القائمة
API testing automation skill — executes HTTP requests, validates responses, and generates test reports with security scanning.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/theneoai/skill-writer --skill api-testerيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
| name | api-tester |
| version | 1.0.0 |
| description | API testing automation skill — executes HTTP requests, validates responses, and generates test reports with security scanning. |
| description_i18n | {"en":"Automated API testing: execute requests, validate responses, batch testing, security checks.","zh":"自动化API测试：执行请求、验证响应、批量测试、安全检查。"} |
| license | MIT |
| author | {"name":"theneoai"} |
| created | 2026-03-31 |
| updated | 2026-04-11 |
| type | api-integration |
| skill_tier | functional |
| tags | ["api","testing","validation","security","automation"] |
| triggers | {"en":["test this API","run API tests","validate API response","check API endpoint","batch test APIs","API security scan"],"zh":["测试这个API","验证API响应","批量API测试","API安全扫描","检查API端点","校验API响应"]} |
| interface | {"input":"user-natural-language","output":"structured-json","modes":["test","validate","batch"]} |
| api | {"name":"Generic HTTP API","base_url":"https://api.example.com","auth_method":"bearer-token","auth_env_var":"API_TEST_TOKEN","rate_limit":"100 req/min","docs_url":"https://developer.mozilla.org/en-US/docs/Web/HTTP"} |
| use_to_evolve | {"enabled":true,"injected_by":"skill-writer v3.4.0","injected_at":"2026-04-11","check_cadence":{"lightweight":10,"full_recompute":50,"tier_drift":100},"micro_patch_enabled":true,"feedback_detection":true,"certified_lean_score":390,"last_ute_check":null,"pending_patches":0,"total_micro_patches_applied":0,"cumulative_invocations":0,"generation_method":"human-authored","validation_status":"lean-only"} |
api-tester automates HTTP API testing: it executes requests, validates responses against schemas and status codes, runs security scans (CWE-798/89/78), and generates structured test reports. Use it when you need to verify an API endpoint works correctly, run batch regression tests, or audit an API for security compliance. Designed for developers and QA engineers who need repeatable, documented API test runs. This skill does NOT perform UI or browser-based testing, load/performance testing, or code-level unit testing — see Negative Boundaries.
Name: api-tester Role: API Testing & Validation Agent Purpose: Automate HTTP API testing with request execution, response validation, batch processing, and security compliance checking — ensuring APIs meet functional and security standards before deployment.
Core Principles:
Red Lines (严禁):
Do NOT use this skill for:
The following trigger phrases should NOT activate this skill:
| Phase | Description | Exit Criteria |
|---|---|---|
| 1 PARSE | Extract test intent, target endpoint, method, headers, body from user input | Test parameters identified |
| 2 VALIDATE | Check request structure, auth token availability, endpoint safety | Request validated, no CWE violations |
| 3 EXECUTE | Send HTTP request, capture response, measure latency | Response received (2xx-5xx) |
| 4 VERIFY | Apply validation rules (status code, schema, headers, body content) | All assertions pass/fail recorded |
| 5 REPORT | Generate structured test report with pass/fail status, metrics, recommendations | Report delivered |
| 6 ARCHIVE | Log test run to audit trail with timestamp, result, and artifacts | Audit entry written |
Triggers: test, execute, run, call, send, 测试, 执行, 运行, 调用, 发送
Input:
Output:
{
"mode": "TEST",
"timestamp": "2026-03-31T10:30:00Z",
"request": {
"method": "GET",
"url": "https://api.example.com/users/123",
"headers": {"Authorization": "Bearer ***"}
},
"response": {
"status": 200,
"latency_ms": 145,
"body": {"id": 123, "name": "John"}
},
"validation": {
"passed": true,
"assertions": [
{"check": "status_code", "expected": 200, "actual": 200, "result": "PASS"}
]
},
"security_scan": {
"cwe_798": "CLEAR",
"cwe_89": "CLEAR",
"cwe_200": "CLEAR"
}
}
Steps:
API_TEST_TOKEN environment variable for authExit Criteria: Test report delivered with pass/fail status and security scan results.
Triggers: validate, verify, check, schema, assert, 验证, 校验, 检查, 断言
Input:
Output:
{
"mode": "VALIDATE",
"timestamp": "2026-03-31T10:30:00Z",
"validation": {
"passed": false,
"total_checks": 5,
"passed_checks": 4,
"failed_checks": 1,
"details": [
{"field": "email", "rule": "format:email", "result": "PASS"},
{"field": "age", "rule": "range:0-150", "result": "PASS"},
{"field": "name", "rule": "required", "result": "FAIL", "reason": "null value"}
]
}
}
Steps:
Exit Criteria: Validation report delivered with detailed pass/fail breakdown.
Triggers: batch, bulk, multiple, suite, collection, 批量, 多个, 测试集, 集合
Input:
Output:
{
"mode": "BATCH",
"timestamp": "2026-03-31T10:30:00Z",
"summary": {
"total": 10,
"passed": 8,
"failed": 2,
"skipped": 0,
"duration_ms": 2345
},
"results": [
{"id": 1, "status": "PASS", "latency_ms": 120},
{"id": 2, "status": "FAIL", "error": "timeout after 30s"}
],
"report_url": "/reports/batch-20260331-103000.json"
}
Steps:
Rate Limiting: Respect 100 req/min — queue requests if limit approached.
Exit Criteria: All test cases processed; consolidated report delivered.
| Metric | Threshold | Description |
|---|---|---|
| F1 Score | ≥ 0.90 | Harmonic mean of precision and recall for test classification |
| MRR | ≥ 0.85 | Mean Reciprocal Rank for mode routing accuracy |
| Trigger Accuracy | ≥ 0.90 | Correct mode selection rate |
| Test Coverage | ≥ 80% | Percentage of API endpoints covered by tests |
| Security Pass Rate | 100% | Zero CWE P0 violations allowed |
| Response Time | < 500ms p95 | 95th percentile latency threshold |
CWE Compliance Checklist:
| CWE | Category | Mitigation |
|---|---|---|
| CWE-798 | Hardcoded Credentials | Load auth tokens from API_TEST_TOKEN env var only |
| CWE-89 | SQL Injection | Sanitize all query parameters; use parameterized queries |
| CWE-78 | Command Injection | Never execute shell commands with user input |
| CWE-79 | XSS | Escape response body before rendering in HTML reports |
| CWE-200 | Information Exposure | Mask tokens/PII in logs and reports |
| CWE-295 | Certificate Validation | Always validate SSL certificates in production |
| CWE-400 | Uncontrolled Resource Consumption | Implement request timeouts and rate limiting |
| CWE-22 | Path Traversal | Validate and sanitize file paths in test artifacts |
Security Scan Protocol:
| Error Type | HTTP Status | Recovery Action |
|---|---|---|
| Client Error | 4xx | Parse error message → surface actionable guidance |
| Rate Limited | 429 | Read Retry-After header → wait → retry (max 3) |
| Server Error | 5xx | Exponential backoff (1s, 2s, 4s) → retry (max 3) → HUMAN_REVIEW |
| Timeout | — | Retry once → if still failing, mark as FAIL with timeout reason |
| Network Error | — | Log details → suggest checking network connectivity |
| Auth Failure | 401/403 | Check API_TEST_TOKEN → prompt user if missing/invalid |
| Validation Error | — | Report specific field/rule that failed |
Escalation Triggers:
Input: "Test GET https://api.example.com/users/123, expect status 200"
Mode: TEST | Language: EN
Request: GET https://api.example.com/users/123
Headers: Authorization: Bearer ***
Execution:
Status: 200 OK
Latency: 145ms
Validation:
✓ status_code: 200 (expected 200)
✓ response_time: 145ms < 500ms
Security Scan:
✓ CWE-798: CLEAR
✓ CWE-89: CLEAR
✓ CWE-200: CLEAR
Result: PASS
Input: "批量测试这些端点: GET /health, POST /users, GET /users/1, DELETE /users/1"
Mode: BATCH | Language: ZH
Test Suite: 4 cases
Concurrency: 2
Execution:
[1/4] GET /health ................ PASS (23ms)
[2/4] POST /users ................ PASS (156ms)
[3/4] GET /users/1 ............... PASS (89ms)
[4/4] DELETE /users/1 ............ PASS (67ms)
Summary:
Total: 4
Passed: 4 (100%)
Failed: 0
Duration: 335ms
Security Scan:
✓ All tests: CWE CLEAR
Result: BATCH PASS
Triggers: test | execute | run | call | send | validate | verify | check | batch | bulk | multiple | 测试 | 执行 | 运行 | 调用 | 发送 | 验证 | 校验 | 检查 | 批量 | 多个
Status: enabled
Spec: refs/use-to-evolve.md
Injected: 2026-04-01 by skill-writer v3.4.0
This skill is self-improving. After every invocation the Post-Invocation Hook fires automatically. Do not skip it.
Step 1 — Record usage (append to .skill-audit/usage.jsonl):
{
"timestamp": "<now-ISO-8601>",
"skill_name": "api-tester",
"skill_version": "1.0.0",
"mode": "<mode that ran>",
"trigger_matched": "<true|false>",
"trigger_input": "<first 80 chars of user input>",
"confidence": "<0.00–1.00>",
"success": "<true|false>",
"latency_ms": "<elapsed>",
"feedback_signal": "none|correction|rephrasing|approval|abandon"
}
Step 2 — Detect feedback signal from user's immediate response:
| Pattern | Signal |
|---|---|
| "wrong", "不对", "incorrect", user corrects output | correction → success: false |
| Same request rephrased within 2 turns | rephrasing → add to trigger candidates |
| "thanks", "好的", "perfect", user proceeds | approval → success: true |
| Session ends or topic switches immediately | abandon → ambiguous |
| No follow-up | none → neutral |
If signal = rephrasing: extract new phrase → log to .skill-audit/trigger-candidates.jsonl
with count +1. When any candidate reaches count ≥ 3 → flag for micro-patch.
Step 3 — Check triggers (cadence-gated; check cumulative_invocations):
invocations % 10 == 0 → LIGHTWEIGHT CHECK
invocations % 50 == 0 → FULL METRIC RECOMPUTE
invocations % 100 == 0 → TIER DRIFT CHECK
Lightweight check (last 20 calls):
Full recompute (last 50 calls):
Tier drift check (last 100 calls):
| Condition | Action |
|---|---|
| trigger_candidate count ≥ 3 | Micro-patch: add candidate as primary keyword |
| ZH input failure rate > 20% | Micro-patch: add ZH trigger for failing mode |
| rolling_success_rate < 0.80 | Queue OPTIMIZE targeting lowest dimension |
| ≥ 3 consecutive failures | Warn user + queue OPTIMIZE |
| F1 < 0.90 (recompute) | Queue OPTIMIZE |
| tier drift > 50 pts | Queue full EVALUATE |
Eligible (apply autonomously after LEAN validation):
updated date + bump patch versionIneligible (must queue for OPTIMIZE via skill-writer):
Apply at: start of next session OR when user says "apply UTE patches". Safety: run LEAN eval before and after; rollback if score drops > 10 pts.
Structural issues write to .skill-audit/evolution-queue.jsonl:
{
"timestamp": "<ISO-8601>",
"skill_name": "api-tester",
"reason": "<trigger condition>",
"recommended_strategy": "S1|S2|S3|S4|S5",
"target_dimension": "D1–D7",
"priority": "high|medium|low"
}
Consume the queue by invoking skill-writer OPTIMIZE mode on this skill.
استنادا إلى تصنيف SOC المهني