decompose
/decompose — reverse-engineer an undocumented API surface
Take a target you can legitimately access — a hosted web API (with or without authentication) or a smart device on your own LAN — and produce: an enumerated endpoint list (or topic / resource / characteristic map for non-HTTP protocols), a draft OpenAPI spec (or Postman collection / annotated catalog), the auth flow documented end-to-end where one exists (refresh / pairing), and a working command-line or script client. The skill is ordered by efficiency-of-discovery — the cheapest phases come first, because the API is often already documented somewhere (Postman public workspaces for web; Home Assistant integrations for IoT) and passive observation gets you 60–80% of the surface before any proxy or deobfuscator is touched.
The skill works equally for: public, unauthenticated APIs (the API behind a public website; an open data portal whose docs aren't current); private/authenticated APIs (a SaaS dashboard you log into); and LAN smart devices.
When to use
- User says "/decompose", "reverse engineer the API for X", "find the endpoints behind X", "build a client for this internal app", or wants an OpenAPI for a service that has none.
- A public website calls an API the maintainers don't document (open data, transit, weather, sports, real-estate listings, etc.) and the user wants programmatic access.
- A product the user uses has no public API but a working web client they are logged into.
- A smart device on the user's LAN (light, plug, thermostat, camera, robot vac, hub) has no documented local API and the user wants to control it locally or integrate it with Home Assistant / Node-RED / their own code.
- A bug-bounty target is in scope and the user wants to map the surface.
- A CTF / research engagement requires understanding an undocumented backend.
When NOT to use
More from patrickruddiman/skills
spec
Write a detailed, objective specification of WHAT a system does and WHY. No code, no file paths, no library picks, no implementation prescriptions of any kind. The spec is read by an AI coding agent that will produce its own plan; the spec exists to bound the problem completely — every user-visible behavior, persona task, lifecycle transition, and failure mode.
10slice
Produce a scoped design doc for one technical vertical of a parent spec. Researches the existing codebase first, surfaces implementation choices as questions one at a time, and only drafts the doc after the user resolves them. No code, no tasks — design only.
9create-tasks
Break a slice into AI-executable task files. Each task has a checkbox Tasks section (file paths, line numbers, technical detail — no code) and a strictly code-verifiable Acceptance criteria section that always includes a test command. The consuming AI must tick checkboxes as it works; create-tasks uses that to decide whether to edit a task in place on re-run or append a new one.
9hunt
Aggressively debug, diagnose, or root-cause an issue. Drives a disciplined hunt — query telemetry, reproduce, bisect, instrument, hypothesize-test-confirm, and verify causation by reverting the fix. Refuses common anti-patterns (fix-without-repro, symptom suppression, multi-variable changes, theorize-without-running). Use when the user types /hunt or asks to debug, diagnose, root-cause, track down, or figure out a bug, crash, regression, flaky test, or unexplained behavior.
7worktree
Create or enter a git worktree for the current repo. New worktrees are named repo-<slug>, placed as a sibling of the repo root, and check out a branch (existing or new). Use when the user says "/worktree", "spin up a worktree", "branch off into a worktree", "hop into worktree X", or wants to work on a separate branch in parallel without disturbing the current checkout.
6schedule
Schedule a one-shot task (Windows/Linux/macOS) to run a command or prompt at a specific time or after a delay. Use when the user says "schedule", "/schedule", "in N minutes/seconds run", "at HH:MM run", "remind me to run", "queue this for later", or wants a task to fire reliably while they step away.
6