API Design Rules
- All endpoints must validate input with Zod schemas
- Return shape: { data: T } | { error: string }
- Rate limit all public endpoints
\}] \}, \{ id: 'skills', label: 'skills/', type: 'folder', icon: 'folder', color: '#D4A843', oneLiner: 'Reusable prompts you or Claude invoke by name', when: <>Invoked with <C>/skill-name</C> or when Claude matches the task to a skill</>, description: <>Each skill is a folder with a SKILL.md file plus any supporting files it needs. By default, both you and Claude can invoke a skill. Use frontmatter to control that: <C>disable-model-invocation: true</C> for user-only workflows like <C>/deploy</C>, or <C>user-invocable: false</C> to hide from the <C>/</C> menu while Claude can still invoke it.</>, tips: [<>Skills accept arguments: <C>/deploy staging</C> passes "staging" as <C>$ARGUMENTS</C>. Use <C>$0</C>, <C>$1</C>, and so on for positional access</>, <>The <C>description</C> frontmatter determines when Claude auto-invokes the skill</>, 'Bundle reference docs alongside SKILL.md. Claude knows the skill directory path and can read supporting files when you mention them'], docsLink: '/en/skills', children: [{ id: 'skill-review', label: 'security-review/', type: 'folder', icon: 'folder', color: '#D4A843', oneLiner: 'A skill bundling SKILL.md with supporting files', children: [{ id: 'skill-review-md', label: 'SKILL.md', type: 'file', icon: 'md', color: '#D4A843', badge: 'committed', oneLiner: 'Entrypoint: trigger, invocability, instructions', when: <>User types <C>/security-review <target></C>; Claude cannot auto-invoke this skill</>, description: [<>This skill uses <C>disable-model-invocation: true</C> so only you can trigger it; Claude never invokes it on its own.</>, <>The <C>!...</C> line runs a shell command and injects its output into the prompt. <C>$ARGUMENTS</C> substitutes whatever you typed after the skill name. Claude sees the skill directory path, so mentioning a bundled file like checklist.md lets Claude read it.</>], example:--- description: Reviews code changes for security vulnerabilities, authentication gaps, and injection risks disable-model-invocation: true