[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EQKBH3YA7BRP4TSTF96F0B":3,"skill-same:01M6EQKBH3YA7BRP4TSTF96F0B":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6EQKBH3YA7BRP4TSTF96F0B","backend-fundamentals",null,"Auto-invoke when reviewing API routes, server logic, Express\u002FNode.js code, or backend architecture. Enforces REST conventions, middleware patterns, and separation of concerns.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fbackend-fundamentals\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"backend fundamentals","backend","auto","middleware","separation","separation of concerns","logic","express","conventions","patterns","architecture","node","js","api","REST","server","code","2026-11-10 10:12:30",false,"---\nname: backend-fundamentals\ndescription: Auto-invoke when reviewing API routes, server logic, Express\u002FNode.js code, or backend architecture. Enforces REST conventions, middleware patterns, and separation of concerns.\n---\n\n# Backend Fundamentals Review\n\n> \"APIs are contracts. Break them, and you break trust.\"\n\n## When to Apply\n\nActivate this skill when reviewing:\n- API route handlers\n- Express\u002FFastify\u002FHono middleware\n- Database queries and models\n- Authentication\u002Fauthorization logic\n- Server-side business logic\n\n---\n\n## Review Checklist\n\n### API Design\n\n- [ ] **RESTful**: Do routes follow REST conventions? (GET for read, POST for create, etc.)\n- [ ] **Naming**: Are endpoints nouns, not verbs? (`\u002Fusers` not `\u002FgetUsers`)\n- [ ] **Versioning**: Is API versioned for future changes? (`\u002Fapi\u002Fv1\u002F`)\n- [ ] **Status Codes**: Are correct HTTP status codes returned?\n\n### Separation of Concerns\n\n- [ ] **Routes**: Do routes only handle HTTP concerns (req\u002Fres)?\n- [ ] **Controllers**: Is business logic in controllers\u002Fservices, not routes?\n- [ ] **Services**: Is data access abstracted from business logic?\n- [ ] **Models**: Are models responsible only for data shape\u002Fvalidation?\n\n### Error Handling\n\n- [ ] **Try\u002FCatch**: Are async operations wrapped properly?\n- [ ] **Error Responses**: Are errors returned with proper status codes?\n- [ ] **Logging**: Are errors logged with context?\n- [ ] **No Leaks**: Are internal errors hidden from clients?\n\n### Security\n\n- [ ] **Input Validation**: Is ALL input validated before use?\n- [ ] **Authentication**: Are protected routes actually protected?\n- [ ] **Authorization**: Can users only access their own data?\n- [ ] **Rate Limiting**: Are endpoints protected from abuse?\n\n---\n\n## Common Mistakes (Anti-Patterns)\n\n### 1. Fat Routes\n```\n❌ app.post('\u002Fusers', async (req, res) => {\n     \u002F\u002F 100 lines of validation, business logic, DB queries\n   });\n\n✅ app.post('\u002Fusers', validateUser, userController.create);\n```\n\n### 2. No Input Validation\n```\n❌ const { email } = req.body;\n   await db.query(`SELECT * FROM users WHERE email = '${email}'`);\n\n✅ const { email } = validateBody(req.body, userSchema);\n   await User.findByEmail(email); \u002F\u002F parameterized\n```\n\n### 3. Wrong Status Codes\n```\n❌ res.status(200).json({ error: 'Not found' });\n\n✅ res.status(404).json({ error: 'User not found' });\n```\n\n### 4. Leaking Internal Errors\n```\n❌ catch (error) {\n     res.status(500).json({ error: error.message, stack: error.stack });\n   }\n\n✅ catch (error) {\n     logger.error('User creation failed', { error, userId });\n     res.status(500).json({ error: 'Something went wrong' });\n   }\n```\n\n---\n\n## Socratic Questions\n\nAsk the junior these questions instead of giving answers:\n\n1. **Architecture**: \"If I wanted to switch from Express to Fastify, what would need to change?\"\n2. **Validation**: \"What happens if someone sends malformed JSON?\"\n3. **Auth**: \"How do you know this user owns this resource?\"\n4. **Errors**: \"What does the client see when the database is down?\"\n5. **Testing**: \"How would you test this endpoint in isolation?\"\n\n---\n\n## HTTP Status Code Reference\n\n| Code | When to Use |\n|------|-------------|\n| 200 | Success (with body) |\n| 201 | Created (after POST) |\n| 204 | Success (no content, after DELETE) |\n| 400 | Bad request (validation failed) |\n| 401 | Unauthorized (not logged in) |\n| 403 | Forbidden (logged in but not allowed) |\n| 404 | Not found |\n| 409 | Conflict (duplicate resource) |\n| 500 | Server error (hide details from client) |\n\n---\n\n## Architecture Layers\n\n```\nRequest → Route → Controller → Service → Repository → Database\n                     ↓\n              Middleware (auth, validation, logging)\n```\n\n| Layer | Responsibility |\n|-------|----------------|\n| Route | HTTP verbs, paths, middleware chain |\n| Controller | Request\u002Fresponse handling, calling services |\n| Service | Business logic, orchestration |\n| Repository | Data access, queries |\n\n---\n\n## Red Flags to Call Out\n\n| Flag | Question to Ask |\n|------|-----------------|\n| SQL in route handler | \"Should data access be in a separate layer?\" |\n| No try\u002Fcatch on async | \"What happens if this fails?\" |\n| req.body used directly | \"What if someone sends unexpected fields?\" |\n| Hardcoded secrets | \"How would this work in production?\" |\n| No pagination on list endpoints | \"What if there are 10,000 records?\" |\n","# Backend Fundamentals Review\n\n> \"APIs are contracts. Break them, and you break trust.\"\n\n## When to Apply\n\nActivate this skill when reviewing:\n- API route handlers\n- Express\u002FFastify\u002FHono middleware\n- Database queries and models\n- Authentication\u002Fauthorization logic\n- Server-side business logic\n\n---\n\n## Review Checklist\n\n### API Design\n\n- [ ] **RESTful**: Do routes follow REST conventions? (GET for read, POST for create, etc.)\n- [ ] **Naming**: Are endpoints nouns, not verbs? (`\u002Fusers` not `\u002FgetUsers`)\n- [ ] **Versioning**: Is API versioned for future changes? (`\u002Fapi\u002Fv1\u002F`)\n- [ ] **Status Codes**: Are correct HTTP status codes returned?\n\n### Separation of Concerns\n\n- [ ] **Routes**: Do routes only handle HTTP concerns (req\u002Fres)?\n- [ ] **Controllers**: Is business logic in controllers\u002Fservices, not routes?\n- [ ] **Services**: Is data access abstracted from business logic?\n- [ ] **Models**: Are models responsible only for data shape\u002Fvalidation?\n\n### Error Handling\n\n- [ ] **Try\u002FCatch**: Are async operations wrapped properly?\n- [ ] **Error Responses**: Are errors returned with proper status codes?\n- [ ] **Logging**: Are errors logged with context?\n- [ ] **No Leaks**: Are internal errors hidden from clients?\n\n### Security\n\n- [ ] **Input Validation**: Is ALL input validated before use?\n- [ ] **Authentication**: Are protected routes actually protected?\n- [ ] **Authorization**: Can users only access their own data?\n- [ ] **Rate Limiting**: Are endpoints protected from abuse?\n\n---\n\n## Common Mistakes (Anti-Patterns)\n\n### 1. Fat Routes\n```\n❌ app.post('\u002Fusers', async (req, res) => {\n     \u002F\u002F 100 lines of validation, business logic, DB queries\n   });\n\n✅ app.post('\u002Fusers', validateUser, userController.create);\n```\n\n### 2. No Input Validation\n```\n❌ const { email } = req.body;\n   await db.query(`SELECT * FROM users WHERE email = '${email}'`);\n\n✅ const { email } = validateBody(req.body, userSchema);\n   await User.findByEmail(email); \u002F\u002F parameterized\n```\n\n### 3. Wrong Status Codes\n```\n❌ res.status(200).json({ error: 'Not found' });\n\n✅ res.status(404).json({ error: 'User not found' });\n```\n\n### 4. Leaking Internal Errors\n```\n❌ catch (error) {\n     res.status(500).json({ error: error.message, stack: error.stack });\n   }\n\n✅ catch (error) {\n     logger.error('User creation failed', { error, userId });\n     res.status(500).json({ error: 'Something went wrong' });\n   }\n```\n\n---\n\n## Socratic Questions\n\nAsk the junior these questions instead of giving answers:\n\n1. **Architecture**: \"If I wanted to switch from Express to Fastify, what would need to change?\"\n2. **Validation**: \"What happens if someone sends malformed JSON?\"\n3. **Auth**: \"How do you know this user owns this resource?\"\n4. **Errors**: \"What does the client see when the database is down?\"\n5. **Testing**: \"How would you test this endpoint in isolation?\"\n\n---\n\n## HTTP Status Code Reference\n\n| Code | When to Use |\n|------|-------------|\n| 200 | Success (with body) |\n| 201 | Created (after POST) |\n| 204 | Success (no content, after DELETE) |\n| 400 | Bad request (validation failed) |\n| 401 | Unauthorized (not logged in) |\n| 403 | Forbidden (logged in but not allowed) |\n| 404 | Not found |\n| 409 | Conflict (duplicate resource) |\n| 500 | Server error (hide details from client) |\n\n---\n\n## Architecture Layers\n\n```\nRequest → Route → Controller → Service → Repository → Database\n                     ↓\n              Middleware (auth, validation, logging)\n```\n\n| Layer | Responsibility |\n|-------|----------------|\n| Route | HTTP verbs, paths, middleware chain |\n| Controller | Request\u002Fresponse handling, calling services |\n| Service | Business logic, orchestration |\n| Repository | Data access, queries |\n\n---\n\n## Red Flags to Call Out\n\n| Flag | Question to Ask |\n|------|-----------------|\n| SQL in route handler | \"Should data access be in a separate layer?\" |\n| No try\u002Fcatch on async | \"What happens if this fails?\" |\n| req.body used directly | \"What if someone sends unexpected fields?\" |\n| Hardcoded secrets | \"How would this work in production?\" |\n| No pagination on list endpoints | \"What if there are 10,000 records?\" |\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fbackend-fundamentals",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill backend-fundamentals",{"tool":66,"command":67},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill backend-fundamentals",{"tool":69,"command":70},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill backend-fundamentals","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fbackend-fundamentals\u002FSKILL.md",true,[74],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"skill-report.json","REFERENCE","参考文档",9695,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fdanielpodolsky\u002Fbackend-fundamentals\u002Fskill-report.json",[81,93,103,112,118,125],{"skillNo":82,"name":83,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":89,"publishedAt":46},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[90,91,92],"model","model hierarchy","model hierarchy skill",{"skillNo":94,"name":95,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":99,"publishedAt":46},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[98],{"categoryNo":87,"categoryName":88,"taxonomyType":21,"taxonomyTypeDesc":22},[100,101,102],"MCP","zoom","zoom mcp",{"skillNo":104,"name":105,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":46},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[109,110,111,101],"sdk","zoom apps sdk","apps",{"skillNo":113,"name":114,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":46},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[114],{"skillNo":119,"name":120,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":124,"publishedAt":46},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[123],{"categoryNo":87,"categoryName":88,"taxonomyType":21,"taxonomyTypeDesc":22},[120],{"skillNo":126,"name":127,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":46},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[127]]