Use when you need to review third-party service, webhook, queue, and cross-system integration boundaries.
How this skill is triggered — by the user, by Claude, or both
Slash command
/skillry-backend-and-api:15-integration-boundary-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review the code that crosses a system boundary — outbound HTTP calls to third-party APIs, inbound webhook handlers, message-queue producers/consumers, and internal service-to-service calls — for the reliability and correctness failures that only appear under real network conditions: missing timeouts, retry storms without backoff, bypassed webhook signature verification, duplicate message proces...
Review the code that crosses a system boundary — outbound HTTP calls to third-party APIs, inbound webhook handlers, message-queue producers/consumers, and internal service-to-service calls — for the reliability and correctness failures that only appear under real network conditions: missing timeouts, retry storms without backoff, bypassed webhook signature verification, duplicate message processing, and absent circuit breaking. Each finding is rated by severity with a concrete fix, and any missing webhook signature check is treated as a critical, surface-immediately issue.
axios, fetch(, https.request, got(, SDK client methods. For each, note the service, the operation, and whether it sits in a critical path (synchronous in a request handler) or a background path (worker, cron).stripe.webhooks.constructEvent(rawBody, sig, secret). GitHub: HMAC-SHA256 of the raw body. Twilio: validateRequest(...). An unverified webhook is an unauthenticated write endpoint anyone can trigger.if exists(processed_events, event.id) return) and a dedup write inside the same transaction as the business operation.429 Too Many Requests must trigger a backoff honoring the Retry-After header, not an immediate retry. A proactive client-side limiter or request queue protects strict monthly quotas.429 responses respect Retry-After and back off.# Inventory outbound call sites
rg -n "axios\.|fetch\(|https?\.request|got\(|new .*Client\(" src/
# Calls missing an explicit timeout
rg -n "axios\.(get|post|put|delete|patch)\(" src/ | rg -v "timeout"
rg -n "fetch\(" src/ | rg -v "signal|AbortSignal\.timeout"
# Webhook handlers and whether they verify a signature
rg -n "router\.(post|all).*webhook|/webhook" src/
rg -n "constructEvent|validateRequest|hmac|createHmac|X-Hub-Signature|stripe-signature" src/
# Retry on non-retryable codes (smell: retrying 400/401/422)
rg -nU "retry[\s\S]{0,120}(400|401|422)" src/
# Consumer idempotency: dedup check before processing
rg -n "processed_events|idempotency|dedup|alreadyProcessed|message.*id" src/
# Circuit breaker presence
rg -n "opossum|cockatiel|circuitBreaker|resilience4j|breaker" src/
# Queue producer relative to transaction commit (outbox?)
rg -nU "(commit|COMMIT)[\s\S]{0,120}(publish|enqueue|sendMessage)" src/ ; rg -n "outbox" src/
# Raw-body access for webhooks (HMAC needs bytes, not parsed JSON)
rg -n "express\.raw\(|bodyParser\.raw|rawBody|request\.body\b" src/ | rg -i "webhook|stripe|hmac"
# Retry-After honored on 429?
rg -nU "429[\s\S]{0,120}(Retry-After|retryAfter|getResponseHeader)" src/ || echo "429 backoff not found"
# Timeouts that are dangerously high or absent on a critical path
rg -n "timeout:\s*(0|[6-9][0-9]{4,}|[0-9]{6,})" src/ # 0 = infinite, or > ~60s
# Replay protection: is the event timestamp checked against a tolerance window?
rg -nU "(timestamp|event\.created|tolerance)[\s\S]{0,120}(Date\.now|now\(\)|maxAge)" src/ \
|| echo "no replay/timestamp window found"
# Heavy work done synchronously inside a webhook handler (deadline risk)
rg -nU "(webhook|/hooks)[\s\S]{0,400}(sendEmail|await db\.|fetch\(|render)" src/ | head
# DLQ / failure routing for consumers (dropped vs parked on failure)
rg -n "deadLetter|dlq|nack|reject\(|moveToFailed|toDeadLetter" src/ || echo "no DLQ wiring found"
// WRONG: webhook trusted without verifying the signature
app.post('/webhook', express.json(), (req, res) => {
fulfill(req.body.data.object); // any caller can forge this
res.sendStatus(200);
});
// RIGHT: verify the signature against the RAW body before doing anything
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
let event;
try { event = stripe.webhooks.constructEvent(req.body, req.headers['stripe-signature'], secret); }
catch { return res.sendStatus(400); } // reject forged/replayed events
if (await seen(event.id)) return res.sendStatus(200); // idempotent on re-delivery
await db.transaction(async (tx) => { await fulfill(tx, event); await markSeen(tx, event.id); });
res.sendStatus(200);
});
| Provider | Verify with | Body form |
|---|---|---|
| Stripe | stripe.webhooks.constructEvent(raw, sig, secret) | raw bytes |
| GitHub | HMAC-SHA256 of raw body vs X-Hub-Signature-256 | raw bytes |
| Twilio | twilio.validateRequest(token, sig, url, params) | parsed params + URL |
| Slack | HMAC-SHA256 of v0:ts:body vs X-Slack-Signature | raw body + timestamp |
req.body after a JSON middleware re-serialized it produces a different byte string and the check fails (or worse, is loosened to "skip if parse"). Capture the raw body.Authorization header to a third party. Log the error code and request ID only.Report must include: third-party call inventory (service, operation, critical/background, timeout configured); retry configuration findings (strategy, backoff, max, non-retryable codes); webhook signature status per provider (validated / missing / misconfigured); idempotency status (dedup mechanism + transactional correctness); circuit-breaker status per critical dependency; rate-limit handling (429 backoff); queue producer delivery guarantee (outbox / post-commit / fire-and-forget); and a severity rating per finding.
Done means every boundary call site is inventoried with its timeout and retry posture, each webhook handler's signature verification is confirmed or flagged critical, consumer idempotency and queue-producer delivery guarantees are assessed, circuit-breaker and rate-limit handling are reported, and every finding has a severity and a concrete fix.
npx claudepluginhub fluxonlab/skillry --plugin skillry-backend-and-apiProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.