spb/ultra-sharp-agent-skills Public

1<!--2Author: Simon-Pierre Boucher3Contact: contact@spboucher.ai4-->56# backend-skills — Backend Development Skill Collection78**Author:** Simon-Pierre Boucher9**Contact:** contact@spboucher.ai1011Twenty ultra-sharp backend skills following the method in12[../RESEARCH-SYNTHESIS.md](../RESEARCH-SYNTHESIS.md). Database-specific work13lives in [../db-skills/](../db-skills/) — this collection deliberately14excludes it. All pass `python3 ../tools/validate_skills.py`.1516## The collection and its boundaries1718**API design**19| Skill | Handles | Explicitly does NOT handle |20|---|---|---|21| `designing-rest-apis` | resources, methods, status codes, pagination, versioning, problem+json, OpenAPI | GraphQL; webhooks; auth mechanics |22| `designing-graphql-apis` | schema design, DataLoader/N+1, cursor pagination, complexity limits | REST; subscriptions infra |23| `designing-webhooks` | payloads, HMAC signing, retries, idempotent delivery | consuming webhooks' business logic; internal messaging |24| `handling-file-uploads` | presigned URLs, validation, safe naming, streaming, resumable | serving files; image processing; CDNs |2526**Security (defensive)**27| Skill | Handles | Explicitly does NOT handle |28|---|---|---|29| `implementing-authentication` | password storage, sessions vs JWT, OAuth2/OIDC + PKCE, MFA, resets | permissions → `implementing-authorization`; DB creds → db-skills |30| `implementing-authorization` | RBAC/ABAC, deny-by-default, IDOR, tenant isolation, policy centralization | login/identity → `implementing-authentication` |31| `validating-input` | boundary schemas, allowlists, canonicalization, 422 responses | authn/authz; deep business rules |32| `securing-backend-services` | headers, TLS, dependencies, secrets, SSRF/CSRF, least privilege | login, permissions, input validation, DB security (see above) |3334**Reliability & operations**35| Skill | Handles | Explicitly does NOT handle |36|---|---|---|37| `handling-errors` | error taxonomy, problem+json mapping, retries, circuit breakers | validation responses; observability pipelines |38| `instrumenting-observability` | structured logs, correlation IDs, RED metrics, OpenTelemetry, alerting | error-handling code; incident process |39| `testing-backend-services` | test pyramid, testcontainers, contract tests, determinism | UI testing; load testing |40| `managing-configuration` | 12-factor env config, startup validation, secrets separation | infra provisioning; CI/CD config |4142**Async & performance**43| Skill | Handles | Explicitly does NOT handle |44|---|---|---|45| `writing-background-jobs` | idempotent jobs, retries/backoff, DLQ, timeouts | inter-service messaging; system cron |46| `handling-async-messaging` | outbox pattern, event versioning, ordering, poison messages | in-process job queues; customer webhooks |47| `caching-strategies` | cache-aside, TTL discipline, invalidation, stampede protection | CDN/edge config; SQL tuning → db-skills |48| `limiting-request-rates` | token bucket, 429/Retry-After, tiered limits, load shedding | authorization; capacity planning |4950**Infrastructure & architecture**51| Skill | Handles | Explicitly does NOT handle |52|---|---|---|53| `containerizing-services` | multi-stage builds, non-root, layer caching, health checks | Kubernetes; pipeline design |54| `shipping-with-ci-cd` | stages, build-once-promote, deploy strategies, rollback | writing tests; Dockerfiles |55| `architecting-service-boundaries` | modular monolith default, data ownership, sagas, strangler | messaging mechanics; endpoint design |56| `scaling-backend-services` | statelessness, pooling, load balancing, autoscaling, replicas | query tuning; caching; rate limiting |5758## Shared conventions5960- Description = WHAT + "Use when …" (literal phrases) + "Do not use for …"61- One default per decision with an escape hatch; concrete values over adjectives62- Every workflow ends with a validation step (replay a job twice, boot with a missing var, kill an instance mid-deploy)63- `SKILL.md` <150 lines; depth in `references/patterns.md` (with TOC)64