APITester Agent-Driven API Testing

Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.

Security Scan

The skill's requested access, instructions, and included code are consistent with an API testing tool and do not request unrelated credentials or installs, though user-defined tests can of course send any data to any endpoint and should be reviewed before use.

Purpose & Capability

Name/description (agent-driven API testing) align with the included JavaScript implementation and SKILL.md examples. The skill does not request unrelated credentials, binaries, or config paths; the code implements HTTP(S) requests, result collection, variable chaining, and report formatting which matches the stated feature set.

Instruction Scope

SKILL.md limits behavior to running tests defined in YAML and generating reports. It does not instruct the agent to read unrelated files or env vars. However, tests are user-provided and may cause the agent to make arbitrary outbound HTTP requests (including to internal endpoints) and submit arbitrary request bodies, so test definitions themselves are a potential vector for accidental data leakage if they include secrets or target attacker-controlled endpoints.

Install Mechanism

No install spec or remote downloads; this is effectively instruction-only with a bundled JS file. Nothing is fetched from external URLs during install, which minimizes supply-chain risk. The single included source file is small and readable.

Credentials

The skill declares no required environment variables or credentials (proportional). Still, test definitions may legitimately contain sensitive tokens/credentials for the APIs being tested; users should avoid embedding long-lived secrets in shared test YAMLs and ensure sensitive values are stored/managed appropriately outside of public test definitions.

Persistence & Privilege

always is false and the skill does not request permanent platform-level privileges or modify other skills. The code does not persist data to disk (fs is imported but not used), so it does not create long-lived on-disk credentials or change agent configuration.

Assessment

This skill appears to be a straightforward API tester and is internally coherent. Before installing: (1) review any YAML test files you run — they can make arbitrary HTTP requests and may send sensitive data; do not include secrets in public/shared tests, use environment-specific secret management where possible; (2) run tests in a controlled environment or sandbox if you need to avoid contacting internal services or leaking data; (3) if you plan to run this in CI or with real credentials, audit the included src/api-tester.js (it is small and readable) and ensure network egress rules meet your policies. Minor note: the source requires 'fs' but doesn't use it; harmless but worth auditing if you modify the code.

Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.

---

Define API tests in plain English. Run them. Get documented results.

Usage

tests:
  - name: "Get all users"
    method: GET
    url: "https://api.example.com/users"
    expect:
      status: 200
      body_contains: "users"

  - name: "Create user"
    method: POST
    url: "https://api.example.com/users"
    body:
      name: "Test User"
      email: "[e-mail]"
    expect:
      status: 201

Test Results

API Test Results — 2026-02-28
✅ Get all users        200 OK    145ms
✅ Create user          201 OK    230ms
❌ Delete user          403 FORBIDDEN
✅ Update user          200 OK    189ms

Pass: 3/4 (75%) | Avg response: 188ms

Features

• YAML test definitions — no code required
• Variable chaining — use response values in subsequent requests
• Environment configs — dev, staging, prod
• Auto-documentation — generates API docs from test results
• Parallel execution — run independent tests concurrently
• Report generation — HTML, JSON, or markdown

---

⚠️ Disclaimer

This software is provided "AS IS", without warranty of any kind, express or implied.

USE AT YOUR OWN RISK.

• The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages.
• This software does NOT constitute financial, legal, trading, or professional advice.
• Users are solely responsible for evaluating whether this software is suitable for their use case, environment, and risk tolerance.
• No guarantee is made regarding accuracy, reliability, completeness, or fitness for any particular purpose.
• The author(s) are not responsible for how third parties use, modify, or distribute this software after purchase.

By downloading, installing, or using this software, you acknowledge that you have read this disclaimer and agree to use the software entirely at your own risk.

DATA DISCLAIMER: This software processes and stores data locally on your system. The author(s) are not responsible for data loss, corruption, or unauthorized access resulting from software bugs, system failures, or user error. Always maintain independent backups of important data. This software does not transmit data externally unless explicitly configured by the user.

---

Support & Links

🐛 Bug Reports	[e-mail]
☕ Ko-fi	ko-fi.com/theshadowrose
🛒 Gumroad	shadowyrose.gumroad.com
🐦 Twitter	@TheShadowyRose
🐙 GitHub	github.com/TheShadowRose
🧠 PromptBase	promptbase.com/profile/shadowrose

Built with OpenClaw — thank you for making this possible.

---

🛠️ Need something custom? Custom OpenClaw agents & skills starting at $500. If you can describe it, I can build it. → Hire me on Fiverr