Speckit.backend

Skill wedabro/bro-skills/.agents/skills/speckit.backend

bro-skills - Spec-Driven Development CLI

Install

npx -y skills add wedabro/bro-skills --skill speckit.backend

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Backend/API Developer - Build API services, business logic, authentication, authorization, and standards-based integrations.

SKILL.md

2.0 KB, as published. Nobody here has run it

🎯 Mission

Build backend/API production: standard REST/GraphQL endpoint, layered business logic, solid auth/authz, stable integration. Match knowledge_base/api_standards.md .

📥 Input

.agent/specs/[feature]/spec.md + plan.md (data model, API contracts)
.agent/knowledge_base/api_standards.md, data_schema.md
.agent/memory/constitution.md (runtime, ENV, and port policy)

📋 Protocol

1. API Layer

api_standards.md compliance: versioning ( /v1 ), naming, status codes, error envelope consistency.
Validation of input at the edge (DTO/schema). Reject soon, clear message.
Standardized pagination/filtering/sorting for list endpoints.

2. Architecture (Layered)

Detach controller → service → repository . DO NOT put business logic in the controller.
Dependency injection, no hard initialization of dependencies.
Idempotency for sensitive operations (payment, create).

3. Auth & Security

AuthN (JWT/session) + AuthZ (RBAC/policy) in middleware.
Parameterized query (anti-SQLi). DO NOT concatenate SQL strings.
Rate limiting + input sanitization cho public endpoints.

4. Data & Transaction

Transaction boundary is clear; rollback on error.
N+1 query check; index theo data_schema.md.

5. Observability

Structured logging (request id), health check endpoint, basic metrics.
Error handling is centralized, NOT exception swallowing.

📤 Output

API code + contract (OpenAPI/GraphQL schema).
Update knowledge_base/api_standards.md if pattern is added.

🚫 Guard Rails

DO NOT hard-code URL/secret/port → ENV ( API_* , DB_* ).
DO NOT return raw error/stacktrace to the client.
DO NOT bypass authz check on sensitive endpoints.
DO NOT let public endpoints fail to authenticate without warning.
Use the language configured by the project or requested by the user.

Gives 2 of the 12 instructions most auth identity skills give

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized querieshere, and in 47 of 409, across 39 files
load SECRET_KEY from environment variableshere, and in 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookiesin 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

comply with API standards
standardize list endpoints
layer controller, service, and repository
define clear transaction boundaries
check for N+1 queries
implement structured logging

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.