\r \r

跨境卫士客户端\r

\r Use this skill when the task involves interacting with the 跨境卫士客户端 API, including:\r \r

• understanding available endpoints\r
• generating curl commands\r
• filling path, query, header, and body parameters\r
• handling authentication\r
• testing API requests\r
• debugging request and response failures\r
• translating user intent into concrete API calls\r \r

Bundled references\r

\r Before making assumptions about endpoints, request bodies, or response schemas, read the bundled OpenAPI specification from one of the following files:\r \r

• references/openapi.yaml\r
• references/openapi.json\r \r If present, also read:\r \r
• references/auth.md\r \r Do not invent endpoints, fields, enum values, request formats, or response shapes that are not defined by the bundled specification or auth notes.\r \r

Workflow\r

\r

1. Read the OpenAPI spec and identify the correct path and HTTP method.\r
2. Determine:\r
   • base URL or server\r
   • authentication scheme\r
   • required headers\r
   • path parameters\r
   • query parameters\r
   • request body schema\r
   • expected response schema\r
3. Translate the user's goal into a concrete API call.\r
4. Prefer showing the exact curl command before or alongside execution when that improves transparency.\r
5. Use safe shell quoting when constructing commands.\r
6. Never expose secrets in full.\r
7. Summarize the result clearly, including the HTTP status code and important response fields.\r \r

Authentication rules\r

\r

• First inspect the OpenAPI spec for the declared security scheme.\r
• If references/auth.md exists, follow it as the source of truth for authentication details not fully expressed in the OpenAPI document.\r
• If credentials are already available in environment variables or local config, use them.\r
• Never print secret values in full.\r
• If a token or key must be shown for debugging, redact the middle portion.\r \r Common environment variable patterns to check:\r \r
• BASE_URL\r
• API_APP_ID\r
• API_APP_SECRET\r
• X_APP_ID\r
• X_APP_SECRET\r
• API_KEY\r
• ACCESS_TOKEN\r
• BEARER_TOKEN\r \r If the local auth notes define different names, follow those instead.\r \r

Request construction rules\r

\r

Path parameters\r

\r Always substitute all required path parameters.\r \r

Query parameters\r

\r Only include query parameters that are relevant or explicitly requested. Do not send null or empty values unless the API expects them.\r \r

Request body\r

\r Build JSON request bodies that conform to the schema in the OpenAPI specification. If the schema has required fields, ensure they are present before sending the request.\r \r

Headers\r

\r Always include:\r \r

• Accept: application/json\r \r Include:\r \r
• Content-Type: application/json\r \r when sending JSON request bodies.\r \r If the API uses custom authentication headers such as x-app-id and x-app-secret, include them on every authenticated request.\r \r

Execution pattern\r

\r Prefer this style for JSON requests:\r \r

curl -sS \\r
  -X POST "$BASE_URL/example/path" \\r
  -H "Accept: application/json" \\r
  -H "Content-Type: application/json" \\r
  --data '{...}'