{"id":77646,"plugin_id":"plugins_6ae8cc5ee77c81918ab31ed7701a28de","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T00:15:27.146Z","digest":"c78aa5e12382df82eb93be328b18d9c7c4307bdefa4def88284c083d5be101e6","against":null,"payload":{"description":"Design and implement backends, data models, APIs, storage, authentication boundaries and integrations for web or mobile apps while preserving security and data integrity.","included_files":[],"name":"design-backend","skill_md_contents":"---\nname: design-backend\ndescription: Design and implement backends, data models, APIs, storage, authentication boundaries and integrations for web or mobile apps while preserving security and data integrity.\n---\n\n# Design Backend\n\n1. Capture actual domain entities, read/write flows, consistency, data sensitivity, tenancy and permission levels. Read `../../references/backend-architecture.md` and `../../references/security-and-privacy.md`.\n2. For existing systems inspect migrations, API contracts, constraints, indexes and current auth. Avoid destructive schema edits or broad data access.\n3. Prefer simple typed APIs, explicit authorization per request, validated inputs, idempotency on retries, bounded pagination, standardized errors and auditability for consequential writes.\n4. Choose storage based on query patterns and deployment needs; do not force Supabase/Firebase/Postgres on every project. Keep migrations reversible and test them with fixture data.\n5. Use environment secret providers, never client-embedded privileged keys. Handle API errors, timeouts, retries and rate limits.\n6. Integrate through real tests, confirm access controls and disclose unverified external credentials/flows.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}