{"id":"9cbc2d98-e154-41d3-a720-41b04bbef22e","slug":"backend-skill","kind":"skill","name":"backend-skill","summary":"Backend Engineering agent-skill — implement the server behind the contract: APIs, domain logic, OLTP persistence, auth, async/jobs, caching, security, integration, tests. Faceted router, agentic flags","owner":"gabros20","repoUrl":"https://github.com/gabros20/backend-skill","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-07-24T19:31:05.000Z","addedAt":"2026-10-21T12:55:03.950Z","logoUrl":"https://avatars.githubusercontent.com/u/49348865?u=249e7e166641cc1ab1ebaed978fdc4048b171508&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["databases","developer-tools","cloud-infra"],"tags":["api","authentication","backend","backend-development","claude-code","database","message-queue"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T18:09:04.220Z","sample":false,"url":"https://conduits.dev/tools/backend-skill","language":"HTML","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# backend — Backend Engineering\n\n**Visual guide:** [backendengskill.vercel.app](https://backendengskill.vercel.app)\n\n**Family hub:** [digital-product-skill.vercel.app](https://digital-product-skill.vercel.app) — the 15-skill Digital Product family and its composer.\n\nImplement **the running server behind the contract** — API endpoints, domain logic, OLTP\npersistence, auth, async jobs and messaging, caching, security controls, outbound integrations, and\nthe tests that prove it works — across REST/GraphQL/gRPC/realtime/serverless-edge/agentic backends\nin Node, Python, Go, Rust, and the JVM. `backend` is the server-side half of the\n**Build** stage of the [Digital Product Skills](https://github.com/gabros20) family, peer of\n`frontend`: an agent skill for implementing production endpoints, business/domain logic, schema and\nmigrations, authentication and authorization, background jobs, caching and rate limiting, security\nhardening, third-party integrations, and agent/MCP-serving backends.\n\nIt sits between `architecture` (which decides the boundaries, the contract shape, the NFR budgets,\nand the threat model) and `operate`/`quality` (which deploy, monitor, and independently verify what\ngets built). It owns the **running server and the implementation craft inside the decided shape** —\nnot the decision behind it. It is an **implementation router grounded in the current stack, not a\nsystem-design tool, and not a single-vendor or single-framework skill.**\n\n## What it does\n\nA **faceted router**: pick one primary job × at most one base surface (the agentic overlay stacks\nadditively on top).\n\n**Primary jobs** — API implementation · domain logic · persistence · auth · async & messaging ·\ncaching & performance · server security · service integration · backend testing.\n\n**Surface overlays** — REST/CRUD service (default) · serverless/edge · realtime · event-driven\nmicroservices · **agentic** (additive). The base surface reshapes how every job applies for that\nruntime/system type; `surface-agentic` stacks on top of whichever base surface applies rather than\nreplacing it.\n\n**The differentiator:** first-class **agentic-backend** support as the flagship overlay — durable\nexecution as the default control plane, tool/MCP endpoints, agent-legible typed contracts and\nerrors, and RAG-retrieval plumbing that calls `ai`'s core without owning it. Plus three invariants no\nsingle-vendor or single-framework skill carries: **retrieval-first / anti-staleness** (fetch current\nframework/ORM/DB docs before generating anything version-specific — Prisma 7, Drizzle 1.0, Go 1.22\nrouting, Kafka 4.0's KRaft-only cutover all ship breaking changes fast), **default-stack-then-deviate**\n(name the current modal pick per language, but every recommendation is a concrete choice + what NOT\nto build + a trade-off, weighted by reversibility — never trend-chasing), and **DB-license-teaching**\n(SSPL, BSL, AGPL, and source-available self-host/resale implications, with the permissive escape\nhatches named) — a distinctive value-add most backend material skips entirely.\n\nEvery method is grounded in its named source: OWASP Top 10 and ASVS, the 12-Factor App, OAuth\n2.0/OIDC with PKCE (RFC 9700), Domain-Driven Design tactical patterns, the transactional-outbox and\nsaga patterns, Zanzibar-style ReBAC, Google/AWS/Azure well-architected guidance on pooling and\ndurable execution (Temporal, Hatchet), and the current official docs for each covered\nframework/ORM/datastore. Full attribution in [SOURCES.md](SOURCES.md).\n\n## Install\n\n```bash\nnpx skills add gabros20/backend-skill -g -y\n```\n\nOr use it in Codex with `$backend`.\n\n## Examples\n\n```text\n$backend build the REST endpoints behind this contract — pagination, versioning, error shape\n\n$backend design the domain/service layer for checkout so rules stop leaking into handlers\n\n$backend add OAuth2/OIDC login with PKCE and decide sessions vs JWT\n\n$backend set up the outbox and saga for this order-fulfillment workflow\n\n$backend expose an MCP/tool endpoint for our agent backend — durable execution, agent-legible errors\n```\n\n## Route by job\n\n| User intent | Reads | Contribution |\n|---|---|---|\n| Build/scaffold/extend endpoints, handlers, routers, resolvers, or RPC methods; pick REST/GraphQL/gRPC/tRPC; set pagination, versioning, error shape | [api-implementation](skills/backend/references/api-implementation.md) | Transport pick, request-lifecycle wiring, single-source schema, uniform error shape, cursor pagination, in-code versioning |\n| Add/refactor business logic, a service or use-case layer, or domain models; apply DDD tactical / clean / hexagonal; stop rules leaking into handlers | [domain-logic](skills/backend/references/domain-logic.md) | Layered domain/application/infra structure, aggregates/entities/VOs, anti-anemic litmus, dependency rule |\n| Design schema/indexes, choose ORM vs raw SQL, write a migration, get transactions/isolation right, size a pool, kill N+1 | [persistence](skills/backend/references/persistence.md) | Schema+index+expand/contract migration, isolation decision, pooling matched to runtime, DB-license flag |\n| Add login/signup/sessions, protect a route, add OAuth/SSO, store passwords, decide who-can-do-what | [auth](skills/backend/references/auth.md) | Session-vs-JWT decision, OAuth2/OIDC+PKCE flow, Argon2id config, RBAC/ABAC/ReBAC model + library pick |\n| Background jobs, queues, workers, event-driven services, pub/sub, CDC, outbox, saga, idempotency, durable workflows | [async-and-messaging](skills/backend/references/async-and-messaging.md) | Broker/queue pick, idempotency-key path, transactional outbox, saga+compensations, delivery stance, durable-execution decision |\n| Add a cache and invalidate it, implement rate limiting, or diagnose a slow endpoint/query | [caching-and-performance](skills/backend/references/caching-and-performance.md) | Cache strategy by staleness/loss tolerance, invalidation mechanism, distributed-correct token bucket, measured bottleneck + fix |\n| Secure the API, add security headers, fix CORS, prevent injection, store secrets, implement a threat model's controls | [server-security](skills/backend/references/server-security.md) | Uniform OWASP controls table (control→impl→verify) with self-audit count, mapped to Top 10:2021 / ASVS |\n| Call a third-party API, receive/deliver webhooks, add a gRPC/HTTP client, tune a circuit breaker | [service-integration](skills/backend/references/service-integration.md) | Resilient client wrapper (retry + circuit breaker), verified idempotent webhooks in/out |\n| Write/run/fix backend tests, or \"prove this works\" | [backend-testing](skills/backend/references/backend-testing.md) | Layered test suite, real-dependency integration tests, contract-producer check, ✓/✗ verification report |\n\n**Surface overlay (add at most one base; the agentic overlay stacks additively):**\n\n| System type | Reads | Reshapes |\n|---|---|---|\n| Standard long-running request/response service — modular monolith or a few services (default) | [surface-rest-crud](skills/backend/references/surface-rest-crud.md) | Concern-scoping model pick, adapter-isolates-runtime seam, per-language idioms, 12-factor scaffold |\n| Serverless / edge — Workers, Lambda, Bun-edge, Vercel/Netlify functions | [surface-serverless-edge](skills/backend/references/surface-serverless-edge.md) | Statelessness, the connection-pooling failure mode (txn-mode pooler or HTTP-native driver), D1/KV/R2/Durable-Objects mapping |\n| Realtime — WebSocket/SSE/pub-sub, stateful connections, presence, rooms | [surface-realtime](skills/backend/references/surface-realtime.md) | SSE-vs-WS transport, actor-per-connection/room, presence abstraction, per-message reliability, fan-out/scaling |\n| Event-driven microservices — independently deployed polyglot services over gRPC + an event backbone | [surface-event-driven-microservices](skills/backend/references/surface-event-driven-microservices.md) | Modular-monolith-first gate, database-per-service consequences (saga/CQRS), inter-service contract evolution, sync-vs-async classification |\n| **Agentic** — backend serving an LLM/agent system, stacked additively on the base surface | [surface-agentic](skills/backend/references/surface-agentic.md) | **Durable execution as default control plane, tool/MCP endpoints, agent-legible typed contracts + errors, RAG plumbing, agent-scoped short-lived tokens** |\n\nPlus [handoff](skills/backend/references/handoff.md) — the `handoff.yaml` companion to `operate`\n(deploy/monitor) and `quality` (independent verification) when downstream work is expected.\n\n## Outputs\n\nA running implementation plus the decision record behind it: endpoint/handler code, a domain/service\nlayer, schema and migrations, auth wiring, job/queue setup, cache and rate-limit configuration, an\nOWASP controls table, resilient outbound client wrappers, and the test suite that proves it all\nruns — plus fillable checklists and a `handoff.yaml` companion that feeds `operate`/`quality`\ndownstream, grounded in the framework each artifact names, never a generic template dump.\n\n## Reference and asset library\n\n15 references under `skills/backend/references/` (9 primary jobs, 5 surface overlays, 1 handoff\ncontract) and 8 fillable assets under `skills/backend/assets/`:\n\n- **Assets:** `backend-service-scaffold.md` · `migration-template.md` ·\n  `auth-implementation-checklist.md` · `owasp-backend-controls-checklist.md` ·\n  `idempotency-and-outbox-recipes.md` · `api-contract-review-checklist.md` ·\n  `verification-loop-template.md` · `handoff.yaml`\n\n## Digital Product lifecycle\n\n`backend` is the server-side half of the **Build** stage, peer of `frontend`: it consumes\n`architecture`'s contracts, NFR budgets, threat model, and `handoff.yaml` upstream, and hands its\nown running services and telemetry hooks to `operate` and its test suite to `quality` downstream,\nwith `data` and `ai` consumed rather than owned for OLAP pipelines and the agent core respectively.\nIt works standalone with no upstream artifact required, and never silently invokes a sibling skill.\n\n## Repository layout\n\n```text\nskills/backend/    runtime skill (SKILL.md + 15 references + 8 assets + agents/openai.yaml)\nevals/              activation · traversal · output · compression-ablation fixtures\ndocs/                installation and usage\n.codex-plugin/      plugin manifest\n```\n\n## Documentation & releases\n\n- [docs/installation.md](docs/installation.md) · [docs/usage.md](docs/usage.md) ·\n  [docs/recipes.md](docs/recipes.md)\n- [CHANGELOG.md](CHANGELOG.md) — release history (current: v0.1.0)\n- [SOURCES.md](SOURCES.md) — framework attribution and license posture\n- [CONTRIBUTING.md](CONTRIBUTING.md) — local validation (`scripts/lint-skill`, `scripts/check-sync`)\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n"}