Curl Http

Essential curl commands for HTTP requests, API testing, and file transfers.

Security Scan

This is an instruction-only curl cheat-sheet that is internally consistent with its stated purpose and does not request extra credentials or installs.

Purpose & Capability

Name/description present a curl HTTP client guide and the SKILL.md contains curl commands and examples — what it claims to do matches what it instructs. Minor metadata mismatch: SKILL.md metadata lists requires bins:["curl"] while the registry metadata above lists no required binaries.

Instruction Scope

The instructions are focused on making HTTP requests and file transfers with curl. They include examples that reference local files (e.g., @data.json, client.key, cookies.txt) and show how to include credentials (basic auth, headers, API keys in URL) and insecure options (-k, API keys in query). These are relevant to curl usage but can encourage insecure practices or cause local file access if the agent executes them — the examples are expected for a curl guide but warrant caution.

Install Mechanism

No install spec and no code files — lowest-risk instruction-only skill. Nothing will be downloaded or written to disk by installing the skill.

Credentials

The skill declares no required environment variables or credentials. The examples show how to supply auth credentials for target services (normal for HTTP client documentation) but there is no request for unrelated secrets.

Persistence & Privilege

always:false and normal model invocation settings. The skill can be invoked autonomously (platform default), which means an agent could run curl commands when it decides to use this skill — this is expected for an instruction skill of this type.

Assessment

This skill is essentially a curl command reference and looks coherent. Before using it, note: (1) it contains examples that place credentials on the command line or in URLs and uses -k — these can leak secrets via shell history, process lists, or network logs; avoid those patterns in production. (2) Some examples reference local files (client keys, cookies, @data.json) — if the agent executes commands it may read local files you specify. (3) There's a small metadata inconsistency about declaring the curl binary requirement. If you plan to let the agent run commands, ensure you trust it with network access and do not store secrets in CLI arguments or query strings; prefer protected files, headers, or secure credential stores.

curl - HTTP Client

Command-line tool for making HTTP requests and transferring data.

Basic Requests

GET requests

# Simple GET request
curl https://api.example.com

# Save output to file
curl https://example.com -o output.html
curl https://example.com/file.zip -O  # Use remote filename

# Follow redirects
curl -L https://example.com

# Show response headers
curl -i https://example.com

# Show only headers
curl -I https://example.com

# Verbose output (debugging)
curl -v https://example.com

POST requests

# POST with data
curl -X POST https://api.example.com/users \
  -d "name=John&email=[e-mail]"

# POST JSON data
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name":"John","email":"[e-mail]"}'

# POST from file
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d @data.json

# Form upload
curl -X POST https://api.example.com/upload \
  -F "file=@document.pdf" \
  -F "description=My document"

Other HTTP methods

# PUT request
curl -X PUT https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"name":"Jane"}'

# DELETE request
curl -X DELETE https://api.example.com/users/1

# PATCH request
curl -X PATCH https://api.example.com/users/1 \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]"}'

Headers & Authentication

Custom headers

# Add custom header
curl -H "User-Agent: MyApp/1.0" https://example.com

# Multiple headers
curl -H "Accept: application/json" \
     -H "Authorization: Bearer token123" \
     https://api.example.com

Authentication

# Basic auth
curl -u username:password https://api.example.com

# Bearer token
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.example.com

# API key in header
curl -H "X-API-Key: your_api_key" \
  https://api.example.com

# API key in URL
curl "https://api.example.com?api_key=your_key"

Advanced Features

Timeouts & retries

# Connection timeout (seconds)
curl --connect-timeout 10 https://example.com

# Max time for entire operation
curl --max-time 30 https://example.com

# Retry on failure
curl --retry 3 https://example.com

# Retry delay
curl --retry 3 --retry-delay 5 https://example.com

Cookies

# Send cookies
curl -b "session=abc123" https://example.com

# Save cookies to file
curl -c cookies.txt https://example.com

# Load cookies from file
curl -b cookies.txt https://example.com

# Both save and load
curl -b cookies.txt -c cookies.txt https://example.com

Proxy

# Use HTTP proxy
curl -x http://proxy.example.com:8080 https://api.example.com

# With proxy authentication
curl -x http://proxy:8080 -U user:pass https://api.example.com

# SOCKS proxy
curl --socks5 127.0.0.1:1080 https://api.example.com

SSL/TLS

# Ignore SSL certificate errors (not recommended for production)
curl -k https://self-signed.example.com

# Use specific SSL version
curl --tlsv1.2 https://example.com

# Use client certificate
curl --cert client.crt --key client.key https://example.com

# Show SSL handshake details
curl -v https://example.com 2>&1 | grep -i ssl

Response Handling

Output formatting

# Silent mode (no progress bar)
curl -s https://api.example.com

# Show only HTTP status code
curl -s -o /dev/null -w "%{http_code}" https://example.com

# Custom output format
curl -w "\nTime: %{time_total}s\nStatus: %{http_code}\n" \
  https://example.com

# Pretty print JSON (with jq)
curl -s https://api.example.com | jq '.'

Range requests

# Download specific byte range
curl -r 0-1000 https://example.com/large-file.zip

# Resume download
curl -C - -O https://example.com/large-file.zip

File Operations

Downloading files

# Download file
curl -O https://example.com/file.zip

# Download with custom name
curl -o myfile.zip https://example.com/file.zip

# Download multiple files
curl -O https://example.com/file1.zip \
     -O https://example.com/file2.zip

# Resume interrupted download
curl -C - -O https://example.com/large-file.zip

Uploading files

# FTP upload
curl -T file.txt ftp://ftp.example.com/upload/

# HTTP PUT upload
curl -T file.txt https://example.com/upload

# Form file upload
curl -F "file=@document.pdf" https://example.com/upload

Testing & Debugging

API testing

# Test REST API
curl -X GET https://api.example.com/users
curl -X GET https://api.example.com/users/1
curl -X POST https://api.example.com/users -d @user.json
curl -X PUT https://api.example.com/users/1 -d @updated.json
curl -X DELETE https://api.example.com/users/1

# Test with verbose output
curl -v -X POST https://api.example.com/login \
  -H "Content-Type: application/json" \
  -d '{"username":"test","password":"pass"}'

Performance testing

# Measure request time
curl -w "Total time: %{time_total}s\n" https://example.com

# Detailed timing
curl -w "\nDNS: %{time_namelookup}s\nConnect: %{time_connect}s\nTLS: %{time_appconnect}s\nTransfer: %{time_starttransfer}s\nTotal: %{time_total}s\n" \
  -o /dev/null -s https://example.com

Common debugging

# Show request and response headers
curl -v https://api.example.com

# Trace request
curl --trace-ascii trace.txt https://api.example.com

# Include response headers in output
curl -i https://api.example.com

Common Patterns

Quick JSON API test:

curl -s https://api.github.com/users/octocat | jq '{name, bio, followers}'

Download with progress bar:

curl -# -O https://example.com/large-file.zip

POST JSON and extract field:

curl -s -X POST https://api.example.com/login \
  -H "Content-Type: application/json" \
  -d '{"user":"test","pass":"secret"}' | jq -r '.token'

Check if URL is accessible:

if curl -s --head --fail https://example.com > /dev/null; then
  echo "Site is up"
else
  echo "Site is down"
fi

Parallel downloads:

for i in {1..10}; do
  curl -O https://example.com/file$i.jpg &
done
wait

Useful Flags

• -X: HTTP method (GET, POST, PUT, DELETE, etc.)
• -d: Data to send (POST/PUT)
• -H: Custom header
• -o: Output file
• -O: Save with remote filename
• -L: Follow redirects
• -i: Include headers in output
• -I: Headers only
• -v: Verbose output
• -s: Silent mode
• -S: Show errors even in silent mode
• -f: Fail silently on HTTP errors
• -k: Insecure (ignore SSL)
• -u: Basic authentication
• -F: Multipart form data
• -b: Send cookies
• -c: Save cookies
• -w: Custom output format

Tips

• Use -s in scripts to suppress progress bar
• Combine -sS for silent but show errors
• Use -L for redirects (e.g., shortened URLs)
• Add -v for debugging
• Use jq to process JSON responses
• Save common requests as shell aliases or scripts
• Use --config for complex reusable requests

Documentation

Official docs: https://curl.se/docs/ Manual: man curl HTTP methods: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods