Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/nongjun/feishu-cursor-claw/apigit clone --depth 1 https://github.com/nongjun/feishu-cursor-clawWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00516 |
| Opus 5 | $0.00000 | $0.00258 |
| Sonnet 5 | $0.00000 | $0.00103 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
测试后端Api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- 测试后端Api — 100% identical, 12 lines differ
What it actually says
后端 API 测试
对当前项目的所有后端服务进行一次全量 API 测试。
自动发现服务
通过以下方式自动发现项目中的后端服务：
docker ps获取运行中的后端容器及端口docker compose config或docker-compose*.yml获取服务定义- Nginx 配置获取域名与路由映射
测试账户
自动获取测试凭据：
- 从项目
.env或容器环境变量中读取数据库连接信息 - 从数据库查询管理员账户
- 使用项目配置的密钥和算法生成 JWT Token（从环境变量中获取
JWT_SECRET/SECRET_KEY等） - 若项目有登录接口，也可通过登录获取 Token
测试范围
对每个发现的后端服务执行：
- 健康检查 —
GET /health或/api/health，验证返回 200 - 核心列表接口 — 带分页参数请求，验证返回结构包含列表数据和分页信息
- 批量操作空数组 — POST 空数组到批量接口，验证返回 400 或合理的错误提示
- 创建接口校验 — 传入非法数据（超长字段、缺必填项），验证被正确拒绝
鉴权受阻时的降级策略
若某接口因权限返回 401/403：
- 尝试使用不同权限级别的 Token 重试
- 在容器内直接验证代码逻辑（
docker exec <容器名>执行验证命令） - 记录为"需要更高权限"，不标为失败
安全头检查
对所有 HTTPS 域名检查响应头：
Strict-Transport-SecurityX-Content-Type-OptionsX-Frame-OptionsReferrer-Policy
输出格式
用表格汇总，每项标注 ✅/❌，最后统计通过率：
# API 测试报告
| 服务 | 端点 | 方法 | 预期 | 结果 | 状态 |
|-----|------|------|------|------|------|
| ... | ... | ... | ... | ... | ✅/❌ |
**通过率**: X/Y (Z%)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 57 lines · 0 tokens per session scan A e9c76a03ed8b
测试后端Api is a command published in the GitHub repository nongjun/feishu-cursor-claw (13 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 516 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
goham
End-to-end workflow for working on tasks from a connected Hamster brief. All tasks from the brief are worked on in a single branch, with one PR created at the end.
help
Command "help" from eyaltoledano/claude-task-master, covering task master ai command help, quick navigation, command categories, quick start examples and getting started.
learn
Learn about Task Master capabilities through interactive exploration.
next-task
Intelligently determine and prepare the next action based on comprehensive context.
ship-and-observe
Take merged, green code to a verified, monitored production release — deploy, confirm the revision is live, smoke-test, observe, and roll back if needed.
parse-prd-with-research
Parse PRD with enhanced research mode for better task generation.