Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nordsym/apiclaw --skill publicgit clone --depth 1 https://github.com/nordsym/apiclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nordsym/apiclaw/public)<a href="https://agentmods.dev/skills/nordsym/apiclaw/public"><img src="https://agentmods.dev/badge/skills/nordsym/apiclaw/public.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.03142 |
| Opus 5 | $0.00062 | $0.01571 |
| Sonnet 5 | $0.00025 | $0.00628 |
| Haiku 4.5 | $0.00012 | $0.00314 |
Grade C, and why
apiclaw scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://apiclaw.cloud/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://apiclaw.cloud/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
APIClaw
Your agent calls real APIs. You sign in once. One workspace. Clerk auth.
The metric that matters is a successful POST /v1/execute, not an install.
Give an agent this file and it can install, sign in, and land one 200 without guessing.
Live catalog (2026-08-25). Use https://apiclaw.cloud/api/catalog if
counts must be current. Do not invent metrics.
- 1,025 callable
- 26,619 discoverable
- 22 built-in providers
Identity and product truth live at https://apiclaw.cloud/llms.txt.
This file is the operational door: auth, then whoami, then execute.
1. Install
Node.js 18+ and npx are enough. A global install is optional.
npx -y @nordsym/apiclaw@latest --version
Human shell door (same package, local MCP):
curl -fsSL https://apiclaw.cloud/install.sh | bash
2. Auth (Clerk). Never paste a token into chat.
Unsigned MCP / CLI first_run mints a pending login even with no TTY and
prints the exact https URL as the first line of the tool/CLI response
(then repeats it as login_url in JSON). The first lines look like:
https://apiclaw.cloud/auth/cli?authId=…
STOP. Show the human the login URL on the first line. Do not summarize it away. Do not execute.
Show the human that first-line URL on its own line so they can click it.
Do not bury it. Do not summarize the tool result. Do not only print
npx @nordsym/apiclaw auth login. A command without /auth/cli?authId=
is not enough.
If you are running on a machine the human cannot see (Grok Bot, cloud
VM, headless agent), do not run auth login there — that opens a
browser they will never get. The first-line URL in the tool response
is the only door. Show it. Stop. Wait.
npx @nordsym/apiclaw auth login
That command is the human-shell door on a machine they can see. It
opens the same browser URL (or reuses the pending one). Finish
Google or email on that URL. Completing sign-in there Authorizes this
agent (one action). If you are already signed in, click Authorize.
Do not tell a new user they still need a second click after sign-in.
Only then does the CLI write session_token to
~/.apiclaw.toml. Printing the URL is not success. Do not declare ready.
Do not execute.
What ships with it
33 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .well-known/openapi.json 7.2 KB
- .well-known/security.txt 155 B
- agents.md 8.1 KB
- android-chrome-192x192.png 6.2 KB
- android-chrome-512x512.png 23 KB
- apiclaw-banner.png 568 KB
- apple-touch-icon.png 5.6 KB
- badges/available-on-apiclaw.svg 855 B
- book/index.html 10 KB
- demo-product.jpg 7.5 KB
- demo.gif 243 KB
- demo.mp4 201 KB
- favicon-16x16.png 458 B
- favicon-32x32.png 926 B
- favicon.ico 926 B
- favicon.svg 113 B
- icon.svg 1.6 KB
- install.ps1 10 KB runs code
- install.sh 9.9 KB runs code
- llms-full.txt 9.1 KB
- llms.txt 9.7 KB
- logo-mono.svg 1.1 KB
- logo-simple.svg 1.3 KB
- logo.svg 2.2 KB
- logos/chattgpt.svg 242 KB
- logos/claude.svg 318 KB
- logos/gemini.svg 147 KB
- logos/grok.svg 20 KB
- og-template.html 4.0 KB
- robots.txt 478 B
- site.webmanifest 638 B
- sitemap.xml 1.4 KB
- stats.json 999 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +27 lines bdcada90d327
- 7d ago First seen · 255 lines · 123 tokens per session scan C 6b0fd18ee95c
apiclaw is a skill published in the GitHub repository nordsym/apiclaw (8 stars, last pushed 3d ago), licensed MIT. It adds 123 tokens to every session and 3,142 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
x402
Set up Browser Use Cloud payments with x402 — pay per request from a crypto wallet (USDC on Base mainnet), no signup or API key. Two setups it works out up front — "just use it" (set up a wallet so you or Claude Code can run cloud browser tasks paid from the wallet — Claude writes and runs throwaway scripts, nothing…
cloud
Documentation reference for using Browser Use Cloud — the hosted API and SDK for browser automation. Use this skill whenever the user needs help with the Cloud REST API (v2, v3, or v4), browser-use-sdk (Python or TypeScript), X-Browser-Use-API-Key authentication, cloud sessions, browser profiles, profile sync, CDP…
open-source
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…
nornweave-api
Give AI agents their own email inboxes using the NornWeave API. Use when building email agents, sending/receiving emails programmatically, managing inboxes, retrieving threads, searching messages, or integrating with email providers (Mailgun, SES, SendGrid, Resend). NornWeave provides LLM-ready markdown parsing and…
auth-middleware
Generates authentication and authorization middleware for Express/Fastify/Hono.
caching-strategy
Adds caching to expensive operations - Redis, in-memory, HTTP cache headers.