Agent skill

API Forge

by EliasOulkadi in EliasOulkadi/shokunin

Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency.

Install API Forge

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.pack/skills/api-forge .claude/skills/api-forge && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .claude/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.pack/skills/api-forge .agents/skills/api-forge && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .agents/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.pack/skills/api-forge .cursor/skills/api-forge && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .cursor/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/EliasOulkadi/shokunin.git --path .pack/skills/api-forge

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.pack/skills/api-forge .gemini/skills/api-forge && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .gemini/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .github/skills && cp -r skills-src/.pack/skills/api-forge .github/skills/api-forge && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .github/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add EliasOulkadi/shokunin --skill api-forge -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install EliasOulkadi/shokunin api-forge --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/EliasOulkadi/shokunin.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.pack/skills/api-forge .opencode/skills/api-forge && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "api-forge" agent skill from https://github.com/EliasOulkadi/shokunin/tree/master/.pack/skills/api-forge into .opencode/skills/api-forge/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-forge", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: api-forge
GitHub stars: 114
Token cost: ~2.9k tokens
SKILL.md length: 1,042 words
Files: 1
Skills in repo: 49
Repo updated: Oct 5, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency.

Works in 5 steps: Determine API type → Define resources and naming → Map HTTP methods → …
User asks to design an API
SKILL.md covers Sub-Commands, Workflow, Error Handling and Rate Limiting, plus 10 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

API Forge is an agent skill from EliasOulkadi/shokunin. Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency. Use when user asks to design an API, create endpoints, define REST/GraphQL schema, or generate OpenAPI spec. Do NOT use for database schema design, frontend API integration, or non-HTTP protocols (gRPC, WebSocket, MQTT).

Its SKILL.md is about 2.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: opencode

It sits in Backend & APIs, covering OpenAPI specifications, Webhooks and GraphQL. It works with OpenAPI, GraphQL, gRPC and Stripe. The repository describes itself as: 職人 Shokunin 62 AI agent skills for OpenCode, Claude Code, Cursor, Windsurf. ChromaDB memory, MCP servers, declarative self-updates. Multi-model, open source, zero cost. The licence is MIT.

When your agent uses it

User asks to design an API
Create endpoints
Define REST/GraphQL schema
Generate OpenAPI spec

Example prompts

“/api-forge”

Requirements

Compatibility (from SKILL.md): opencode

Workflow steps

5 steps, taken from the step headings in SKILL.md.

Determine API type
Define resources and naming
Map HTTP methods
Design response format
Implement pagination

What it can do on your machine

Read from SKILL.md and the folder at commit 4c68e5b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are json and typescript).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
opencode
From compatibility in the SKILL.md frontmatter.

Context cost

API Forge loads about 2.9k tokens when it runs. Until then it costs about 86 tokens; SKILL.md has 1,042 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~86
When it runs · the whole SKILL.md, loaded when a task matches: ~2.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from EliasOulkadi/shokunin at commit 4c68e5b, republished under its MIT licence (© EliasOulkadi). 1,042 words, ~2,911 tokens.

Download SKILL.mdSave it as .claude/skills/api-forge/SKILL.md (or your agent's skills folder).

name: api-forge
description: Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency. Use when user asks to design an API, create endpoints, define REST/GraphQL schema, or generate OpenAPI spec. Do NOT use for database schema design, frontend API integration, or non-HTTP protocols (gRPC, WebSocket, MQTT).
compatibility: opencode
triggers: design an API, create endpoints, REST API, GraphQL schema, OpenAPI spec, rate limiting, webhooks, idempotency, API pagination, API versioning, API security
negatives: database schema, frontend integration, gRPC, WebSocket, MQTT, database design
license: MIT
metadata.workflow: backend
metadata.audience: developers
metadata.version: 4.0.0
metadata.author: shokunin

API Forge

Design APIs that developers love. Based on patterns from Stripe, GitHub, Twilio, Slack, and the OpenAPI 3.1 specification.

Sub-Commands

Command	Category	Description
`design`	Build	Design an API from user requirements. Generate OpenAPI 3.1 spec.
`endpoint`	Build	Design a single endpoint with all methods, parameters, responses, and error codes.
`audit`	Evaluate	Audit an existing API against design rules, security checklist, and anti-patterns.
`document`	Document	Generate API documentation from OpenAPI spec or route handlers.
`extract`	Document	Extract OpenAPI spec from existing route handlers.
`webhook`	Build	Design webhook delivery, retry, and signature verification.

Workflow

Step 1: Determine API type

Type	Use Case	Spec
REST	CRUD, resource-oriented	OpenAPI 3.1
GraphQL	Complex queries, multiple resources	Schema Definition Language
Webhook	Event-driven, async notifications	Standard webhooks (Stripe pattern)

Step 2: Define resources and naming

Pattern	Example	Notes
Nouns, plural	`/users`, `/orders`	Never verbs
Nested (max 2 levels)	`/users/{id}/orders`	Flat preferred over deep nesting
Actions as sub-resources	`/orders/{id}/cancel`	Only for non-CRUD operations
Query for filters	`/users?role=admin`	Not `/users/admins`
kebab-case for paths	`/order-items`	Not `/orderItems`
snake_case for fields	`first_name`	Not `firstName` in JSON:API

Step 3: Map HTTP methods

Method	Purpose	Idempotent	Safe	Body
GET	Read resource	Yes	Yes	No
POST	Create resource	No	No	Yes
PUT	Full replace	Yes	No	Yes
PATCH	Partial update	No	No	Yes
DELETE	Remove resource	Yes	No	Optional

Step 4: Design response format

Stripe-style standard envelope:

json

{
  "data": {},
  "meta": {
    "page": 1,
    "per_page": 25,
    "total": 100
  },
  "error": null,
  "request_id": "req_abc123"
}

If using JSON:API or GraphQL, use their standard envelopes instead.

Step 5: Implement pagination

Cursor-based for production. Page-based only for admin/internal tools.

json

GET /items?cursor=abc123&limit=25
{
  "data": [...],
  "meta": {
    "next_cursor": "def456",
    "has_more": true
  }
}

Cursor must be opaque (base64-encoded compound key). Never expose internal IDs. Maximum limit: 100. Default: 25.

Error Handling

Every error response includes:

code: machine-readable error code (VALIDATION_ERROR, NOT_FOUND, RATE_LIMITED)
message: human-readable summary, max 150 chars
details: array of field-level errors for validation
request_id: UUIDv4 for debugging correlation
docs_url: link to error documentation (optional, strongly recommended)

json

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Email is required",
    "details": [
      { "field": "email", "code": "required", "message": "Email is required" }
    ],
    "request_id": "req_a1b2c3d4e5f6",
    "docs_url": "https://docs.example.com/errors/validation"
  }
}

Status codes — exact mapping

Code	When	What to return
200	Success (GET, PUT, PATCH)	Resource + meta
201	Created (POST)	Created resource + `Location` header
204	No content (DELETE)	Empty body
400	Validation error	Error details + fields
401	Missing/invalid auth	Generic message. Never reveal which part of auth failed.
403	Insufficient permissions	Generic message
404	Resource not found	Minimal. Don't reveal if the resource ever existed.
409	Conflict (duplicate, stale version)	Details of conflicting field
422	Unprocessable entity	Validation details
429	Rate limited	`Retry-After` header (seconds)
500	Internal error	Generic message. No stack traces. No internal state.
502	Downstream failure	"Service temporarily unavailable"
503	Maintenance / overload	`Retry-After` header

Rate Limiting

Algorithm decision

Algorithm	Best for	Behavior
Token Bucket	General purpose, bursts allowed	Tokens refill at configurable rate. Allows bursts up to bucket size.
Sliding Window	Strict fairness, multi-tenant	Counts requests in rolling time window. No burst edge at boundaries.
Fixed Window	Simple, non-critical	Resets at interval. Budget edge problem at boundaries.

Default: Token Bucket.

Headers (every response)

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1700000000

Return 429 Too Many Requests with Retry-After header when exceeded.

Rate limit tiers (exact values)

Tier	Requests	Window	Per
Anonymous	60	60s	IP
Authenticated	1000	60s	User ID + endpoint group
Critical endpoints	5	15min	IP + identifier

Critical: login (5/15min per IP+username), password reset (3/60min per email), MFA (3/15min per user).

Versioning

Strategy	Example	When	Risk
URL path	`/v1/users`	Default for REST APIs	URL pollution
Header	`Accept: application/vnd.api+json;version=2`	Clean URLs needed	Harder to discover
Query param	`/users?version=2`	Simple, transitional	Cache poisoning risk

Prefer URL path for public APIs. Deprecate with sunset headers. 6-month migration window minimum.

Deprecation: true
Sunset: Sat, 12 May 2027 00:00:00 GMT

Webhooks

Delivery format (Stripe pattern)

json

{
  "id": "wh_abc123",
  "type": "order.created",
  "created": 1700000000,
  "data": {
    "id": "order_456",
    "status": "paid",
    "total": 2999
  }
}

Delivery protocol

Retry: exponential backoff (1s, 2s, 4s, 8s, 16s, 32s…)
Max retries: 3. Max TTL: 24 hours.
Expect 200 response within 5 seconds.
Signature: HMAC-SHA256.

Signature verification (exact implementation)

X-Webhook-Signature: t=1700000000,v1=abc123def456...

typescript

function verifyWebhook(payload: string, signature: string, secret: string): boolean {
  const [timestampStr, signatures] = signature.split(',').map(s => s.trim())
  const timestamp = timestampStr.split('=')[1]

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatures.split('=')[1])
  )
}

Idempotency

Header	Value	TTL
`Idempotency-Key`	UUIDv4	24 hours

Return cached response (same status, same body) if same key seen within TTL. Return 409 Conflict if different request body arrives with same key.

Show full SKILL.md (414 more words)Show less

API Security Checklist

HTTPS enforced (HTTP → 301 redirect)
TLS 1.2+ only (no TLS 1.0/1.1)
CORS whitelist per environment, never * with credentials
Input validation at boundary (Zod, Joi, Pydantic)
Parameterized queries (no SQL injection). Never string interpolation.
No secrets in responses, logs, or error messages
Rate limiting on auth + password endpoints
Request size limit: 1MB default, configurable per endpoint
Body parsing limits (depth, field count, string length)
Security headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Content-Security-Policy

OpenAPI 3.1 Generation

Every endpoint needs:

summary: one sentence. Verb + resource.
parameters: name, in, required, schema, description, example
responses: every possible status code
requestBody (for POST/PUT/PATCH): content, schema, required

GraphQL

Schema design

Queries for read, Mutations for write, Subscriptions for real-time
Max 3 nesting levels per query
@deprecated(reason: "Use fieldX instead") for removals
DataLoader for N+1 prevention
Complexity limits: max depth 5, max cost 1000

Error handling

json

{
  "errors": [
    {
      "message": "Validation error",
      "extensions": {
        "code": "VALIDATION_ERROR",
        "field": "email",
        "request_id": "req_abc123"
      }
    }
  ]
}

Anti-Patterns

Anti-pattern	Fix
Verbs in URL (`/getUsers`)	Use HTTP methods on noun resources
Page-based pagination for real-time data	Cursor-based with opaque cursors
No rate limit headers	Include `X-RateLimit-*` on every response
Returning 500 with stack trace	Log internally, return generic message
Breaking changes without migration	Version via URL, deprecation + sunset headers
No idempotency on POST creates	Add `Idempotency-Key` header support
Inconsistent error format across endpoints	Standard envelope for all errors
GraphQL without complexity limits	Implement query depth + cost analysis
Nested resources > 2 levels	Restructure. Deep nesting = tight coupling.
POST for everything	Use correct HTTP methods. GET=read, PUT=replace, PATCH=partial.

Production Checklist

All endpoints documented with OpenAPI 3.1
Envelope: { data, meta, error, request_id } on every response
Cursor-based pagination for public endpoints
Rate limit headers on every response
Rate limiting on auth endpoints (5/15min login, 3/60min reset)
Idempotency-Key support on POST/PATCH
Webhook signature verification (HMAC-SHA256)
Security headers on every response
CORS whitelist (never * with credentials)
Input validation at boundary
Parameterized queries everywhere
Error responses include request_id and code
Versioning strategy defined (URL path preferred)
Deprecation + Sunset headers on deprecated endpoints

Sources

Stripe API Reference — idempotency, pagination, webhooks, error format
GitHub REST API — resource naming, versioning
Twilio API — webhook signature verification
OpenAPI 3.1 Specification (openapis.org)
JSON:API Specification (jsonapi.org)
GraphQL Relay Connection Specification
IETF RFC 7231 — HTTP semantics
IETF RFC 6585 — Additional HTTP status codes
Slack API — rate limiting headers

Checklist

Skill loads without errors in the AI agent
YAML frontmatter is valid (description, compatibility, audience)
Workflow section provides clear step-by-step instructions
Error handling section covers common failure modes
All referenced files (references/, scripts/, assets/) exist
Skill triggers correctly for intended use cases
No broken links or missing resources

Files

Just SKILL.md in .pack/skills/api-forge of EliasOulkadi/shokunin.

Open the folder on GitHubat commit 4c68e5b

Compare with similar skills

API Forge next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

API Forge compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
API Forge this skillEliasOulkadi/shokunin	114	—	~2.9k	Automated safety check: Pass	MIT	4 days ago
System Design CommunicationHoangNguyen0403/agent-skills-standard	571	—	~894	Automated safety check: Pass	MIT	today
API Architectcuriositech/some_claude_skills	243	—	~1.4k	Automated safety check: Pass	MIT	1 mo ago
API Contract Detectionprime-radiant-inc/greenfield	292	—	~4.2k	Automated safety check: Pass	Apache-2.0	2 mo ago
Implementing API Patternsancoleman/ai-design-components	526	—	~3k	Automated safety check: Pass	MIT	10 mo ago
API Designmajiayu000/spellbook	287	—	~2.1k	Automated safety check: Pass	MIT	today

Similar skills

System Design Communication
HoangNguyen0403/agent-skills-standard
Select how services talk: REST, gRPC, GraphQL, WebSocket, SSE, or webhook per hop, sync versus async per flow, service discovery mode, and DNS/edge routing.
571 GitHub stars~894 tokensUpdated today
Backend & APIsAuto-check passed
API Architect
curiositech/some_claude_skills
Expert API designer for REST, GraphQL, gRPC architectures. An agent skill from curiositech/some_claude_skills.
243 GitHub stars~1.4k tokensUpdated 1 mo ago
Backend & APIsAuto-check passed
API Contract Detection
prime-radiant-inc/greenfield
Finds OpenAPI, GraphQL, Protobuf and JSON Schema files in a codebase and extracts behavioral claims from them as part of a reverse-engineering workflow.
292 GitHub stars~4.2k tokensUpdated 2 mo ago
Backend & APIsAuto-check passed
Implementing API Patterns
ancoleman/ai-design-components
API design and implementation across REST, GraphQL, gRPC, and tRPC patterns.
526 GitHub stars~3k tokensUpdated 10 mo ago
Backend & APIsAuto-check passed
API Design
majiayu000/spellbook
REST/GraphQL/gRPC API design best practices. An agent skill from majiayu000/spellbook.
287 GitHub stars~2.1k tokensUpdated today
Backend & APIsAuto-check passed
API Protocol Security
zhaji2333/CkSKILLS
当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。
114 GitHub stars~520 tokensUpdated 24 days ago
Backend & APIsAuto-check passed

Questions about API Forge

What does API Forge do?

Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency. API Forge is an agent skill from EliasOulkadi/shokunin.1, error handling, pagination, rate limiting, webhooks, and idempotency.

When should I use API Forge?

API Forge fits situations like: user asks to design an API; create endpoints; define REST/GraphQL schema; generate OpenAPI spec.

How do I install API Forge in Claude Code?

Run `npx skills add EliasOulkadi/shokunin --skill api-forge -a claude-code`. Or copy the skill folder (.pack/skills/api-forge in EliasOulkadi/shokunin) into .claude/skills/api-forge in your project. Claude Code loads it when a task matches its description.

How do I install API Forge in Codex?

Run `npx skills add EliasOulkadi/shokunin --skill api-forge -a codex`. Or copy the skill folder (.pack/skills/api-forge in EliasOulkadi/shokunin) into .agents/skills/api-forge in your project. Codex loads it when a task matches its description.

Can I use API Forge in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add EliasOulkadi/shokunin --skill api-forge -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/api-forge, .gemini/skills/api-forge, .github/skills/api-forge and .opencode/skills/api-forge in your project.

What does API Forge need to run?

SKILL.md names no scripts, command-line tools or credentials: API Forge is instructions for the agent only. Compatibility (from SKILL.md): opencode.

Does API Forge access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is API Forge safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does API Forge use?

API Forge is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does API Forge use?

About 2.9k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to API Forge?

Skills that share tags, products or a category with API Forge: System Design Communication (HoangNguyen0403/agent-skills-standard, 571 stars), API Architect (curiositech/some_claude_skills, 243 stars), API Contract Detection (prime-radiant-inc/greenfield, 292 stars) and Implementing API Patterns (ancoleman/ai-design-components, 526 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains API Forge?

EliasOulkadi (a GitHub user) maintains it in EliasOulkadi/shokunin, which has 114 GitHub stars. The repository holds 49 skills in this directory. The repository was last updated on October 5, 2026.

Source: EliasOulkadi/shokunin on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install API Forge

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

API Forge

Sub-Commands

Workflow

Step 1: Determine API type

Step 2: Define resources and naming

Step 3: Map HTTP methods

Step 4: Design response format

Step 5: Implement pagination

Error Handling

Status codes — exact mapping

Rate Limiting

Algorithm decision

Headers (every response)

Rate limit tiers (exact values)

Versioning

Webhooks

Delivery format (Stripe pattern)

Delivery protocol

Signature verification (exact implementation)

Idempotency

API Security Checklist

OpenAPI 3.1 Generation

GraphQL

Schema design

Error handling

Anti-Patterns

Production Checklist

Sources

Checklist

Files

Compare with similar skills

Similar skills

More from EliasOulkadi/shokunin

Related

Questions about API Forge