PuPu: Skill for Claude Code

.claude/skills/test-api/SKILL.md

test-api is a skill for Claude Code from haoxiang-xu/PuPu. It costs 110 tokens per session (1,944 once invoked), scanned A, original, Apache-2.0.

A local HTTP testing interface for PuPu in development mode. It lets an agent operate the app through requests, read its state and logs, and take screenshots.

In plain words
What is it for?
Use it to test chat creation, message sending, model selection, toolkits, and characters; inspect debug state and logs; and capture screenshots of fixes.
Why use it?
It verifies that code changes work in the running application and helps distinguish what the app believes is happening from what the interface shows.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

This is haoxiang-xu/PuPu's own configuration. It tells Claude Code how to work on PuPu itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything PuPu configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is node scripts/test-api/smoke.mjs.

Reuse

Borrowing it

Nothing to install: this file belongs to haoxiang-xu/PuPu. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/haoxiang-xu/PuPu/main/.claude/skills/test-api/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/haoxiang-xu/PuPu

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for test-api

README.md
[![agentmods](https://agentmods.dev/badge/skills/haoxiang-xu/pupu/test-api.svg)](https://agentmods.dev/skills/haoxiang-xu/pupu/test-api)
Your own site
<a href="https://agentmods.dev/skills/haoxiang-xu/pupu/test-api"><img src="https://agentmods.dev/badge/skills/haoxiang-xu/pupu/test-api.svg" alt="Measured on agentmods" height="20"></a>
Per session 110 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,944 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00110 $0.01944
Opus 5 $0.00055 $0.00972
Sonnet 5 $0.00022 $0.00389
Haiku 4.5 $0.00011 $0.00194

Measured 8d ago against content hash b6e4f11ee4a3, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

test-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

### Quick path: curl
.claude/skills/test-api/SKILL.md · 152 lines

How it starts

The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PuPu Test API — Skill

A local HTTP REST endpoint on PuPu (dev mode only, bound to 127.0.0.1) that lets you drive PuPu like a human: create chats, switch models, send messages, read state, take screenshots. Use it to verify your code changes actually behave correctly in the running app.

When to use

  • After making code changes that touch chat creation, message send, model selection, toolkits, characters, or any chat-related path — run a quick regression to confirm the happy path still works
  • When debugging "the UI is wrong" — pull /v1/debug/state to see what the app thinks vs. what it shows
  • When debugging "why didn't X happen" — pull /v1/debug/logs to see renderer console + main stdout (Flask logs are Phase 2)
  • When you need to demonstrate a fix to the user with a real screenshot

Pre-flight check

Before invoking the API, confirm PuPu is running in dev mode:

ls "$HOME/Library/Application Support/pupu/test-api-port" && cat "$HOME/Library/Application Support/pupu/test-api-port"

Expected: a JSON {port, pid, started_at}. If the file is missing, ask the user to run npm start in the PuPu repo. If the file exists but pid references a dead process, ask the user to restart PuPu.

How to call

Quick path: curl

PORT=$(node -e "console.log(JSON.parse(require('fs').readFileSync(process.env.HOME + '/Library/Application Support/pupu/test-api-port')).port)")
BASE="http://127.0.0.1:$PORT/v1"

# Always retry 503 not_ready a couple times — it just means renderer is still initializing
for i in 1 2 3; do
  S=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/debug/state")
  [ "$S" = "200" ] && break
  sleep 0.3
done

Better path: use the helper

scripts/test-api/client.mjs does port discovery + 503 retry for you:

node -e "import('./scripts/test-api/client.mjs').then(({client}) => client.GET('/debug/state').then(s => console.log(JSON.stringify(s, null, 2))))"

For a complete end-to-end smoke (create chat → send → screenshot → cleanup), run the bundled script:

Read the full file on GitHub · 152 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 152 lines · 110 tokens per session scan A b6e4f11ee4a3

Subscribe to this mod's changes

test-api is a skill published in the GitHub repository haoxiang-xu/PuPu (36 stars, last pushed today), licensed Apache-2.0. It adds 110 tokens to every session and 1,944 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

factory-render-verify

Render-and-measure receipts for any HTML page your factory builds — the render half of the design quality gate. Engineer runs it to screenshot every screen size and MEASURE what a source read or a single screenshot only guesses at: horizontal overflow, computed type sizes, tap-target sizes, safe-area presence, mono…

squidbay/factory · 133 tokens

gsd-builder

Implement a design document end-to-end in a target repo by driving Claude Code through the GSD workflow — define a GSD milestone from the doc, then run /gsd-autonomous (TDD, skip-discuss) to build all phases unattended. Use when the operator hands you a design/spec document and asks to autonomously build, implement…

comisai/comis · 104 tokens

verify

Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.

Hmbown/CodeWhale · 25 tokens

webapp-testing

Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.

Hmbown/CodeWhale · 32 tokens

qa

Browser-based QA verification. Launches a real browser, navigates the app, clicks buttons, fills forms, and tests user flows. Works as a standalone skill or as a phase end condition in campaigns. Requires Playwright (optional dependency, graceful skip if not installed).

SethGammon/Citadel · 56 tokens

live-preview

Mid-build visual verification loop. Takes screenshots of components during construction, not just after. Catches visual regressions and invisible features before they compound. Requires Playwright or similar screenshot tool.

SethGammon/Citadel · 40 tokens