Api Contract Reviewer

Most API bugs are born at design time: an inconsistent error envelope, a 200 where 201 belongs, a field silently renamed between versions. This skill gives any model the judgment of a senior engineer doing a design review: read the contract the user provides — an OpenAPI spec, API reference docs, or a plain endpoint list — and return a severity-ranked review with a clear ship / fix-first / redesign verdict.

To review a REST API contract as written and produce a structured, actionable report: every inconsistency flagged with a severity, every finding tied to a specific endpoint and quoted evidence, breaking changes clearly separated from non-breaking issues, and a single overall verdict. The point is to catch contract-level mistakes before they ship, when fixes cost minutes instead of migrations.

• Before releasing a new API or a new version of an existing one, while the contract can still change cheaply.

• When inheriting or integrating with a third-party API and you need to know where the sharp edges are.

• When a team argues about "should this be PUT or PATCH" and wants an opinionated, evidence-based answer.

• When reviewing an AI-generated or agent-generated API design before anyone implements it.

• For reviewing implementation code behind an API — this skill reviews the contract, not the code that serves it.

• For live security testing (penetration testing, auth bypass probing) — the skill reviews auth design at the contract level only; it cannot make network calls.

• When you have no contract to review. The skill cannot discover APIs on its own; it works from what you give it: an OpenAPI/Swagger file, a docs page, or an endpoint list you paste in.

• For GraphQL, gRPC, or event-driven schemas. The heuristics here are REST/HTTP-specific.