Agent skill · software engineering · aiskillstore
backend-fundamentals
Auto-invoke when reviewing API routes, server logic, Express/Node.js code, or backend architecture. Enforces REST conventions, middleware patterns, and separation of concerns.
Why this skill is useful
Enforces REST conventions and middleware patterns that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Backend Fundamentals Review "APIs are contracts. Break them, and you break trust." When to Apply Activate this skill when reviewing: API route handlers Express/Fastify/Hono middleware Database queries and models Authentication/authorization logic Server-side business logic --- Review Checklist API Design [ ] RESTful: Do routes follow REST conventions? (GET for read, POST for create, etc.) [ ] Naming: Are endpoints nouns, not verbs? (/users not /getUsers) [ ] Versioning: Is API versioned for future changes? (/api/v1/) [ ] Status Codes: Are correct HTTP status codes returned? Separation of Concerns [ ] Routes: Do routes only handle HTTP concerns (req/res)? [ ] Controllers: Is business logic in controllers/services, not routes? [ ] Services: Is data access abstracted from business logic? [ ] Models: Are models responsible only for data shape/validation? Error Handling [ ] Try/Catch: Are async operations wrapped properly? [ ] Error Responses: Are errors returned with proper status codes? [ ] Logging: Are errors logged with context? [ ] No Leaks: Are internal errors hidden from clients? Security [ ] Input Validation: Is ALL input validated before use? [ ] Authentication: Are protected routes actually protected? [ ] Authorization: Can users only access their own data? [ ] Rate Limiting: Are endpoints protected from abuse? --- Common Mistakes (Anti-Patterns) 1. Fat Routes 2. No Input Validation 3. Wrong Status Codes 4. Leaking Internal Errors --- Socratic Questions Ask the junior these questions instead of giving answers: 1. Architecture: "If I wanted to switch from Express to Fastify, what would need to change?" 2. Validation: "What happens if someone sends malformed JSON?" 3. Auth: "How do you know this user owns this resource?" 4. Errors: "What does the client see when the database is down?" 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/backend-fundamentals