output and check exit codein 45 of 1524, across 40 files
- Verify output confirms the claimin 44 of 1524, across 39 files
- Identify the command that proves the claimin 43 of 1524, across 39 files
- Execute the full verification commandin 36 of 1524, across 30 files
- Produce a verification reportin 34 of 1524, across 18 files
- Review git diff changesin 30 of 1524, across 16 files
- Fix build failures immediatelyin 29 of 1524, across 9 files
- Group findings by severityin 28 of 1524
- State claim only with evidencein 27 of 1524, across 22 files
- Verify regression tests with red-green cyclein 26 of 1524, across 22 files
- Run the full test suitein 26 of 1524, across 25 files
- Run test suite with coveragein 25 of 1524, across 10 files
Said here and by no other author read
- Verify route and resolver authorization
- Check object scoping and tenant filters
- Prevent mass assignment vulnerabilities
- Audit response leakage and error behavior
- Assess rate limiting and abuse resistance
- Verify server-side fetch and callbacks
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.