AAS Core is a local control plane for coding agents that lets them search a large catalogue of skills, choose a stack, validate it, and create a reproducible plan. It is used to assemble and review agent workflows through its CLI, local MCP server, catalogue, plugins, and Workbench. The catalogue add-ons provide the skills, plugins, bundles, and workflows that AAS Core helps agents select and validate.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sickn33/agentic-awesome-skills --skill api-analyzergit clone --depth 1 https://github.com/sickn33/agentic-awesome-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sickn33/agentic-awesome-skills/api-analyzer)<a href="https://agentmods.dev/skills/sickn33/agentic-awesome-skills/api-analyzer"><img src="https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/api-analyzer.svg" alt="Measured on agentmods" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high System Prompt Leakage · line 21 Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
- high Tool Misuse · line 65 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01006 |
| Opus 5 | $0.00015 | $0.00503 |
| Sonnet 5 | $0.00006 | $0.00201 |
| Haiku 4.5 | $0.00003 | $0.00101 |
Grade A, and why
api-analyzer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Use this skill when you need validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params). Use this skill whenever a user wants to check, validate, debug, or verif Copies of this mod
4 near-identical copies found in the catalogue:
- api-analyzer — 100% identical, 0 lines differ
- api-analyzer — 100% identical, 0 lines differ
- api-analyzer — 97% identical, 2 lines differ
- api-analyzer — 97% identical, 2 lines differ
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Analyzer
When to Use
Use this skill when you need validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params). Use this skill whenever a user wants to check, validate, debug, or verify an API call — including when they paste a curl command, show endpoint details, ask "is this...
Your job: validate an API request and respond in one line (or two at most if needed). Be a strict, efficient reviewer — no padding, no explanations beyond what's necessary.
Output Rules
- ✅ If correct: one line —
Looks correct.orValid request. - ❌ If incorrect: one line — state the error + one-line fix. Example:
Missing Authorization header — add \Authorization: Bearer `.` - ⚠️ If ambiguous: ask one targeted question before validating. Never ask more than one question at a time. Only ask if the missing info would change your verdict.
When to Ask a Question
Ask only if the answer could flip your assessment. Examples:
- POST/PUT/PATCH with no body → ask:
Is there a request body? - No auth header on a likely-protected endpoint → ask:
Does this endpoint require authentication? - Ambiguous content-type with a body → ask:
What format is the body — JSON or form data?
Do not ask about things that don't affect correctness (e.g., optional headers, environment details).
What to Check
- Method — correct verb for the operation (GET has no body, POST/PUT/PATCH usually do)
- URL — well-formed, no obvious typos, path params filled in
- Headers — Content-Type matches body format; Authorization present if endpoint seems protected
- Body — valid format per Content-Type; required fields present if schema is known
- Query params — required ones present, correctly encoded
- Auth — token/key format looks right for the scheme (Bearer, Basic, API key)
Response Format
[✅/❌/⚠️] <one-line verdict or question>
Skip the emoji if it feels redundant. Never add preamble like "Sure!" or postamble like "Let me know if you need more help."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -37 tokens per session 5b06a4022c27
- 2d ago First seen · 102 lines · 67 tokens per session scan A 5a6704ead19b
api-analyzer is a skill published in the GitHub repository sickn33/agentic-awesome-skills (46,082 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 1,006 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
profiling-guide
Professional Profiling Guide Expert skill. Build performant, secure, and scalable backend logic and RESTful or GraphQL APIs.
debugging-expert
Professional Debugging Expert skill. Build performant, secure, and scalable backend logic and RESTful or GraphQL APIs.
troubleshooting
Systematic backend debugging — reproduce, isolate root cause, implement fix with regression test.
laravel-api
Build production-ready RESTful APIs with Laravel. Covers authentication (Sanctum/Passport), versioning, resources, rate limiting, and API testing.
wordpress-developer
Develop professional WordPress sites, custom themes, and plugins. Covers WordPress best practices, hooks system, custom post types, WP REST API, and security.
websocket-architect
Design and implement real-time features using WebSockets. Covers Laravel Reverb, Pusher, Socket.io, broadcasting, and live update patterns.