backendskills skill
Three backend skills for agents that guard access, data and schema migrations: 2 of 150 runs had critical mistakes instead of 25.
- 53 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skills only add instructions for the agent and run nothing themselves.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/backendskillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skills only add instructions for the agent and run nothing themselves.
This is third-party code. Review the repository files before installing.
What it does
backendskills teaches Claude Code, Codex and Cursor to write server code with a safety margin. The set has three skills: `api-endpoint` checks who may call a route, turns bad input into 4xx replies and rate-limits login; `data-integrity` adds locks or conditional updates, UNIQUE constraints and idempotency keys around payments and mailings; `db-migration` runs migrations as expand then contract, with concurrent indexes, lock timeouts and batched backfills. The author tested the skills on 15 tasks in a sample app: on hidden checks such as 20 buyers for 5 items in stock, critical mistakes fell from 25 to 2 across 150 runs. Most of the gap came from two tasks, login rate limiting and renaming a column.
Who it is for. Backend developers who hand code to an AI agent and want to avoid mistakes with auth, money and database schema.
Good fit when
- An agent adds an API route that reads other people's orders by an id in the URL.
- A payment webhook or refund must survive repeated delivery.
- A column is renamed during a rolling deploy while the old app version still runs.
- Login attempts need a limit and costly routes need protection.
Not a fit when
- The project has no server side.
- You need rules for a UI or mobile client.
- The team wants full database documentation rather than agent behavior.
Example request
Add an endpoint that returns an order and make sure each user sees only their own orders.Limitations
Examples in the skills use TypeScript with `pg` and the SQL targets Postgres, with replacements for MySQL in the text. The "Make it yours" section of each skill is left empty by the author: while it says "not set", the agent follows what the repository already does. The 25 versus 2 figures come from Sonnet 5.5 and Haiku 5.5 with five runs per task, and 25 runs were left out because the account hit its usage limit. With the skills the agent does more work, about $0.11 per run against $0.06.
How to disable. Delete the skill folders from the agent skills directory. They do not alter other project files.
FAQ
How do I install backendskills?
With `npx skills add globalmpc/backendskills`. The skills fit Claude Code, Codex and Cursor.
Which skills are included?
Three: `api-endpoint`, `data-integrity` and `db-migration`. Each ends with a section for your team conventions.
How did the author measure the result?
Agents received 15 tasks with and without the skills, then hidden checks ran: 20 simultaneous buyers, reading someone else's order, the old version on a new schema.
Does it work with MySQL?
Yes, the rules are stack independent. The skill text lists `on duplicate key update` replacements for `on conflict` queries.
What if the agent still made a mistake?
Open an issue with the prompt and the diff. Skills are edited in `skills/` and rebuilt with `node scripts/build-dist.mjs`.
Discussion
No questions or reviews yet.
Related
SkillsA set of 14 skills for Java Spring Boot, from requirements analysis and code generation to tests, review and Docker deployment.
A PostgreSQL backend your agent builds over MCP, where the platform verifies every change and can roll it back.
builder-skills: agent skills for Convex apps
builder-skills
17 skills that teach an agent to build Convex apps by the docs and run a project through a PRD, task.md and a changelog
Hundreds of per-provider skills teach an agent to receive webhooks, verify signatures and handle events, with code examples.
Supabase's official skills: help an agent work with the database, Auth, Edge Functions and Postgres best practices
A Claude Code plugin for Butterbase: 39 skills and 34 commands take an idea to a deployed app on a hosted backend
README in short
The project gives a results table over 15 tasks and describes three skills. The benchmark with raw runs sits in `bench/` and can be reproduced.
README badge
Original SKILL.md
---
name: api-endpoint
description: Rules for HTTP API endpoints. Use when adding or changing any endpoint (route, request or response shape, status codes), especially login and ones that read or change other users' data.
---
# API endpoint
Examples are TypeScript with `pg`. The rules apply to any stack.
The SQL is Postgres. On MySQL, `on conflict ... do update` is `on duplicate key update`, and `on conflict
do nothing` is `on duplicate key update id = id` (0 affected rows: the row was there; not `insert ignore`,
which hides other errors too). There's no `returning`: read the row back in the same transaction.
Anything that changes money, stock or balances, or calls a payment provider or email: also follow the
`data-integrity` skill (transactions, locks, idempotency).
## 1. Check who may call it, not just that they're logged in
Why: a logged-in user who changes the id in the URL reads or edits someone else's data (IDOR).
```ts
// Bad: any logged-in user can read any invoice
const { rows } = await pool.query("select * from invoices where id = $1", [id]);
// Good: scope the query to the caller; someone else's invoice looks the same as a missing one
const { rows } = await pool.query(
"select id, number, total_cents, status from invoices where id = $1 and account_id = $2", [id, user.accountId]);
if (rows.length === 0) return sendError(res, 404, "not_found", "Invoice not found");
```
Admins or other roles get access through an explicit role check, never by skipping the filter.
Webhooks have no logged-in user, so the signature is the check: verify it on the raw request body with a
constant-time compare (`crypto.timingSafeEqual`, after checking both are the same length, or it throws)
before you parse or trust anything in it. Unsigned or wrongly signed: 401, and nothing changes.
## 2. Bad input is a 4xx, never a 500
Why: a 500 on bad input hides real errors in the noise. Bad values that slip through (negative amounts,
fractions) corrupt data.
- Validate the body and path params at the edge: types, integers where money and quantities are counted,
ranges (`quantity >= 1`, `amountCents > 0`), required fields, ids that aren't numbers.
- Handle what a request can legally contain but your code doesn't expect, like the same item listed
twice. Merge the duplicates or reject them with a 400, but don't let the request crash into a 500.