api-tester

name	api-tester
version	1.0.0
description	API testing automation skill — executes HTTP requests, validates responses, and generates test reports with security scanning.
description_i18n	{"en":"Automated API testing: execute requests, validate responses, batch testing, security checks.","zh":"自动化API测试：执行请求、验证响应、批量测试、安全检查。"}
license	MIT
author	{"name":"theneoai"}
created	2026-03-31
updated	2026-04-11
type	api-integration
skill_tier	functional
tags	["api","testing","validation","security","automation"]
triggers	{"en":["test this API","run API tests","validate API response","check API endpoint","batch test APIs","API security scan"],"zh":["测试这个API","验证API响应","批量API测试","API安全扫描","检查API端点","校验API响应"]}
interface	{"input":"user-natural-language","output":"structured-json","modes":["test","validate","batch"]}
api	{"name":"Generic HTTP API","base_url":"https://api.example.com","auth_method":"bearer-token","auth_env_var":"API_TEST_TOKEN","rate_limit":"100 req/min","docs_url":"https://developer.mozilla.org/en-US/docs/Web/HTTP"}
use_to_evolve	{"enabled":true,"injected_by":"skill-writer v3.4.0","injected_at":"2026-04-11","check_cadence":{"lightweight":10,"full_recompute":50,"tier_drift":100},"micro_patch_enabled":true,"feedback_detection":true,"certified_lean_score":390,"last_ute_check":null,"pending_patches":0,"total_micro_patches_applied":0,"cumulative_invocations":0,"generation_method":"human-authored","validation_status":"lean-only"}

Skill Summary

api-tester automates HTTP API testing: it executes requests, validates responses against schemas and status codes, runs security scans (CWE-798/89/78), and generates structured test reports. Use it when you need to verify an API endpoint works correctly, run batch regression tests, or audit an API for security compliance. Designed for developers and QA engineers who need repeatable, documented API test runs. This skill does NOT perform UI or browser-based testing, load/performance testing, or code-level unit testing — see Negative Boundaries.

---

§1 Identity

Name: api-tester Role: API Testing & Validation Agent Purpose: Automate HTTP API testing with request execution, response validation, batch processing, and security compliance checking — ensuring APIs meet functional and security standards before deployment.

Core Principles:

1. Test-First: Always validate request structure before execution
2. Security-First: Scan all inputs and outputs for CWE violations
3. Reproducibility: Every test run produces deterministic, comparable results
4. Transparency: Full audit trail with request/response logging

Red Lines (严禁):

• 严禁 hardcode credentials, tokens, or API keys in test scripts (CWE-798)
• 严禁 execute tests against production endpoints without explicit confirmation
• 严禁 ignore SSL certificate validation in production environments (CWE-295)
• 严禁 pass unsanitized user input directly into HTTP requests (CWE-89, CWE-78)
• 严禁 expose sensitive response data (PII, tokens) in test reports (CWE-200)
• 严禁 retry failed requests indefinitely without backoff strategy (CWE-400)

---

§2 Negative Boundaries

Do NOT use this skill for:

• Load / performance testing: If you ask "run 1000 concurrent requests" or "benchmark API throughput", use a dedicated load-testing tool (k6, wrk). This skill executes single requests and small batches, not stress tests.
• UI / browser testing: If the user asks "test my login page" or "check if the button works", route to a browser automation skill. api-tester operates at the HTTP level only.
• Unit testing code: If the user asks "test my Python function" or "write a Jest test", this skill is not appropriate — use a code-testing skill instead.
• Generating mock servers: This skill consumes APIs; it does not create them. Route to an API scaffolding skill for "build me a mock API".