api-doc-zh

api-doc-zh is a skill for Claude Code, Codex from AgiWish/hermes-skills-zh. It costs 40 tokens per session (876 once invoked), scanned A, original, MIT.

An API documentation generator that turns an interface description or code into documentation in Chinese or English. The documentation can describe requests, responses, errors, permissions, and examples, using Markdown or OpenAPI 3.0 YAML.

In plain words
What is it for?
Use it to document HTTP endpoints, including methods, paths, query, body and header parameters, response structures, authentication requirements, error codes, and example calls.
Why use it?
It removes the need to write interface specifications by hand when frontend and backend teams need to connect or when an API is offered to other developers.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to document HTTP endpoints, including methods, paths, query, body and header parameters, response structures, authentication requirements, error codes, and example calls.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/agiwish/hermes-skills-zh/api-doc-zh
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add AgiWish/hermes-skills-zh --skill api-doc-zh
Clone the repo
git clone --depth 1 https://github.com/AgiWish/hermes-skills-zh

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api-doc-zh

README.md
[![agentmods](https://agentmods.dev/badge/skills/agiwish/hermes-skills-zh/api-doc-zh/github.svg)](https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh)
Your own site
<a href="https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh"><img src="https://agentmods.dev/badge/skills/agiwish/hermes-skills-zh/api-doc-zh/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for api-doc-zh

Your own site · 80×15
<a href="https://agentmods.dev/skills/agiwish/hermes-skills-zh/api-doc-zh"><img src="https://agentmods.dev/badge/skills/agiwish/hermes-skills-zh/api-doc-zh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 40 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 876 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00040 $0.00876
Opus 5 $0.00020 $0.00438
Sonnet 5 $0.00008 $0.00175
Haiku 4.5 $0.00004 $0.00088

Measured 11d ago against content hash 64cf20a9b0aa, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

api-doc-zh scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -X POST https://api.example.com/api/v1/[path] \
skills/api-doc-zh/SKILL.md · 124 lines

What it actually says

API 接口文档生成 (api-doc-zh)

When to Use

  • "帮我写这个接口的文档"、"把这段代码转成 API 文档"
  • 前后端对接需要接口规格说明
  • 对外提供 API 需要标准化文档
  • /api-doc-zh [接口描述或代码片段]

Quick Reference

/api-doc-zh [接口描述 / 代码]

可选参数:
  --style=markdown  # Markdown 格式(默认)
  --style=openapi   # OpenAPI 3.0 YAML 格式
  --lang=zh         # 中文文档(默认)
  --lang=en         # 英文文档

Procedure

  1. 解析接口信息

    • HTTP 方法 + 路径
    • 请求参数(Query / Body / Header)
    • 响应结构
    • 权限要求
  2. 输出标准接口文档

## [接口名称]

**接口描述**:[一句话说明这个接口做什么]

### 基本信息
| 项目 | 内容 |
|------|------|
| 请求方法 | POST / GET / PUT / DELETE |
| 请求路径 | `/api/v1/[path]` |
| 权限要求 | [无需鉴权 / Bearer Token / API Key] |
| 频率限制 | [X 次/分钟] |

### 请求参数

**Header**
| 参数名 | 类型 | 必填 | 说明 |
|--------|------|------|------|
| Authorization | String | 是 | Bearer {token} |

**Query 参数**(GET 请求)
| 参数名 | 类型 | 必填 | 默认值 | 说明 |
|--------|------|------|--------|------|
| [param] | String | 否 | - | [说明] |

**Body 参数**(JSON)
```json
{
  "field1": "string",    // 必填,说明
  "field2": 0,           // 可选,默认 0
  "nested": {
    "key": "value"
  }
}

响应格式

成功响应(200)

{
  "code": 0,
  "message": "success",
  "data": {
    "id": "string",
    "created_at": "2026-01-01T00:00:00Z"
  }
}

错误码

错误码 HTTP状态 说明 处理建议
1001 400 参数缺失 检查必填字段
1002 401 未授权 刷新 Token
5000 500 服务异常 重试或联系支持

调用示例

cURL

curl -X POST https://api.example.com/api/v1/[path] \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"field1": "value"}'

## Pitfalls

- 必填字段必须明确标注,不能模糊
- 错误码要有处理建议,不能只列状态码
- 示例中的数据要真实可用,不要用 `xxx` 占位

## Verification

- [ ] 所有参数有类型和必填说明
- [ ] 响应格式有完整示例
- [ ] 错误码覆盖主要异常场景
- [ ] cURL 示例可以直接复制运行
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 124 lines · 40 tokens per session scan A 64cf20a9b0aa

Subscribe to this mod's changes

api-doc-zh is a skill published in the GitHub repository AgiWish/hermes-skills-zh (5 stars, last pushed 3mo ago), licensed MIT. It adds 40 tokens to every session and 876 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

hunt-auth-bypass

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024)…

uphiago/recon-skills · 172 tokens

hunt-grpc

Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS…

uphiago/recon-skills · 135 tokens

hunt-ldap

Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set ( ( ) \ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT}…

uphiago/recon-skills · 118 tokens

hunt-websocket

Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://)…

uphiago/recon-skills · 95 tokens

401-403-bypass-techniques

Use when protected HTTP routes return 401 or 403.

uphiago/recon-skills · 20 tokens

hunt-saml

Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID ([email protected] @attacker.com → some parsers see [email protected]), signature stripping (remove Signature element entirely, server should reject…

uphiago/recon-skills · 198 tokens