← 返回 Skills 市场
squidtestgary

api-test-reporter

作者 squidtestgary · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
96
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install api-test-reporter
功能描述
Automates API testing from interface docs by generating detailed HTML reports with test cases, parameters, responses, and validation results for JSON POST/GE...
使用说明 (SKILL.md)

\r \r

API 接口自动化测试报告 Skill\r

\r

功能概述\r

\r 将接口文档转化为一套完整的自动化测试,生成可视化 HTML 报告,报告包含:\r

  • 测试用例:ID、分组、名称、描述\r
  • 入参:每条用例发送的完整 JSON 请求体\r
  • 返参:响应耗时、完整响应 JSON\r
  • 校验结果:每条校验项的通过/失败明细\r \r

与 isp-api-tester 的关系\r

\r | 场景 | 使用的执行器 |\r |------|------------|\r | 百望 ISP 开放平台接口 | isp-api-testerrun_isp_test.py(内置动态签名) |\r | 通用 HTTP 接口 | 本 skill 的 run_api_test.py |\r \r generate_report.pyreport_template.htmlisp-api-tester 跨 skill 引用。\r \r ---\r \r

执行流程\r

\r

第一步:解析接口文档\r

\r 从 Markdown 文档提取:\r

  • 请求地址、方式(POST/GET)\r
  • 公共参数(method、version 等 URL query 参数)\r
  • 业务请求参数(字段名、类型、是否必填、枚举值)\r \r

第二步:数据库取数(优先)\r

\r 如果提供了数据库信息,先执行此步:\r

  1. 连接数据库,找到对应业务表\r
  2. 查询真实记录,注意发票类型字段规则(见下方)\r
  3. 建立 DB 字段 → 接口入参字段 的映射关系\r \r 发票类型字段规则:\r \r | 票种大类 | invoiceCode | invoiceNumber |\r |---------|:-----------:|:-------------:|\r | 数电票(31/32/51/59/61/83/84) | ❌ 不传 | E_INV_NUM(20位数电号码) |\r | 税控票(01/03/04/08/10/11/14/15) | INV_KIND | INV_NUM |\r | 数电纸票(85/86/87/88) | INV_KIND | INV_NUM |\r \r

数电票的 invoiceCode 必须完全不传(传空串 "" 会触发 704 参数为空错误)\r \r

第三步:设计测试用例\r

\r | 分组 | 策略 |\r |------|------|\r | 必填参数验证 | 每个必填字段:缺失1条 + 空字符串1条 |\r | 分页参数验证 | 正常值 + 边界值 + 负数 |\r | 枚举字段验证 | 每个合法枚举值1条 + 非法值1条 |\r | 日期范围筛选 | 正常范围 + 起止倒置 + 格式错误 |\r | 状态/标记字段 | 每个合法值各1条 |\r | 综合多条件组合 | 2~3字段组合 + 全量字段组合 |\r | 边界与异常参数 | 超长字段 + 空body + 类型错误 |\r \r 正向用例(expect success=true)的入参字段值必须从数据库获取真实值。\r \r

第四步:执行测试\r

\r ISP 接口(需要动态签名):\r

python ~/.workbuddy/skills/isp-api-tester/scripts/run_isp_test.py --config test_config_xxx.json --output ./\r
```\r
\r
**通用 HTTP 接口:**\r
```bash\r
python ~/.workbuddy/skills/api-test-reporter/scripts/run_api_test.py --config test_config.json --output ./\r
```\r
\r
### 第五步:输出文件\r
\r
| 文件 | 说明 |\r
|------|------|\r
| `test_report_\x3Cmethod>_\x3Ctimestamp>.html` | 可视化报告(双击打开) |\r
| `__REPORT_DATA__.js` | 报告数据文件(与 HTML 同目录,不可删) |\r
| `test_results_\x3Cmethod>_\x3Ctimestamp>.json` | 原始结果 JSON |\r
\r
---\r
\r
## test_config.json 格式\r
\r
```json\r
{\r
  "meta": {\r
    "title": "接口测试报告标题",\r
    "base_url": "http://host/api/endpoint",\r
    "method": "baiwang.input.invoice.queryinvoicepool",\r
    "version": "6.0",\r
    "timeout": 30,\r
    "http_method": "POST",\r
    "url_params": {},\r
    "isp_auth": {\r
      "appKey": "1000139",\r
      "appSecret": "xxx",\r
      "username": "cpy001",\r
      "password": "Aa123456.",\r
      "userSalt": "xxx"\r
    }\r
  },\r
  "fixed_params": {\r
    "taxNo": "91440606MA4WHN8C8X"\r
  },\r
  "db_fixture": {\r
    "connection": {\r
      "host": "10.115.96.247", "port": 3306,\r
      "user": "jxindependent", "password": "Xj2zCkLJXTkEJ5j",\r
      "database": "jxindependent0", "charset": "utf8mb4"\r
    },\r
    "queries": [\r
      {\r
        "name": "tax_invoice_sample",\r
        "sql": "SELECT INV_KIND, INV_NUM FROM bw_jms_main1 WHERE INV_TYPE='01' LIMIT 1",\r
        "mapping": {\r
          "invoiceCode":   "INV_KIND",\r
          "invoiceNumber": "INV_NUM"\r
        }\r
      }\r
    ]\r
  },\r
  "test_cases": [\r
    {\r
      "id": "TC_001",\r
      "group": "正常流程",\r
      "name": "按发票号码查询",\r
      "desc": "使用数据库真实发票号码查询",\r
      "body": {\r
        "invoiceCode":   "{{invoiceCode}}",\r
        "invoiceNumber": "{{invoiceNumber}}"\r
      },\r
      "expect": {\r
        "success": true\r
      }\r
    },\r
    {\r
      "id": "TC_010",\r
      "group": "异常参数",\r
      "name": "缺少必填参数 taxNo",\r
      "desc": "不传 taxNo,期望返回 success=false",\r
      "remove_fixed": ["taxNo"],\r
      "body": {},\r
      "expect": {\r
        "success": false\r
      }\r
    }\r
  ]\r
}\r
```\r
\r
---\r
\r
## `expect` 校验规则速查\r
\r
| 字段 | 类型 | 说明 |\r
|------|------|------|\r
| `success` | bool | 校验响应体 success 字段值 |\r
| `response.{field}` | any | 校验 response 节点下的字段,如 `"response.invoiceType": "31"` |\r
| `model.{field}` | any | 校验 model 节点下的字段 |\r
| `has_response` | bool | 期望 response/model 字段存在且非 null |\r
| `check_page_data` | bool | 期望返回列表/分页数据 |\r
| `error_field_exists` | bool | 期望 errorResponse 字段存在 |\r
| `custom_checks` | list | 自定义路径校验(见下方) |\r
\r
**不使用 `http_status` 字段**(百望 ISP 接口测试不校验 HTTP 状态码)。\r
\r
### 返参校验规则(ISP 接口)\r
\r
1. **`success=true`** → 自动校验 invoiceList/response/model 非空\r
2. **`success=false`** → 只校验 success 字段,不校验数据\r
3. **不校验 HTTP 状态码**\r
\r
### custom_checks 示例\r
\r
```json\r
"custom_checks": [\r
  {"path": "response.invoiceType", "op": "eq",    "value": "31"},\r
  {"path": "errorResponse.code",   "op": "exists"},\r
  {"path": "response",             "op": "contains", "value": "invoiceNo"}\r
]\r
```\r
\r
支持 `op`:`eq` / `ne` / `contains` / `exists` / `not_exists` / `gt` / `lt`\r
\r
---\r
\r
## 用例设计规范\r
\r
1. 正向用例(`"success": true`)的入参**必须从数据库获取真实值**\r
2. 数电票用例 body 中**完全不传 invoiceCode**(数电票没有发票代码)\r
3. 时间范围参数使用近期日期(近3个月),避免数据量超500\r
4. 数据量可能超500的查询加 `pageNum` 参数\r
5. 需要排除某个 fixed_params 中的参数时,使用 `"remove_fixed": ["字段名"]`\r
\r
---\r
\r
## 报告架构(模板与数据分离)\r
\r
- `report_template.html`:固定 HTML 骨架,不含测试数据,CSS/JS 全部内嵌\r
- `__REPORT_DATA__.js`:测试结果 JS 变量赋值文件(`var reportData = {...}`)\r
- HTML 通过 `\x3Cscript src="__REPORT_DATA__.js">` 加载数据并渲染\r
- **不使用 fetch 加载 JSON**(`file://` 协议下 CORS 会阻止 fetch 本地文件)\r
- 两个文件必须在同一目录,双击 HTML 即可打开\r
\r
---\r
\r
## 依赖\r
\r
```bash\r
pip install requests pymysql\r
```\r
安全使用建议
This skill appears to implement a legitimate API testing/reporting workflow, but exercise caution before running it: 1) Inspect and sanitize any test_config.json you use — do not paste production DB credentials or real user passwords into configs. 2) The shipped SKILL.md and example files contain cleartext DB credentials and IP addresses that look like internal infrastructure — treat them as potential leaked secrets, and verify whether they are valid or stale. 3) The runner will open network connections (HTTP requests to base_url and optional MySQL queries) — run it in an isolated/sandbox environment or on a non-production network to avoid unintended access. 4) If you only need report generation, review generate_report.py separately; if you enable db_fixture, ensure the DB credentials you supply have read-only, minimal access. 5) Confirm the referenced cross-skill path (~/.workbuddy/skills/isp-api-tester/...) before invoking to avoid executing unexpected scripts. If you want, provide sanitized example configs (no secrets) and I can point to the exact lines that contain potential secret leaks and explain how to neutralize them.
功能分析
Type: OpenClaw Skill Name: api-test-reporter Version: 1.0.0 The skill bundle provides automated API testing with high-risk capabilities, specifically the ability to connect to MySQL databases and execute arbitrary SQL queries to fetch test data (found in run_api_test.py). Most notably, SKILL.md and test_config.json include hardcoded database credentials (user: jxindependent, pass: Xj2zCkLJXTkEJ5j) for a private network IP (10.115.96.247), which could be used to misdirect an agent into accessing internal resources. While these features are aligned with the stated purpose of data-driven API testing, the handling of plain-text credentials and the execution of unvalidated SQL queries represent a significant security risk and potential for unauthorized data access.
能力评估
Purpose & Capability
Name/description match the actual code: the repo provides a test runner (run_api_test.py) and an HTML report generator (generate_report.py) that parse configs, run HTTP requests, apply DB fixtures and produce reports. The ability to query a database and inject values is coherent with the stated goal of creating realistic test cases.
Instruction Scope
SKILL.md explicitly instructs the agent to parse docs, optionally connect to a MySQL DB (db_fixture), run the provided Python test runner, and generate HTML output. Those steps are within the stated purpose. However the instructions also hardcode example command-lines and refer to another skill's script path (~/.workbuddy/skills/isp-api-tester/...), which requires the agent to execute local scripts and may cause cross-skill dependencies or unexpected file access if those paths are assumed to exist.
Install Mechanism
There is no install spec or remote download; the skill is instruction + shipped scripts. No archive downloads or external installers were found. Runtime may require pip-installing pymysql/requests which is typical for Python tooling.
Credentials
The skill declares no required env vars, which is reasonable, but multiple example configs embedded in SKILL.md and references/test_config.example.json contain cleartext credentials, IP addresses and DB connection details (e.g., 10.115.96.247 / user jxindependent / password Xj2zCkLJXTkEJ5j and other host examples). Including plausible-looking secrets in shipped examples is a red flag (they may be accidental leaks), and the tool will, if configured, connect to arbitrary internal/external endpoints and databases supplied in config — a powerful capability that must be constrained and justified by the user. The number of credential-like strings in examples is disproportionate for a code sample and should be vetted.
Persistence & Privilege
Skill does not request 'always:true' and does not modify other skills or global agent settings. It runs as a invoked script and has standard runtime behavior; autonomous invocation is allowed by platform default but is not specially privileged here.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install api-test-reporter
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /api-test-reporter 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
api-test-reporter 1.0.0 - Initial release of the skill for automated API interface testing based on interface documentation. - Supports HTTP POST/GET APIs with JSON parameters; parses docs, generates test cases (required fields, pagination, enums, date ranges, numeric, status, combined scenarios, boundary/exception cases), executes them, and creates a structured HTML report. - Includes database integration for using real data, detailed validation options, and test configuration via JSON. - Provides separate flows for ISP API signature requirements and general HTTP API use. - Reports are strongly visualized, with test details, parameters, responses, and validation breakdowns.
元数据
Slug api-test-reporter
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

api-test-reporter 是什么?

Automates API testing from interface docs by generating detailed HTML reports with test cases, parameters, responses, and validation results for JSON POST/GE... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 96 次。

如何安装 api-test-reporter?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install api-test-reporter」即可一键安装,无需额外配置。

api-test-reporter 是免费的吗?

是的,api-test-reporter 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

api-test-reporter 支持哪些平台?

api-test-reporter 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 api-test-reporter?

由 squidtestgary(@squidtestgary)开发并维护,当前版本 v1.0.0。

💬 留言讨论