Borrowing it
Nothing to install: this file belongs to haoxiang-xu/PuPu. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/haoxiang-xu/PuPu/main/.claude/skills/test-api/SKILL.mdgit clone --depth 1 https://github.com/haoxiang-xu/PuPuWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/haoxiang-xu/pupu/test-api)<a href="https://agentmods.dev/skills/haoxiang-xu/pupu/test-api"><img src="https://agentmods.dev/badge/skills/haoxiang-xu/pupu/test-api.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.01944 |
| Opus 5 | $0.00055 | $0.00972 |
| Sonnet 5 | $0.00022 | $0.00389 |
| Haiku 4.5 | $0.00011 | $0.00194 |
Grade A, and why
test-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
### Quick path: curl How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PuPu Test API — Skill
A local HTTP REST endpoint on PuPu (dev mode only, bound to 127.0.0.1) that lets you drive PuPu like a human: create chats, switch models, send messages, read state, take screenshots. Use it to verify your code changes actually behave correctly in the running app.
When to use
- After making code changes that touch chat creation, message send, model selection, toolkits, characters, or any chat-related path — run a quick regression to confirm the happy path still works
- When debugging "the UI is wrong" — pull
/v1/debug/stateto see what the app thinks vs. what it shows - When debugging "why didn't X happen" — pull
/v1/debug/logsto see renderer console + main stdout (Flask logs are Phase 2) - When you need to demonstrate a fix to the user with a real screenshot
Pre-flight check
Before invoking the API, confirm PuPu is running in dev mode:
ls "$HOME/Library/Application Support/pupu/test-api-port" && cat "$HOME/Library/Application Support/pupu/test-api-port"
Expected: a JSON {port, pid, started_at}. If the file is missing, ask the user to run npm start in the PuPu repo. If the file exists but pid references a dead process, ask the user to restart PuPu.
How to call
Quick path: curl
PORT=$(node -e "console.log(JSON.parse(require('fs').readFileSync(process.env.HOME + '/Library/Application Support/pupu/test-api-port')).port)")
BASE="http://127.0.0.1:$PORT/v1"
# Always retry 503 not_ready a couple times — it just means renderer is still initializing
for i in 1 2 3; do
S=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/debug/state")
[ "$S" = "200" ] && break
sleep 0.3
done
Better path: use the helper
scripts/test-api/client.mjs does port discovery + 503 retry for you:
node -e "import('./scripts/test-api/client.mjs').then(({client}) => client.GET('/debug/state').then(s => console.log(JSON.stringify(s, null, 2))))"
For a complete end-to-end smoke (create chat → send → screenshot → cleanup), run the bundled script:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 152 lines · 110 tokens per session scan A b6e4f11ee4a3
test-api is a skill published in the GitHub repository haoxiang-xu/PuPu (36 stars, last pushed today), licensed Apache-2.0. It adds 110 tokens to every session and 1,944 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
factory-render-verify
Render-and-measure receipts for any HTML page your factory builds — the render half of the design quality gate. Engineer runs it to screenshot every screen size and MEASURE what a source read or a single screenshot only guesses at: horizontal overflow, computed type sizes, tap-target sizes, safe-area presence, mono…
gsd-builder
Implement a design document end-to-end in a target repo by driving Claude Code through the GSD workflow — define a GSD milestone from the doc, then run /gsd-autonomous (TDD, skip-discuss) to build all phases unattended. Use when the operator hands you a design/spec document and asks to autonomously build, implement…
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
webapp-testing
Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.
qa
Browser-based QA verification. Launches a real browser, navigates the app, clicks buttons, fills forms, and tests user flows. Works as a standalone skill or as a phase end condition in campaigns. Requires Playwright (optional dependency, graceful skip if not installed).
live-preview
Mid-build visual verification loop. Takes screenshots of components during construction, not just after. Catches visual regressions and invisible features before they compound. Requires Playwright or similar screenshot tool.