Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add APIPASS-Integrations/apipass-headless --skill apipass-actionsgit clone --depth 1 https://github.com/APIPASS-Integrations/apipass-headlessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apipass-integrations/apipass-headless/apipass-actions)<a href="https://agentmods.dev/skills/apipass-integrations/apipass-headless/apipass-actions"><img src="https://agentmods.dev/badge/skills/apipass-integrations/apipass-headless/apipass-actions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/apipass-integrations/apipass-headless/apipass-actions"><img src="https://agentmods.dev/badge/skills/apipass-integrations/apipass-headless/apipass-actions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.03111 |
| Opus 5 | $0.00022 | $0.01555 |
| Sonnet 5 | $0.00009 | $0.00622 |
| Haiku 4.5 | $0.00004 | $0.00311 |
Grade A, and why
apipass-actions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Catalogo de Acoes e Anatomia do FlowStep
Na APIPASS, cada passo de um fluxo e uma acao. O catalogo de acoes e descoberto via ferramentas (nao ha lista fixa — varia por conta):
list_action_groups— categorias de acoeslist_actions— catalogo (compactado)get_action(groupId, id)— detalhe de uma acaoget_action_struct(id)— schema de input da acao (base domappingAttributes)list_custom_actions/get_custom_action(id)— acoes customizadas da conta
Catalogo completo: banco + acoes fixas
O list_actions retorna o catalogo COMPLETO, mesclando duas fontes:
catalog— acoes do banco (viaGET /action); exige login.fixed— acoes fixas embutidas no codigo do flow-manager (ex..service.mongodb.MongoDBInsertService,.utility.delay.DelayUtility,.trigger.scheduler.TriggerScheduler), que NAO aparecem na API. Sempre disponiveis, mesmo sem login.
Cada item traz source: "catalog" | "fixed". Filtre com list_actions(group, kind) — ex. kind: "trigger" para gatilhos, group: "mongodb" para uma familia. O campo type (ex. .service.mongodb.MongoDBInsertService) e exatamente o que vai em FlowStep.type.
Campos da action (resolve o cold-start): as acoes fixas trazem fields (struct extraido das classes) e, melhor ainda, um stepSkeleton — o FlowStep canonico com os campos ja no NIVEL correto (topo do step, mappingAttributes: {}) e mappingLevel: "top-level". Use o stepSkeleton direto: NAO e preciso fluxo de exemplo nem get_action_struct para acao fixa. Excecoes: .service.actions.Action/CustomAction sao do catalogo (dinamicas) — a config vai em inputData, com o schema via get_action_struct; algumas utility.*/paradigma.* ainda nao expoem fields/skeleton completo (nesses casos, leia um fluxo existente com get_flow_development ou pergunte ao usuario).
As acoes fixas vem de um manifesto gerado do codigo-fonte (
src/catalog/fixed-actions.ts). O gerador faz DEDUPE com o repoactions(catalogo de connectors): qualquer action que ja exista la (por grupo com.jsou por nome) e EXCLUIDA do manifesto, pois retorna via API/list_actions. Sobram so as acoes realmente fixas no engine (http, loop, triggers, store? nao — store vem do catalogo; sim: nodejs, switch, jwtsign, text/datetime ops core, etc.). Regenere comnpm run generate:catalogapontandoFLOW_MANAGER_SRC,FLOW_MANAGER_APP_I18NeACTIONS_REPO.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 133 lines · 43 tokens per session scan A b0b745a004c3
apipass-actions is a skill published in the GitHub repository APIPASS-Integrations/apipass-headless (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 43 tokens to every session and 3,111 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…