REST API Tester

Test REST APIs with customizable headers, authentication, and request bodies. Use when debugging API endpoints, testing authentication flows, validating resp...

This skill is essentially a set of code examples for testing APIs — it's coherent and doesn't ask for secrets itself, but be careful when using it: do not paste real production credentials into examples you run; run tests and the Flask listener in an isolated or disposable environment; be cautious when exposing local services with ngrok (it can expose local resources to the public); pin and review any pip packages you install (use a virtualenv and consider specifying versions); and review any URLs the skill will contact to avoid sending sensitive data to unintended endpoints.

Type: OpenClaw Skill Name: rest-api-tester Version: 1.0.0 The skill bundle is classified as suspicious due to its inherent capabilities for making arbitrary network requests and running a local web server, which, while legitimate for an API testing tool, present significant security risks. The `requests` library is used to perform GET/POST/PUT/DELETE/PATCH operations to any specified URL, potentially leading to Server-Side Request Forgery (SSRF) if the agent's input is not properly sanitized. Additionally, the `create_webhook_listener` function in `SKILL.md` uses Flask to create a local web server, which could expose a port on the agent's host, especially with the suggested `ngrok` usage. There is no evidence of intentional malicious behavior such as data exfiltration or backdoor installation, but the powerful network access capabilities make it a high-risk tool that could be abused.