API Development
Apply when creating API routes, handling errors, validating input, or designing API responses
Examining code for the line that is wrong
What it does
Systematic REST API development with error handling, validation, and consistent response formats.
What it can touch
No script files in its folder
Its folder holds text, not programs. It changes how your AI works; it does not bring code of its own.
How we know
Listed the 32 files in the skill’s folder on GitHub; none is a script or program.
Mentions an outside service
The instructions point your AI at these sites or APIs. Anything it sends there leaves your computer.
How we know
Web addresses in the SKILL.md, excluding GitHub and documentation sites: tools.ietf.org.
Lets your AI run any terminal command without asking, while the skill is in use
While the skill is working, Claude Code will not stop to ask before each terminal command. The permission ends when you send your next message.
How we know
api-development-skill.md line 1: “allowed-tools: Read, Write, Edit, Bash”. Read 2026-10-04, commit 4dedd94.
api-development-skill.md, line 1 ↗Asks for administrator rights
Some of its commands use sudo or "run as administrator". Those can change anything on your computer.
How we know
Seen in its code. Read 2026-10-04, commit 4dedd94.
7 smaller things worth knowing
Runs a well-known installer straight from the web; Sets itself up to run again automatically later; Contains commands that delete or overwrite; Refers to a credentials file (SSH keys, cloud logins, tokens); and more. Usually legitimate — listed so nothing is hidden.
How we know
Runs a well-known installer straight from the web — aws-cloud-infrastructure-skill.md line 79; Sets itself up to run again automatically later — aws-cloud-infrastructure-skill.md line 202; Contains commands that delete or overwrite — database-migrations.md line 61; Contains commands that delete or overwrite — git-workflow-skill.md line 344; Refers to a credentials file (SSH keys, cloud logins, tokens) — owasp-security-audit-skill.md line 327; Refers to a credentials file (SSH keys, cloud logins, tokens) — penetration-testing-skill.md line 172. Read 2026-10-04, commit 4dedd94.
aws-cloud-infrastructure-skill.md, line 79 ↗aws-cloud-infrastructure-skill.md, line 202 ↗database-migrations.md, line 61 ↗git-workflow-skill.md, line 344 ↗owasp-security-audit-skill.md, line 327 ↗penetration-testing-skill.md, line 172 ↗No serious risk pattern found
Launch7’s automated check read all 32 text files in this skill and matched none of its serious risk patterns. This is not a guarantee: a check like this can miss new or disguised tricks, and the author can change the files after the check.
How we know
Read 2026-10-04, commit 4dedd94 by pipeline/trust/analyze.py — 40+ patterns for hidden text, prompt injection, downloads that run, credential access and more. It reads; it never runs the skill.
Updated this year
Its repository has had changes recently.
How we know
Last push to ThamJiaHe/claude-code-handbook: 2026-04-19 (168 days before the scan).
Read automatically from the skill’s own files on GitHub on 4 Oct 2026. Launch7 does not run or manually review skills: this lists what the check saw, and nothing here means “safe”. How we check
Add it to your AI
Supported. Upload it once in Claude’s settings. Works on every plan, including Free.
Built in your browser from the SKILL.md on GitHub — nothing passes through Launch7.
In Claude, open Customize → Skills, press +, then Create skill → Upload a skill, and choose the .zip.
Make sure code execution is switched on (Settings → Capabilities). Skills need it.
Start a new chat and ask for the job in your own words — Claude picks the skill up when it fits.
How Claude does this: support.claude.com · checked 28 Sep 2026 · “Supported” means documented by the vendor; Launch7 has not run it end to end
More from ThamJiaHe
All from this publisher →- Build Error Resolver
Apply when builds fail, TypeScript reports errors, or CI/CD pipelines break
- Cybersecurity Threat Modeling
Apply when designing new systems, reviewing architecture, or assessing security posture of existing applications
- Docker Containerization
Apply when creating Dockerfiles, docker-compose configs, or deploying containerized applications
- Google Cloud Platform & APIs
Apply when building serverless applications, integrating Google services, or deploying to GCP
- Monitoring & Logging
Apply when setting up monitoring, tracking errors, debugging production issues, or configuring dashboards
