skills.rest
machenjie
machenjieCOMMUNITY
Explore all skills by this author →
GitHub

extensibility-design

Design extension points with versioned compatibility contracts and bounded security scope.

4|Updated May 16, 2026
Search Tags:#versioning#observability#API contracts#plugin architecture#extension points#security sandbox#invariant safety
One-click install
npx skills add https://github.com/machenjie/rd-skills --skill extensibility-design
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: extensibility-design
Source: https://github.com/machenjie/rd-skills/tree/main/src/foundation/capabilities/extensibility-design
Command: npx skills add https://github.com/machenjie/rd-skills --skill extensibility-design

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Extensibility decisions often create long-lived complexity and security risk when teams generalize too early, let extensions bypass invariants, or fail to version compatibility boundaries.

Core Features & Use Cases

  • Extension point governance: Establishes when extension points are justified by proven variation and explicit ownership.
  • Non-bypassable domain invariants: Defines rules that extensions must not circumvent (validation, authorization, tenant isolation, audit, and financial correctness).
  • Versioned compatibility contracts: Specifies how extension interfaces and configs evolve with breaking-change policies and deprecation timelines.
  • Security boundary & sandboxing: Requires explicit policies for network, filesystem, and database access, including SSRF and untrusted input handling.
  • Validation & observability: Mandates strict schema validation for extension-supplied data and per-invocation tracing for debugging and incident response.

Quick Start

Use the extensibility-design skill to produce a guarded extension point plan for a new plugin interface, hook system, or configuration-driven provider mechanism in your product.

Frequently Asked Questions about extensibility-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design a safe plugin architecture that prevents extensions from bypassing domain invariants?▼

Versioned compatibility contracts specify how extension interfaces and configurations evolve by defining breaking-change policies and deprecation timelines. This ensures third-party plugin interfaces and hook systems maintain backward compatibility while evolving safely.

What is the best way to handle SSRF risks and untrusted input in webhook callback integrations?▼

The best way to handle SSRF risks in webhook integrations is enforcing strict security boundaries and explicit sandboxing. Require explicit policies for network, filesystem, and database access, including SSRF-safe URL handling and strict validation of untrusted extension-supplied data.

When do I need versioned extension points for configuration schemas and registries?▼

Per-extension observability is required for plugin interfaces to ensure traceability for debugging and incident response. Mandating per-invocation tracing alongside strict schema validation for extension-supplied data guarantees reliable monitoring across hook systems and provider mechanisms.

How do I prevent speculative abstraction when creating a hook system or provider mechanism?▼

Prevent speculative abstraction in hook systems by establishing extension point governance justified by proven variation and explicit ownership. Require explicit variation criteria before generalizing interfaces to avoid long-lived complexity and security risks in your provider mechanism.

Related Skills

Explore More Software Engineering Skills→
majiayu000majiayu000
12

sage-core-module-guide

Document sage-core module responsibilities, dependencies, and extension points.

Community
Advanced
yaklangyaklang
1.6k

upload-insecure-files

Identify insecure file upload paths across validation, storage, and processing boundaries.

Official
Advanced
v0lkav0lka
15

vibespec-consult

Locate and read project specification files to extract invariants before structural changes.

Community
Advanced
JordanCoinJordanCoin
6

yagni

Guide code design and review to avoid speculative features and premature abstraction.

Community
Intermediate