Automates API testing, monitors response times, validates data, checks status codes, performs performance and regression tests, and integrates with CI/CD.

This package appears inconsistent rather than clearly malicious: the docs advertise a full testing/monitoring product but the code only performs a single HTTP request and writes a markdown report. Before installing or running: - Don't point it at sensitive internal endpoints or production systems until you verify behavior in a sandbox (it will send requests to whatever URL you provide). - Be aware the SKILL.md CLI examples (flags like --monitor, --load, --concurrency) are not implemented; rely on the shipped main.py interface or ask the author for clarification. - The 'auth' mode uses a hardcoded header value ('Bearer test_token') — the tool does not accept user-supplied credentials, which limits usefulness and may be a leftover/demo artifact. Avoid using any 'auth' option with real credentials until the implementation is corrected. - package.json exists but the project is Python-based (main.py); confirm dependency management (requests) and consider running in an isolated environment (container/VM) so the script cannot access other local files. If you intend to use this for production testing, ask the publisher for a clear roadmap: implement real auth handling, documented CLI consistent with SKILL.md, true load/monitoring capabilities, dependency manifest (requirements.txt/pyproject), and CI/CD integration examples. If the developer cannot or will not clarify these mismatches, treat the skill as incomplete/experimental and use it in a restricted/testing environment only.

Type: OpenClaw Skill Name: ai-api-test Version: 1.0.0 The `main.py` script directly uses user-provided URLs and HTTP methods from command-line arguments (`sys.argv`) without any input sanitization or validation when making network requests via the `requests` library. This creates a Server-Side Request Forgery (SSRF) vulnerability, allowing an attacker to potentially probe internal network services or access resources not intended for public exposure. While this is a significant security flaw, there is no clear evidence of intentional malicious behavior such as data exfiltration to external servers, persistence mechanisms, or unauthorized system modifications; the reports are saved locally.