Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AgiWish/hermes-skills-zh --skill api-doc-zhgit clone --depth 1 https://github.com/AgiWish/hermes-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh)<a href="https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh"><img src="https://agentmods.dev/badge/skills/agiwish/hermes-skills-zh/api-doc-zh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh"><img src="https://agentmods.dev/badge/skills/agiwish/hermes-skills-zh/api-doc-zh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00876 |
| Opus 5 | $0.00020 | $0.00438 |
| Sonnet 5 | $0.00008 | $0.00175 |
| Haiku 4.5 | $0.00004 | $0.00088 |
Grade A, and why
api-doc-zh scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST https://api.example.com/api/v1/[path] \ What it actually says
API 接口文档生成 (api-doc-zh)
When to Use
- "帮我写这个接口的文档"、"把这段代码转成 API 文档"
- 前后端对接需要接口规格说明
- 对外提供 API 需要标准化文档
/api-doc-zh [接口描述或代码片段]
Quick Reference
/api-doc-zh [接口描述 / 代码]
可选参数:
--style=markdown # Markdown 格式(默认)
--style=openapi # OpenAPI 3.0 YAML 格式
--lang=zh # 中文文档(默认)
--lang=en # 英文文档
Procedure
-
解析接口信息
- HTTP 方法 + 路径
- 请求参数(Query / Body / Header)
- 响应结构
- 权限要求
-
输出标准接口文档
## [接口名称]
**接口描述**:[一句话说明这个接口做什么]
### 基本信息
| 项目 | 内容 |
|------|------|
| 请求方法 | POST / GET / PUT / DELETE |
| 请求路径 | `/api/v1/[path]` |
| 权限要求 | [无需鉴权 / Bearer Token / API Key] |
| 频率限制 | [X 次/分钟] |
### 请求参数
**Header**
| 参数名 | 类型 | 必填 | 说明 |
|--------|------|------|------|
| Authorization | String | 是 | Bearer {token} |
**Query 参数**(GET 请求)
| 参数名 | 类型 | 必填 | 默认值 | 说明 |
|--------|------|------|--------|------|
| [param] | String | 否 | - | [说明] |
**Body 参数**(JSON)
```json
{
"field1": "string", // 必填,说明
"field2": 0, // 可选,默认 0
"nested": {
"key": "value"
}
}
响应格式
成功响应(200)
{
"code": 0,
"message": "success",
"data": {
"id": "string",
"created_at": "2026-01-01T00:00:00Z"
}
}
错误码
| 错误码 | HTTP状态 | 说明 | 处理建议 |
|---|---|---|---|
| 1001 | 400 | 参数缺失 | 检查必填字段 |
| 1002 | 401 | 未授权 | 刷新 Token |
| 5000 | 500 | 服务异常 | 重试或联系支持 |
调用示例
cURL
curl -X POST https://api.example.com/api/v1/[path] \
-H "Authorization: Bearer {token}" \
-H "Content-Type: application/json" \
-d '{"field1": "value"}'
## Pitfalls
- 必填字段必须明确标注,不能模糊
- 错误码要有处理建议,不能只列状态码
- 示例中的数据要真实可用,不要用 `xxx` 占位
## Verification
- [ ] 所有参数有类型和必填说明
- [ ] 响应格式有完整示例
- [ ] 错误码覆盖主要异常场景
- [ ] cURL 示例可以直接复制运行
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 124 lines · 40 tokens per session scan A 64cf20a9b0aa
api-doc-zh is a skill published in the GitHub repository AgiWish/hermes-skills-zh (5 stars, last pushed 3mo ago), licensed MIT. It adds 40 tokens to every session and 876 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024)…
hunt-grpc
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS…
hunt-ldap
Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set ( ( ) \ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT}…
hunt-websocket
Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://)…
401-403-bypass-techniques
Use when protected HTTP routes return 401 or 403.
hunt-saml
Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID ([email protected] @attacker.com → some parsers see [email protected]), signature stripping (remove Signature element entirely, server should reject…