Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bug-ops/zeph/api-requestnpx skills add bug-ops/zeph --skill api-requestgit clone --depth 1 https://github.com/bug-ops/zephWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00069 | $0.02477 |
| Opus 5 | $0.00034 | $0.01239 |
| Sonnet 5 | $0.00014 | $0.00495 |
| Haiku 4.5 | $0.00007 | $0.00248 |
Grade B, and why
api-request scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
| POST JSON | `curl -s -X POST -H "Content-Type: application/json" -d '{}' URL` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Send HTTP API requests using curl. Use when the user asks to call an API, How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HTTP API Requests with curl
Quick Reference
| Action | Command |
|---|---|
| GET | curl -s URL |
| POST JSON | curl -s -X POST -H "Content-Type: application/json" -d '{}' URL |
| PUT | curl -s -X PUT -H "Content-Type: application/json" -d '{}' URL |
| PATCH | curl -s -X PATCH -H "Content-Type: application/json" -d '{}' URL |
| DELETE | curl -s -X DELETE URL |
| HEAD | curl -s -I URL |
Essential Options
| Option | Long form | Purpose |
|---|---|---|
-s |
--silent |
Suppress progress bar (always use for scripting) |
-S |
--show-error |
Show errors even when silent |
-X |
--request |
HTTP method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) |
-H |
--header |
Add request header (-H "Name: Value") |
-d |
--data |
Send request body (implies POST) |
-o |
--output |
Write response body to file |
-w |
--write-out |
Print metadata after transfer (status code, timing) |
-L |
--location |
Follow HTTP redirects (3xx) |
-i |
--include |
Include response headers in output |
-I |
--head |
Fetch headers only (HEAD request) |
-k |
--insecure |
Skip TLS certificate verification |
-v |
--verbose |
Show full request/response exchange for debugging |
-f |
--fail |
Return exit code 22 on HTTP errors (4xx/5xx) |
-F |
--form |
Multipart form field (implies POST, multipart/form-data) |
-u |
--user |
Basic auth credentials (user:password) |
Timeouts
# Connection timeout (seconds to establish TCP connection)
curl -s --connect-timeout 10 URL
# Max total time (entire operation including transfer)
curl -s --max-time 30 URL
# Both together (recommended for robustness)
curl -sS --connect-timeout 10 --max-time 30 URL
GET Requests
# Simple GET
curl -s "https://api.example.com/users"
# With query parameters (URL-encode special characters)
curl -s "https://api.example.com/users?status=active&limit=10"
# Follow redirects
curl -sL "https://example.com/redirect"
# Save response to file
curl -sS -o response.json "https://api.example.com/data"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 282 lines · 69 tokens per session scan B f695c0b4f0af
api-request is a skill published in the GitHub repository bug-ops/zeph (57 stars, last pushed 7d ago), licensed MIT. It adds 69 tokens to every session and 2,477 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verify
Drive an engine app headlessly in a pty, record a video of the whole verification, and open a summary page (video + timeline + checks) with pixel open.
axum-docs
Axum 0.8.9 — Rust web framework. Routing, extractors, middleware (Tower), state, WebSocket, SSE, testing.
verify
Run Chimeraforge's canonical verification gate end-to-end and report the real output before claiming work done or committing. Failing output gets pasted, fixed, and re-run — never summarized away.
performance
Optimize web performance for faster loading and better user experience. Use when asked to "speed up my site", "optimize performance", "reduce load time", "fix slow loading", "improve page speed", or "performance audit".
dioxus-docs
Dioxus 0.7 — fullstack cross-platform Rust app framework. Web, Desktop, Mobile, SSR. RSX, signals, hooks, router.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.