See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptWhen completing the execution of an endpoint scaffolding action, what operational telemetry parameters should be recorded?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Logs HTTP method, path, authorization type, and test outcome metadata | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md98 linessingle file
Skill: backend/endpoint-scaffold
Purpose
Add or extend an API endpoint in a way that is:
- validated (request + response shape)
- authorized (authn/authz hooks enforced)
- mapped to a stable error taxonomy
- covered by tests
This skill is the default entry point for backend feature exposure.
Inputs
- Endpoint intent (what it does, who calls it)
- Contract surface (preferred):
- method + path
- request fields + types
- response shape + types
- Authorization expectation:
- public / authenticated / role-based / resource-based
- Error expectations:
- list of expected failure cases
- Repo profile (preferred):
<repo>/REPO_PROFILE.json
Outputs
- New or updated endpoint handler/controller/router entry
- Input validation (schema/types) consistent with repo patterns
- Authorization enforcement consistent with repo patterns
- Error mapping consistent with shared error taxonomy
- Tests:
- unit tests for handler logic and validation OR
- integration tests at route boundary (preferred when available)
Non-goals
- Implementing complex domain rules inside the handler (use
backend/domain-logic-module)
Track record
Benchmark
19 / 22
test cases passed, vs 19 / 22 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedvelcrafting / codex-skills
skills/backend/endpoint-scaffold/SKILL.md
View on GitHub ↗Imported 8/1/2026Version v1