agentmods.dev

feishu-cursor-claw: Command for Claude Code

.cursor/commands/测试后端Api.md

测试后端Api is a command for Claude Code, Cursor from nongjun/feishu-cursor-claw. It costs 0 tokens per session (516 once invoked), scanned A, original, MIT.

A command for testing the backend APIs of a project, including service discovery, authentication checks, endpoint validation, and security-header checks. Backend APIs are the server-side interfaces that applications use to exchange data.

In plain words
What is it for?
Use it to find running services, test health and core endpoints, verify input validation and batch operations, check authentication behavior, and inspect HTTPS security headers.
Why use it?
It checks multiple services and common failure cases in a consistent report. When permissions block a test, it tries other credentials or validates the logic inside the service instead of automatically treating the result as a code failure.

Command for Claude CodeCursor

Written for Cursor and Claude Code: installed under .cursor/, but also a Claude Code command (commands/*.md).

This is nongjun/feishu-cursor-claw's own configuration. It tells Claude Code and Cursor how to work on feishu-cursor-claw itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything feishu-cursor-claw configures →

not rated 14repo 3mo ago A scan 0 tokens original MIT
View source ↗ nongjun/feishu-cursor-claw
Reuse

Borrowing it

Nothing to install: this file belongs to nongjun/feishu-cursor-claw. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/nongjun/feishu-cursor-claw/main/.cursor/commands/测试后端Api.md
Clone the repo
git clone --depth 1 https://github.com/nongjun/feishu-cursor-claw

Made for: Claude Code, Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for 测试后端Api

README.md
[![agentmods](https://agentmods.dev/badge/commands/nongjun/feishu-cursor-claw/api/github.svg)](https://agentmods.dev/commands/nongjun/feishu-cursor-claw/api)
Your own site
<a href="https://agentmods.dev/commands/nongjun/feishu-cursor-claw/api"><img src="https://agentmods.dev/badge/commands/nongjun/feishu-cursor-claw/api/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for 测试后端Api

Your own site · 80×15
<a href="https://agentmods.dev/commands/nongjun/feishu-cursor-claw/api"><img src="https://agentmods.dev/badge/commands/nongjun/feishu-cursor-claw/api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 516 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.00516
Opus 5.5 $0.00000 $0.00206
Sonnet 5.5 $0.00000 $0.00103
Haiku 4.5 $0.00000 $0.00052

Measured 1mo ago against content hash e9c76a03ed8b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

测试后端Api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

.cursor/commands/测试后端Api.md · 57 lines

What it actually says

后端 API 测试

对当前项目的所有后端服务进行一次全量 API 测试。

自动发现服务

通过以下方式自动发现项目中的后端服务：

  1. docker ps 获取运行中的后端容器及端口
  2. docker compose config 或 docker-compose*.yml 获取服务定义
  3. Nginx 配置获取域名与路由映射

测试账户

自动获取测试凭据：

  1. 从项目 .env 或容器环境变量中读取数据库连接信息
  2. 从数据库查询管理员账户
  3. 使用项目配置的密钥和算法生成 JWT Token（从环境变量中获取 JWT_SECRET / SECRET_KEY 等）
  4. 若项目有登录接口，也可通过登录获取 Token

测试范围

对每个发现的后端服务执行：

  1. 健康检查 — GET /health 或 /api/health，验证返回 200
  2. 核心列表接口 — 带分页参数请求，验证返回结构包含列表数据和分页信息
  3. 批量操作空数组 — POST 空数组到批量接口，验证返回 400 或合理的错误提示
  4. 创建接口校验 — 传入非法数据（超长字段、缺必填项），验证被正确拒绝

鉴权受阻时的降级策略

若某接口因权限返回 401/403：

  • 尝试使用不同权限级别的 Token 重试
  • 在容器内直接验证代码逻辑（docker exec <容器名> 执行验证命令）
  • 记录为"需要更高权限"，不标为失败

安全头检查

对所有 HTTPS 域名检查响应头：

  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-Frame-Options
  • Referrer-Policy

输出格式

用表格汇总，每项标注 ✅/❌，最后统计通过率：

# API 测试报告

| 服务 | 端点 | 方法 | 预期 | 结果 | 状态 |
|-----|------|------|------|------|------|
| ... | ... | ... | ... | ... | ✅/❌ |

**通过率**: X/Y (Z%)
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 57 lines · 0 tokens per session scan A e9c76a03ed8b

Subscribe to this mod's changes

测试后端Api is a command published in the GitHub repository nongjun/feishu-cursor-claw (14 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 516 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIsTestingai-agentcursorcursor-agentcursor-aifeishufeishu-bot
Related

Other commands, from other repositories

api-aqa-flow

Workflow for backend API test automation: TMS / Issue Tracker test cases → automated API tests, HITL-gated.

griddynamics/rosetta · 29 tokens

api-aqa-flow-data-collection

Phase 1 Data Collection of api-aqa-flow.

griddynamics/rosetta · 18 tokens

api-aqa-flow-api-spec-analysis

Phase 2 API Spec Analysis of api-aqa-flow.

griddynamics/rosetta · 19 tokens

api-aqa-flow-gap-and-requirements-clarification

Phase 3 Gap & Requirements Clarification of api-aqa-flow (USER INTERACTION REQUIRED).

griddynamics/rosetta · 32 tokens

green-repo

Drive the whole repository to a verified-green baseline — typecheck, lint, tests, build — with authorized fixing of pre-existing debt.

kensaurus/cursor-kenji · 26 tokens

arch-boundaries

Install mechanically-enforced architecture boundaries that fail CI on spaghetti imports.

kensaurus/cursor-kenji · 12 tokens