Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add liuxinye23/CyberStrikeAI --skill openapi-contract-reviewgit clone --depth 1 https://github.com/liuxinye23/CyberStrikeAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liuxinye23/cyberstrikeai/openapi-contract-review)<a href="https://agentmods.dev/skills/liuxinye23/cyberstrikeai/openapi-contract-review"><img src="https://agentmods.dev/badge/skills/liuxinye23/cyberstrikeai/openapi-contract-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liuxinye23/cyberstrikeai/openapi-contract-review"><img src="https://agentmods.dev/badge/skills/liuxinye23/cyberstrikeai/openapi-contract-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00791 |
| Opus 5 | $0.00017 | $0.00396 |
| Sonnet 5 | $0.00007 | $0.00158 |
| Haiku 4.5 | $0.00003 | $0.00079 |
Grade A, and why
openapi-contract-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
OpenAPI 契约审计
何时使用
当目标提供 OpenAPI/Swagger 文档、导出的接口契约、前后端共享 schema，或大量 JSON API 需要结构化审计时，优先调用本技能。
快速流程
- 先确认契约来源：线上公开文档、代码仓库、导出文件、网关配置。
- 枚举所有路径、方法、认证方式、批量接口、导出接口、上传接口和管理员接口。
- 对照 schema 审核字段约束、只读/只写边界、默认值、枚举、分页、排序、过滤与错误模型。
- 将“契约允许的输入”与“服务端真实行为”做抽样核对。
重点检查
认证与授权边界
- 不同路径是否声明了不同安全需求，还是全部继承了过宽的默认配置。
- 管理员接口、批量操作、导出接口是否在契约里被弱化或漏标。
字段与对象模型
- 是否缺少关键字段约束，例如长度、格式、枚举、只读/只写、最小最大值。
- 是否把内部字段、角色字段、租户字段、审批字段直接暴露为可写。
批量与危险操作
- 批量更新、批量删除、导入导出、异步任务、回调配置等高影响接口是否有单独限制。
- 契约是否模糊地复用了通用请求体，导致危险字段“顺便可写”。
错误与兼容性
- 契约中的错误响应是否足够区分认证失败、权限不足、参数错误、资源不存在。
- 版本兼容策略、弃用接口和隐藏接口是否有可见约束。
建议工具
api-schema-analyzer
- 用于快速审阅 schema 结构、字段、鉴权声明和批量写接口。
http-framework-test
- 对高风险接口做只读抽样核对，确认线上行为与契约是否一致。
arjun
- 在契约不完整或文档过旧时，补充挖掘隐藏参数与未文档化字段。
证据要求
- 记录路径、方法、认证方式、可疑字段和契约片段摘要。
- 区分“文档缺陷”和“真实安全缺陷”；若两者并存，要分别说明。
- 对高风险字段写明其可能导致的数据或权限影响。
修复建议方向
- 把安全边界直接表达在契约中，而不是只在实现里“默认处理”。
- 为高影响接口单独设计请求体与权限模型。
- 建立契约与线上行为的回归校验。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 94 lines · 35 tokens per session scan A e54bd5967cfe
openapi-contract-review is a skill published in the GitHub repository liuxinye23/CyberStrikeAI (0 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 35 tokens to every session and 791 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mem0-oss-to-platform
Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…
agui-dotnet-protobuf
Use the protobuf wire transport (instead of the default Server-Sent Events) for an AG-UI connection with the AG-UI .NET SDK — a compact binary event stream negotiated via the Accept header. USE FOR: making an AGUIChatClient prefer protobuf by wiring an AGUIEventStreamHandler with ProtobufEventStreamFormatter (then…
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".
fastapi-router-py
Create FastAPI routers with CRUD operations, authentication dependencies, and proper response models. Use when building REST API endpoints, creating new routes, implementing CRUD operations, or adding authenticated endpoints in FastAPI applications.
migrate-segw-to-rap
Reverse-engineer a SEGW-built OData V2 service (MPC/DPC/MPCEXT/DPCEXT) into a modern RAP V4 service — tables, CDS views (interface + projection), behavior definitions, draft entities, service definition + binding. Use when asked to "migrate this SEGW service to RAP", "convert OData V2 to V4 RAP", "modernize this…
telnyx-messaging-hosted-curl
Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.