How to use the API Testing Expert agent skill (api-tester)

What the api-tester skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a task matches them. The api-tester skill is a single SKILL.md file. Once it is loaded, the agent works through API tasks in a set order: it reads the API documentation or OpenAPI/Swagger spec first, tests the happy path, then moves on to error cases and edge cases.

For testing, the agent checks authentication (unauthenticated and expired tokens should return 401, wrong roles should return 403), invalid input (missing required fields, wrong types, empty, very long and special-character values), pagination, idempotency, rate limiting (429 responses and Retry-After headers), and CORS. For GraphQL it covers introspection, depth and complexity limits, variables, and mutation and subscription behaviour.

For debugging, the agent checks the status code first, then headers such as Content-Type and Accept, then API versioning, and then network causes such as firewalls or proxies. It suggests curl commands for each check. The skill itself only contains written instructions and commands; it does not run anything by itself.

Install the api-tester skill

You can install the skill in either of two ways. The first is to download the ZIP from the agent-skills directory page and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project. The second is to upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

After unzipping, the skill folder should contain SKILL.md. The skill file begins with a short header naming it api-tester and describing it, which is how the agent recognises when to use it.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project
• Apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you start

The skill needs curl, which is commonly preinstalled on macOS and Linux. jq, httpie or Postman are optional and only needed if you want the agent to use them. API credentials are supplied by you through environment variables; the skill tells the agent to keep tokens out of command history and scripts.

The skill does not run scripts and does not use the network by itself. Any request that reaches an API comes from commands you or the agent run on your machine.

• Required: curl
• Optional: jq, httpie or Postman
• Credentials: supplied by you via environment variables

Trigger the skill with natural requests

You do not need a special command. Describe the API task in plain language and mention the endpoint or the failure. The skill's description covers API testing, curl, REST, GraphQL, authentication and debugging, so requests that touch those topics are the ones that should load it.

Give the agent as much context as you can: the endpoint, the method, the documentation or spec if you have one, and the exact status code or error body you see. The skill asks the agent to read the documentation before testing, so pasting the spec helps.

• Test this new endpoint for auth, validation and pagination problems: POST /users
• Our GraphQL API is slow on nested queries. Check the depth and complexity limits.
• This curl call returns 502 from our staging API. Work out why, starting with the status code.

Example: a systematic check of a new REST endpoint

Ask the agent to test a new endpoint against the methodology. Typical output starts with an authentication check and then moves to invalid input. For example, a request to create a user without a required field should return 400, and the agent will suggest a curl command like the one below to confirm it.

Remember that a 200 response is not proof of success. The skill specifically tells the agent to validate the response body as well.

Use safe habits with the suggested commands

Store tokens in environment variables and reference them in commands, so they do not end up in scripts or shared history. Use timeouts so a hanging request does not block you. Inspect raw traffic with verbose mode when a response does not make sense.

Keep destructive calls such as DELETE or bulk updates away from production. The skill warns against them, but it cannot technically stop a command from being run, so review each command before you execute it.

• Authorization header from an environment variable: curl -s -H "Authorization: Bearer $TOKEN" https://api.example.com/me
• Add timeouts: curl --connect-timeout 5 --max-time 30
• Inspect the exchange: curl -v