Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jansenanalytics/claudex/api-criticnpx skills add JansenAnalytics/claudex --skill api-criticgit clone --depth 1 https://github.com/JansenAnalytics/claudexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.00842 |
| Opus 5 | $0.00036 | $0.00421 |
| Sonnet 5 | $0.00014 | $0.00168 |
| Haiku 4.5 | $0.00007 | $0.00084 |
Grade A, and why
api-critic scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
None. Uses only Node.js built-in modules (http, https, fs, path, url, child_process). How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
api-critic — Autonomous API Testing & Evaluation
Like design-critic but for backends. Tests any REST API for correctness, security, performance, error handling, and standards compliance.
Quick Start
api-critic https://jsonplaceholder.typicode.com
api-critic http://localhost:3000 --auth "Bearer token" --full
api-critic http://localhost:3000 --quick
api-critic http://localhost:3000 --compare /tmp/api-critic-previous
Options
| Flag | Description |
|---|---|
--endpoints FILE |
Manual route list (JSON: [{method, path, body?}]) |
--auth "Bearer x" |
Authorization header for all requests |
--timeout MS |
Request timeout (default: 10000) |
--quick |
Skip edge cases (SQL injection, XSS, oversized payload) |
--full |
Run everything including extended probes |
--compare DIR |
Compare with previous run's output directory |
--out-dir DIR |
Output directory (default: /tmp/api-critic-TIMESTAMP) |
What It Tests
Correctness
- Happy path (valid requests → 2xx)
- JSON validity, schema types
- Status code correctness (201 for POST, 204 for DELETE)
Security
- CORS wildcard detection
- Auth bypass (requests without auth header)
- Malformed token acceptance
- SQL injection strings in query params
- XSS reflection in responses
- Mass assignment (extra unknown fields accepted)
Performance
- Response time (>500ms warning, >2000ms critical)
Error Handling
- Empty body, null values → should get 4xx not 5xx
- Wrong Content-Type handling
- Oversized payload (1MB)
Standards
- Content-Type headers present
- Cache headers on GET responses
- 405 for wrong HTTP methods
- Pagination support detection
Pipeline
- discover.cjs — Finds endpoints (OpenAPI spec, common paths, CRUD inference)
- probe.cjs — Runs all tests against each endpoint
- report.cjs — Generates scored report (0-100, grade A-F)
Output
discovered-endpoints.json— Found endpointsprobe-results.json— Raw test resultsapi-critic-report.md— Human-readable reportapi-critic-report.json— Machine-readable summary
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 99 lines · 72 tokens per session scan A e0722872e41f
api-critic is a skill published in the GitHub repository JansenAnalytics/claudex (5 stars, last pushed 2mo ago), licensed MIT. It adds 72 tokens to every session and 842 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
API Test Suite Generator
Automatically generate comprehensive API test suites from OpenAPI specifications covering CRUD operations, error handling, authentication, pagination, and edge cases.
sql-database-support
Guides classifying, gap-analyzing, and scaffolding support for a new SQL database in pREST (wire-compatible variants like TimescaleDB or new dialects). Use when adding database support, creating integration/ /, DIFFERENCES.md, adapters/ , per-DB docker-compose or GitHub workflows, or planning where config/app wiring…
noodle-use
Teach agents to create, organize, maintain, evaluate, import, convert, and automate noodle terminal REST client collections using supported CLI commands plus YAML and dotenv files.
forgetful-cli-setup
Set up the Forgetful CLI and connect from a terminal — install, local or remote mode, auth, and verification. Use when connecting a human or headless agent via shell, wiring CI with token auth, or operating a local server (serve, database selection, feature flags, re-embedding). Also covers the machine contract…
ocli-api
Turn any OpenAPI/Swagger API into CLI commands and call them. Search endpoints with BM25, check parameters, execute — no MCP server needed.
ast-introspection
Use Go AST-aware analysis to enumerate symbols, extract signatures, and propose mechanically safe refactors (read-only by default).