Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/mendixlabs/mxclinpx agentmods add skills/mendixlabs/mxcli/rest-call-from-jsonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mendixlabs/mxcli/rest-call-from-json)<a href="https://agentmods.dev/skills/mendixlabs/mxcli/rest-call-from-json"><img src="https://agentmods.dev/badge/skills/mendixlabs/mxcli/rest-call-from-json/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mendixlabs/mxcli/rest-call-from-json"><img src="https://agentmods.dev/badge/skills/mendixlabs/mxcli/rest-call-from-json.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 223 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.03598 |
| Opus 5.5 | $0.00020 | $0.01439 |
| Sonnet 5.5 | $0.00010 | $0.00720 |
| Haiku 4.5 | $0.00005 | $0.00360 |
Grade A, and why
rest-call-from-json scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 380 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Find it fast
sed -n '<from>,<to>p' SKILL.md one section rather than reading the file;
./mxcli syntax <topic> answers how do I write this for a fraction of either.
| lines | section |
|---|---|
| 35-43 | Overview — Four Steps |
| 44-64 | Step 1 — JSON Structure |
| 65-98 | Step 2 — Non-Persistent Entities |
| 99-133 | Step 3 — Import Mapping |
| 134-173 | Step 4 — REST CALL Microflow |
| 174-213 | Step 5 — Import/Export Mapping in Microflows (Optional) |
| 214-277 | Step 6 — Sending a Request Body (Optional) |
| 278-353 | Complete Example — Bible Verse API |
| 354-369 | Gotchas and Common Errors |
| 370-379 | Naming Conventions (MES) |
REST Call from JSON Payload — End-to-End Skill
Use this skill to generate the full stack of Mendix integration artifacts from a JSON payload: JSON Structure → Non-persistent entities → Import Mapping → microflow.
Two approaches: This skill uses the inline REST CALL approach (good for one-off calls and quick prototyping). For structured APIs with reusable operations, use the REST Client approach instead — see rest-client for
create consumed rest service+send rest request
- optional
transformwith JSLT data transformers.
Overview — Four Steps
- CREATE JSON STRUCTURE — store the raw payload and derive the element tree
- CREATE ENTITY (non-persistent) — one per JSON object type, with attributes per JSON field
- CREATE IMPORT MAPPING — link JSON structure elements to entities and attributes
- CREATE MICROFLOW — inline REST CALL that invokes the import mapping (or use REST Client + SEND REST REQUEST)
Step 1 — JSON Structure
mdl 1;
create json structure Module.JSON_MyStructure
sample '{"key": "value", "count": 1}';
- The executor formats the snippet (pretty-print) then refreshes (derives element tree) automatically.
- The snippet must be valid JSON; use single quotes around it in MDL.
- Escape single quotes inside the snippet by doubling them:
''. - The derived element tree must stay consistent with the snippet — the executor sorts JSON object keys alphabetically to match
json.MarshalIndentoutput.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +19 lines 8f57185c8fef
- 10d ago Changed · +10 lines 40eb1b17ea4f
- 15d ago Changed · +3 lines 37f5087a628a
- 16d ago Changed 27cb3a52cce6
- 1mo ago First seen · 348 lines · 51 tokens per session scan A ed68eb3a1f8c
rest-call-from-json is a skill published in the GitHub repository mendixlabs/mxcli (131 stars, last pushed yesterday), licensed Apache-2.0. It adds 51 tokens to every session and 3,598 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
hatch3r-api-spec
Generates and validates OpenAPI specifications from codebase. Covers endpoint design, schema validation, and documentation generation.
hatch3r-scalability-verify
Scalability verification gate before commit/release — stateless-handler ratio, back-pressure patterns, idempotency-key adoption, queue-based offloading, pool sizing, bulkheads, load-test pass at target scale.
golang-manual-di
Guides manual dependency injection wiring for Go services: three-tier naming taxonomy (Provide/MustProvide/Must), Must-pattern entrypoints, OS-signal-driven context lifecycle, common provider structs, infrastructure must-builders, interface-segregated bus registration, decorator/tracing wrappers, and…
terraform-infrastructure
Structures, writes, and reviews Terraform infrastructure code. Covers module layout, remote state, workspace strategy, variable and secrets handling, CI plan/apply pipeline, naming conventions, and multi-region deployment patterns (provider aliases, per-region state, failover strategies), while delegating shared risk…
microservices-architecture
Guides service boundary analysis, communication pattern selection, data consistency design, API contract strategy, and resilience checklist for microservices systems. Complements the microservices fragment. Invoked when the user asks to design a microservices system, split a monolith, or review service boundaries.
nosql-database-design
Designs a NoSQL data model by leading with access pattern analysis. Covers DynamoDB single-table design (PK/SK/GSI) and MongoDB embedding vs referencing, consistency models, and capacity planning. Invoked when the user asks to design a DynamoDB schema, MongoDB data model, or NoSQL data model.