QA API Tester

API interface testing and automation. Send HTTP requests, validate responses, chain API calls, generate test scripts (Python requests/pytest, curl, Postman c...

This skill appears to genuinely provide API testing helpers, but the metadata is incomplete. Before installing or running it: (1) ensure required tools are present — curl, python3, jq, pytest (or the Python packages requests and pytest) — or be prepared to install them; (2) don't run tests against production systems or provide real credentials until you verify endpoints and test payloads; (3) avoid putting long-lived secrets directly in files under ~/.openclaw/workspace — use ephemeral tokens or CI/service accounts; (4) ask the publisher to update the manifest to list expected env vars (e.g., TOKEN, BASE_URL) and dependencies so you know what the skill truly needs; (5) run the generated scripts in an isolated environment (container or throwaway VM) the first time to confirm behavior. These mismatches look like sloppy metadata rather than malicious intent, but verify dependencies and endpoints before use.

Type: OpenClaw Skill Name: qa-api-tester Version: 1.0.0 The 'qa-api-tester' skill bundle is a standard toolkit for API testing and automation. It provides legitimate templates for curl commands, pytest scripts, and Postman collections. The instructions in SKILL.md are well-aligned with its stated purpose, and the code snippets follow security best practices, such as using environment variables for authentication tokens rather than hardcoding them. No indicators of data exfiltration, malicious execution, or harmful prompt injection were found.