Speckit.backend

Skill wedabro/bro-skills/.agent/skills/speckit.backend

bro-skills - Spec-Driven Development CLI

Install

npx -y skills add wedabro/bro-skills --skill speckit.backend

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Backend/API Developer - Build API services, business logic, authentication, authorization, and standards-based integrations.

SKILL.md

2.0 KB, as published. Nobody here has run it

🎯 Mission

Build backend/API production: standard REST/GraphQL endpoint, layered business logic, solid auth/authz, stable integration. Match knowledge_base/api_standards.md .

📥 Input

.agent/specs/[feature]/spec.md + plan.md (data model, API contracts)
.agent/knowledge_base/api_standards.md, data_schema.md
.agent/memory/constitution.md (runtime, ENV, and port policy)

📋 Protocol

1. API Layer

api_standards.md compliance: versioning ( /v1 ), naming, status codes, error envelope consistency.
Validation of input at the edge (DTO/schema). Reject soon, clear message.
Standardized pagination/filtering/sorting for list endpoints.

2. Architecture (Layered)

Detach controller → service → repository . DO NOT put business logic in the controller.
Dependency injection, no hard initialization of dependencies.
Idempotency for sensitive operations (payment, create).

3. Auth & Security

AuthN (JWT/session) + AuthZ (RBAC/policy) in middleware.
Parameterized query (anti-SQLi). DO NOT concatenate SQL strings.
Rate limiting + input sanitization cho public endpoints.

4. Data & Transaction

Transaction boundary is clear; rollback on error.
N+1 query check; index theo data_schema.md.

5. Observability

Structured logging (request id), health check endpoint, basic metrics.
Error handling is centralized, NOT exception swallowing.

📤 Output

API code + contract (OpenAPI/GraphQL schema).
Update knowledge_base/api_standards.md if pattern is added.

🚫 Guard Rails

DO NOT hard-code URL/secret/port → ENV ( API_* , DB_* ).
DO NOT return raw error/stacktrace to the client.
DO NOT bypass authz check on sensitive endpoints.
DO NOT let public endpoints fail to authenticate without warning.
Use the language configured by the project or requested by the user.