Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jaktestowac/awesome-copilot-for-testers/testing-api-contractsnpx skills add jaktestowac/awesome-copilot-for-testers --skill testing-api-contractsgit clone --depth 1 https://github.com/jaktestowac/awesome-copilot-for-testersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jaktestowac/awesome-copilot-for-testers/testing-api-contracts)<a href="https://agentmods.dev/skills/jaktestowac/awesome-copilot-for-testers/testing-api-contracts"><img src="https://agentmods.dev/badge/skills/jaktestowac/awesome-copilot-for-testers/testing-api-contracts.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.01984 |
| Opus 5 | $0.00035 | $0.00992 |
| Sonnet 5 | $0.00014 | $0.00397 |
| Haiku 4.5 | $0.00007 | $0.00198 |
Grade A, and why
testing-api-contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing API Contracts
Use this skill when the question is not "does the endpoint work" but "does the endpoint still promise what its consumers were built against".
A contract test checks shape and compatibility, not business behaviour. It answers: did a field disappear, did a type change, did an enum gain a value the client cannot handle, did a required field become optional. Functional API tests answer whether the value is correct. Both are needed and they fail for different reasons, which is the point of keeping them separate.
When to Use
- an API publishes an OpenAPI or JSON Schema document and nothing verifies the implementation matches it
- API tests assert
status === 200and nothing about the body - a backend change is about to ship and no one can say which clients it breaks
- mocked fixtures need a drift guard against the real service
- two teams are arguing about whether a change is breaking
- a spec exists but has visibly diverged from what the service returns
Operating Principles
- The spec is the contract, the implementation is the claim. Test the claim against the contract, in both directions.
- Shape checks and value checks stay separate. Mixing them produces a test that fails for two unrelated reasons and reports one message.
- Additive is safe, subtractive is not. Adding an optional response field breaks nobody. Removing one, or tightening a type, breaks everybody who read it.
- Validate every response, not a sampled one. Schema validation is cheap enough to run on every API call the suite already makes.
- A breaking change is defined by consumers, not by the provider. A field no client reads can be removed freely; the argument is about evidence, not opinion.
- Undocumented behaviour is a finding. A response field absent from the spec is either a spec gap or an accidental leak. Both get reported.
Workflow
Phase 0: Locate the contract
Find the authoritative artifact and record which it is:
- an OpenAPI document in the repository, generated from code or hand-written
- an OpenAPI document served at runtime (
/openapi.json,/swagger.json,/v3/api-docs) - standalone JSON Schema files
- a GraphQL SDL
- none of the above, in which case the first deliverable is a spec derived from observed traffic, marked as derived rather than authoritative
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 151 lines · 70 tokens per session scan A cf348f1ae4ab
testing-api-contracts is a skill published in the GitHub repository jaktestowac/awesome-copilot-for-testers (113 stars, last pushed 10d ago), licensed MIT. It adds 70 tokens to every session and 1,984 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-aqa-flow
Workflow for backend API test automation: TMS / Issue Tracker test cases → automated API tests, HITL-gated.
refactor-check
Safety analysis before refactoring -- dependency graph, test coverage, public API exposure, blast radius verdict.
generate-microcks-openapi-samples
Use when creating OpenAPI mock examples for Microcks, setting up request/response routing with dispatchers, or mapping request fields to mock responses.
fix-tests
Focus on all unit + command tests (pytest --exclude tests/integration). Make sure they pass and fix errors. If you run into anything very odd: stop, and let me know. Mutate test code first and let me know if you think you should update application code.
implement-fastapi-routes
The file docstring contains a description of the FastAPI routes we need to implement. Implement these routes.
stripe-backend
Stripe Backend.