Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ntygod/zhiwei/api-debuggernpx skills add ntygod/ZhiWei --skill api-debuggergit clone --depth 1 https://github.com/ntygod/ZhiWeiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00641 |
| Opus 5 | $0.00018 | $0.00320 |
| Sonnet 5 | $0.00007 | $0.00128 |
| Haiku 4.5 | $0.00004 | $0.00064 |
Grade A, and why
api-debugger scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- curl What it actually says
API 调试指南
curl / Python requests 测试 REST / GraphQL 接口，验证响应格式、对比文档与实际行为。
适用场景
- REST API 请求测试（GET / POST / PUT / DELETE / PATCH）
- GraphQL 查询和变更测试
- 响应格式与状态码分析
- 接口文档对比实际返回（找出文档过期 / 行为异常）
- Mock 数据生成（造测试请求体）
- 批量接口测试（一组端点跑一遍）
不适用场景
- 浏览器端交互测试 → browser-automation
- 代码级单元测试 → code-assistant
- 简单单次 curl → 直接
shell_exec
工作流（按场景分流）
| 场景 | 路径 |
|---|---|
| 单端点测一次 | curl 模板（GET/POST/认证/GraphQL） |
| 验响应格式 | curl + jq / python -m json.tool 看结构 |
| 对比文档 vs 实际 | 调一次 → 跟文档逐字段对，输出差异表 |
| 批量测一组 | 先验单个 → 再 shell 循环或 python requests |
| Mock 数据 | 按 schema 造请求体（用户给字段约束就照填，没给就给典型值） |
各路径要点：
- 同时看状态码 + 响应体：单看 200 不够，body 可能是错误结构（"success":false）
- 敏感信息走变量：Token / API Key 用
$TOKEN/${API_KEY}，不写明文；写入文件时不带 token - 批量先试单个：批量执行前先跑一个验证格式，再 shell 循环或 python 批跑
- 结果落盘：批量测试结果
file_write写api-test-report.md，含端点 / 状态 / 响应摘要 / 差异 -k仅限测试环境：跳 SSL 证书校验只在 dev / staging 用，给用户结果时注明
详细参考
- curl 模板 / 响应分析 / 批量测试 / Mock 生成 / 常见错误：
{skill_dir}/references/curl-recipes.md
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 62 lines · 37 tokens per session scan A 8560063a4941
api-debugger is a skill published in the GitHub repository ntygod/ZhiWei (137 stars, last pushed 22d ago), licensed MIT. It adds 37 tokens to every session and 641 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
inbox-triage
Summarize unread Gmail messages Alfred Core has already synced, and offer to draft or schedule follow-up actions -- never sends or deletes anything on its own.
morning-brief
Render Alfred Core's deterministic morning brief and deliver a short, warm rewrite of it without changing any fact, date, or link it contains.
weekly-review
Pull together the week's open tasks, GitHub notifications, Canvas missing assignments, and remembered context into one retrospective-style summary.
docmancer
Work from the same local memory as every other coding agent on this machine. Recall prior decisions, preferences, instructions, and project conventions that Claude Code, Codex, Cursor, and other agents wrote here, with cited sources, fully local. Also searches a separate local technical-documentation index.
vault-for-llm
Connect OpenClaw to Vault Agent Memory as a local-first governed project memory layer. Search first, then bounded-read cited source ranges; propose new memories as candidates instead of writing directly into active memory.
mooncite
Use when an agent needs past Pi, OMP, Claude Code, Codex, or ChatGPT context.