Api Audit
- 23 installs
- 22 repo stars
- Updated May 28, 2026
- acedergren/agentic-tools
api-audit is a Claude Code skill that read-only scans API routes against shared TypeScript types to find schema drift, missing auth, and validation gaps.
About
api-audit is a Claude Code skill that audits API routes for schema drift, missing auth, and validation gaps. It scans routes against shared TypeScript type definitions to find mismatches, missing middleware, and undocumented endpoints, then produces a severity-grouped report. It is read-only and does not modify files. Developers use it to review an API surface before shipping.
- Cross-references API routes against shared TypeScript types to find schema drift
- Flags missing auth on mutation endpoints and missing request validation
- Read-only, produces a severity-grouped report and never modifies files
Api Audit by the numbers
- 23 all-time installs (skills.sh)
- Ranked #3,434 of 4,347 Backend & APIs skills by installs in the Skillselion catalog
- Data as of Jul 28, 2026 (Skillselion catalog sync)
api-audit capabilities & compatibility
- Capabilities
- api audit · schema drift check · auth gap audit · code review
- Use cases
- code review · api development · security audit
- Pricing
- Free
What api-audit says it does
Scans routes against shared TypeScript types to find mismatches, missing middleware, and undocumented endpoints. Read-only — produces a severity-grouped report.
Read-only cross-reference of API routes against shared type definitions. Do NOT modify any files.
npx skills add https://github.com/acedergren/agentic-tools --skill api-auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 23 |
|---|---|
| repo stars | ★ 22 |
| Last updated | May 28, 2026 |
| Repository | acedergren/agentic-tools ↗ |
What it does
Audit API routes against shared TypeScript types to find schema drift, missing auth, and validation gaps in a severity-grouped report.
Who is it for?
Reviewing a TypeScript/Fastify API surface for schema drift, missing auth on mutations, and unvalidated write routes.
Skip if: Fixing the issues it finds; it is strictly read-only and produces only a report.
When should I use this skill?
You want to audit API routes for schema drift or find auth and validation gaps.
What you get
A severity-grouped report of auth gaps, type drift, missing validation, and orphaned schemas with file:line references.
- Severity-grouped markdown table of route/type issues
- Summary counts of validation coverage and mismatches
By the numbers
- 3 severity levels: Critical, Warning, Info
- ships 2 scripts: inventory-api-surface.sh, find-shared-schemas.sh
Files
API Route & Type Audit Skill
Read-only cross-reference of API routes against shared type definitions. Do NOT modify any files.
NEVER
- Never flag a missing schema without first confirming the framework doesn't use inline validation (Fastify schema objects, Zod in middleware, etc.).
- Never report an auth gap without verifying the route should actually be protected — not all routes require auth.
- Never treat orphaned types as critical — they may be planned, transitional, or used by SDK consumers not visible in the route tree.
- Never make assumptions about auth from route path alone —
/admin/*prefix doesn't guarantee a route requires auth without inspecting the hook chain.
Decision: What counts as a real mismatch?
Schema drift — only if the shared type and the route handler both exist but disagree on shape (field names, required vs optional, type divergence). A route using its own inline schema is not drift.
Auth gap — only if: (a) a sibling or parent route has auth hooks AND (b) the route handles mutations or user-scoped data. Public GET endpoints with no sibling pattern are ambiguous — report as Info, not Critical.
Orphaned type — only if the schema has no imports, no references in any route file, and is not in a types/ package that may serve external consumers.
Parallel Execution Strategy
Spawn two agents simultaneously:
- Agent A: Scan routes + plugins → catalog
(method, path, auth hooks, request schema, response schema)per endpoint - Agent B: Scan type/schema directories → catalog all exported schema names and their shapes
Synthesize after both complete. Never do this serially — the two inventories are independent.
Scripts
bash scripts/inventory-api-surface.sh
bash scripts/inventory-api-surface.sh admin # scope filter
bash scripts/find-shared-schemas.sh packagesWhat to Collect (Agent A)
Per route: HTTP method, path, auth/permission requirements, request validation schema (name or inline), response schema (name or inline). Check both route registration AND plugin/middleware hooks — auth often lives in the plugin, not the handler.
What to Collect (Agent B)
Per shared schema: exported name, file location, TypeScript shape summary, and whether it's referenced by any route import.
Report Format
Severity-grouped markdown table:
| Severity | Category | Route/Type | Issue | File:Line |
|---|
Severity levels: 1. Critical: Auth gaps on mutation endpoints, missing request validation on write operations 2. Warning: Type drift between route handler and shared schema, missing response schemas on documented APIs 3. Info: Orphan types, inline schemas that could use shared ones
Include summary counts: total routes, full validation coverage, partial, none, mismatch count.
Scope Filter
$ARGUMENTS — optional path prefix (e.g., admin → only audit /admin/* routes). Empty = audit all.
#!/usr/bin/env bash
set -euo pipefail
SCOPE="${1:-packages}"
rg -n "z\\.(object|string|number|enum|union)|export .*schema|export const .*Schema|export type|export interface" "$SCOPE" -g '!**/node_modules/**'
#!/usr/bin/env bash
set -euo pipefail
SCOPE="${1:-}"
ROUTE_PATTERN='\\b(get|post|put|patch|delete|options|head)\\s*\\('
SCHEMA_PATTERN='schema|zod|responseSchema|requestSchema'
AUTH_PATTERN='requireAuth|preHandler|permissions|resolveOrgId|auth'
if [ -n "$SCOPE" ]; then
rg -n -i "$ROUTE_PATTERN|$SCHEMA_PATTERN|$AUTH_PATTERN" apps packages -g '!**/node_modules/**' | rg "$SCOPE"
else
rg -n -i "$ROUTE_PATTERN|$SCHEMA_PATTERN|$AUTH_PATTERN" apps packages -g '!**/node_modules/**'
fi
Related skills
Lark Openapi ExplorerInstantly explore, test, and generate calls against the full Lark (Feishu) OpenAPI surface without leaving their agent workflow.493k
Lark EventConsume real-time events from Lark/Feishu as structured NDJSON streams inside AI agent workflows.387k16kLark Openapi ExplorerWhen an existing Lark/Feishu skill or CLI command cannot fulfill a specific requirement and they need to discover and invoke the exact native OpenAPI endpoint.386k16k
Just ScrapeQuickly search, crawl, extract structured JSON, or monitor web pages without writing custom scraping code.245k41Lark AppsQuery the current visibility and permission scope of a Lark (Feishu) app without writing HTTP client code.235k16k
Design An InterfaceGenerate multiple radically different interface or API designs in parallel before committing to one.188k198kFAQ
Does api-audit change my code?
No. It is a read-only cross-reference of routes against type definitions and explicitly does not modify any files.
How are findings prioritized?
In a severity-grouped table: Critical for auth gaps on mutations and missing write validation, Warning for type drift, and Info for orphan or inline schemas.