Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmicstack-labs/mercury-agent-skills --skill api-testinggit clone --depth 1 https://github.com/cosmicstack-labs/mercury-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmicstack-labs/mercury-agent-skills/api-testing)<a href="https://agentmods.dev/skills/cosmicstack-labs/mercury-agent-skills/api-testing"><img src="https://agentmods.dev/badge/skills/cosmicstack-labs/mercury-agent-skills/api-testing.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00433 |
| Opus 5 | $0.00012 | $0.00217 |
| Sonnet 5 | $0.00005 | $0.00087 |
| Haiku 4.5 | $0.00002 | $0.00043 |
Grade A, and why
api-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
API Testing
Test REST and GraphQL APIs systematically.
Test Categories
| Category | What | Example |
|---|---|---|
| Functional | Does it work? | POST /users returns 201 |
| Validation | Input handling | Missing required field → 400 |
| Auth | Access control | No token → 401 |
| Edge Cases | Boundary conditions | Max page size, empty results |
| Contract | Schema conformance | Response matches OpenAPI spec |
| Performance | Within SLO | p95 < 500ms |
REST API Testing
Structure
describe('POST /users', () => {
it('creates a user with valid data', async () => {
const res = await request(app)
.post('/api/users')
.send({ name: 'Alice', email: '[email protected]' });
expect(res.status).toBe(201);
expect(res.body).toHaveProperty('id');
});
it('rejects duplicate email', async () => {
const res = await request(app)
.post('/api/users')
.send({ name: 'Alice', email: '[email protected]' });
expect(res.status).toBe(409);
});
});
Contract Testing (Pact)
- Provider publishes OpenAPI spec
- Consumer tests verify against published spec
- CI rejects PR if contract breaks
- Prevents API drift between services
GraphQL Testing
- Test queries and mutations independently
- Validate against schema
- Test error paths (partial failures, null propagation)
API Monitoring
- Synthetic checks every 5 minutes
- Assert status, response time, required fields
- Alert on SLA breaches
- Monitor from multiple regions
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 63 lines · 24 tokens per session scan A 455f089971a5
api-testing is a skill published in the GitHub repository cosmicstack-labs/mercury-agent-skills (471 stars, last pushed 14d ago), licensed MIT. It adds 24 tokens to every session and 433 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
xdto-validate
A validator for XDTO packages in 1C:Enterprise. It checks the package model, its metadata object, and its connection to the configuration.
openapi-swagger-codegen-expert
OpenAPI 3.1 spec authoring, Swagger UI, automatic client/server code generation (openapi-typescript, Orval, Kiota), contract testing / Penulisan spesifikasi OpenAPI 3.1, Swagger UI, pembuatan kode klien/server otomatis, dan pengujian kontrak.
drift-testing
Verifies API implementations against OpenAPI specifications using the Drift CLI, catching spec drift and supporting Bi-Directional Contract Testing (BDCT). Use when the user mentions Drift, API contract testing, provider contract testing, provider verification, spec drift, API conformance testing, OpenAPI…
openapi-parser
Parses complex OpenAPI specs and generates Drift test cases from them. Use whenever the user wants to generate, write, or scaffold Drift tests from an OpenAPI spec — especially when the spec contains complex schemas: anyOf/oneOf/allOf, discriminators, polymorphism, inheritance, $ref chains, regex patterns, enums, or…
springboot-tdd
Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use when adding features, fixing bugs, or refactoring.
go-service-idioms
This skill should be used when the user asks to "write a Go function", "implement this in Go", "structure this Go service", "add error handling in Go", "handle context cancellation in Go", "write a Go worker pool", "add a table-driven test", "review this Go code for idioms", or otherwise writes or reviews Go…