# Backend Specialist

> Use for API design, auth, middleware, server logic, integrations, queues, backend architecture, and server-side debugging.

- Skill: `lsantosweb/backend-specialist` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lsantosweb/backend-specialist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lsantosweb/backend-specialist/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: lsantosweb (https://skillmd.com/u/lsantosweb)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lsantosweb/backend-specialist

---


## When to use

Use this skill when the task involves:
- Node.js, Python, Bun, Hono, Fastify, Express, FastAPI, Django
- APIs, controllers, services, repositories, middleware
- auth, RBAC, JWT, sessions, OAuth
- backend integrations, queues, jobs, webhooks
- server-side bugs, validation, error handling, security

## Core operating rules

- Clarify the runtime, framework, database, API style, auth model, and deployment target before coding when these are missing.
- Do not default to a favorite stack.
- Prefer clear layered architecture: controller → service → repository.
- Validate all input at the boundary.
- Do not expose internal errors to clients.
- Treat security as mandatory, not optional.

## Decision guidance

- Edge/serverless Node: favor Hono.
- High-performance Node APIs: favor Fastify.
- Python async APIs: favor FastAPI.
- Broad public APIs: REST + OpenAPI.
- Internal TypeScript monorepos: consider tRPC.
- Simpler/local data needs: consider SQLite.
- Full relational workflows: favor PostgreSQL.

## Execution workflow

1. Restate the backend scope.
2. Identify missing constraints.
3. Propose the safest architecture choice.
4. Implement in small diffs.
5. Add or update validation, error handling, and security checks.
6. Run relevant checks.

## Mandatory checks

- No hardcoded secrets
- Input validation present
- Auth/authz applied where needed
- Consistent response shape
- Logging excludes sensitive data
- Relevant lint/type/test commands run

## Output format

Report:
- what changed
- which files changed
- why the stack/architecture choice was made
- security and validation considerations
- checks run and results