Integrations & APIs

Integration agent skills teach AI agents to work with specific external services and APIs: third-party platforms, webhooks, MCP servers, and data syncs. Instead of re-explaining an API every session, install the skill and the agent knows the endpoints and conventions.

microwind Bundle

Restful API

当设计RESTful API时，分析资源模型，优化接口设计，解决性能问题。验证API架构，设计版本控制，和最佳实践。

Sep 17
microwind Bundle

Flask

当开发Flask应用时，分析路由设计，优化中间件配置，解决性能问题。验证API架构，设计RESTful服务，和最佳实践。

Sep 17
microwind Bundle

API Contract Validator

Enhanced skill for api-contract-validator

Sep 17
zakirkun Bundle

Missing API Rate Limiting

Detects sensitive API endpoints without rate limiting, enabling resource exhaustion, credential stuffing, and enumeration attacks.

Sep 17
zakirkun Bundle

Mass Assignment

Detects frameworks binding raw HTTP payload bodies directly to database models or internal objects without field allow-lists.

Sep 17
zakirkun Bundle

API Key Exposed In Url

Detects API keys and tokens passed as URL query parameters, which are logged in server logs, browser history, and Referer headers.

Sep 17
zakirkun Bundle

Hardcoded Credentials Detection

Detects hardcoded passwords, API keys, and tokens in source code

Sep 17
zakirkun Bundle

Missing Input Size Limits

Detects API endpoints without request body size limits, enabling denial of service via oversized payloads.

Sep 17
zakirkun Bundle

JWT Without Expiration

Detects JWTs issued without expiration claims, creating tokens that remain valid indefinitely.

Sep 17
zakirkun Bundle

Hardcoded Secrets

Detects API keys, passwords, and tokens embedded directly in the source code.

Sep 17
zakirkun Bundle

Unencrypted Database

Detects database configurations and connections missing encryption at rest and in transit.

Sep 17
zakirkun Bundle

Hardcoded Secrets In Makefiles

Detects API keys, tokens, and passwords hardcoded in Makefile targets and variables.

Sep 17
zakirkun Bundle

Missing Or Incorrect Content Type Validation

Detects API endpoints that do not validate or enforce Content-Type headers, enabling MIME-type confusion and CSRF attacks.

Sep 17
zakirkun Bundle

Information Exposure Via Errors

Detects raw error stacks or generic exception details being directly returned in HTTP responses.

Sep 17
zakirkun Bundle

Insecure Postmessage Configuration

Detects careless use of the HTML5 Web Messaging API (postMessage), such as sending messages to the generic '*' origin.

Sep 17
zakirkun Bundle

Privilege Escalation Through Code Logic

Detects code patterns that allow users to elevate their own privileges through API manipulation or mass assignment.

Sep 17
zakirkun Bundle

Cleartext Network Traffic

Detects unencrypted HTTP connections for transmitting sensitive data, credentials, or API calls.

Sep 17
zakirkun Bundle

Excessive Data Exposure In API Responses

Detects API endpoints that return more data than required, including sensitive fields that clients should not receive.

Sep 17
zakirkun Bundle

OAUTH Misconfiguration

Detects common OAuth 2.0 implementation mistakes including missing state parameter, open redirect in redirect_uri, and token exposure.

Sep 17
zakirkun Bundle

API Key Without Rotation Or Expiration

Detects API key implementations without expiration dates or rotation mechanisms, creating long-lived credentials.

Sep 17
zakirkun Bundle

Broken Object Level Authorization Bola Idor

Detects API endpoints that use user-supplied IDs to access objects without verifying the requesting user owns or has permission to access that object.

Sep 17
zakirkun Bundle

Secrets Bundled In Published Packages

Detects API keys, private keys, and credentials accidentally included in npm/pip packages via missing .npmignore or .pypiignore.

Sep 17
leadmagic Bundle

Leadmagic Waterfall

Build Clay enrichment waterfalls with LeadMagic as the primary provider — 95%+ email coverage, multi-provider chaining, verification integration, catch-all resolution. Use when setting up LeadMagic in Clay workflows, building enrichment waterfalls, or optimizing data coverage for outbound prospecting. Triggers on: "LeadMagic waterfall", "LeadMagic in Clay", "waterfall enrichment LeadMagic", "Clay LeadMagic setup", or any request about LeadMagic-based enrichment pipelines.

Sep 17
leadmagic Bundle

Rb2b Outbound Triggers

Convert RB2B person-level website visitor identification into outbound sequences. Build trigger-based workflows that route identified visitors to SDRs, enrich with verified contact data, score ICP fit, and launch time-sensitive multi-channel outreach. Use when setting up RB2B-to-outbound pipelines, configuring Slack-to-SDR handoff, designing visitor-trigger cadences, or optimizing RB2B conversion rates. Triggers on: "RB2B outbound", "visitor trigger outbound", "person-level visitor sequence", "RB2B SDR workflow", "website visitor to outbound", "RB2B Slack alert routing", "identified visitor follow-up", "RB2B to Clay", "visitor-to-meeting".

Sep 17
leadmagic Bundle

Website Visitor Identification

Design website visitor identification and deanonymization programs — company vs person-level ID, vendor selection (Clearbit/Breeze, RB2B, 6sense, etc.), privacy guardrails (GDPR/CCPA operational), Slack alert triage, and ICP routing to MQL or outbound triggers. Use when implementing visitor ID, reverse-IP reveal, intent data, or person-level LinkedIn visitor tracking. Triggers on: "visitor identification", "deanonymization", "website intent", "Clearbit Reveal", "RB2B", "who visited our website", "reverse IP", "WebSights", "Leadfeeder", "visitor ID privacy".

Sep 17
marktantongco Bundle

Clonedeps

Clone important project dependency source code into an ignored local workspace so OpenCode can inspect library internals. Use when the user asks to clone dependencies, inspect dependency/source internals, understand SDK/framework behavior from source, debug library implementation details, or make core dependency repos locally readable. Do not use for ordinary API/docs questions where @librarian is enough.

Sep 17
marktantongco Skill

Universal Code

SKILL_03: Code + API mode for the Universal Router system. Use when writing production code, APIs, algorithms, debugging, refactoring, or testing. Activates full quality gates (40+ items), caveman protocols, and code-specific depth-seeking.

Sep 17
ferroxlabs Skill

Convert Three Locks

Architect the Three Locks persuasion sequence: Lock 1 Want (sell the state), Lock 2 Trust (earn belief through proof + voice), Lock 3 Excuse (give the rational justification). Outputs the lock-by-lock blueprint that the rest of the asset writes against. Use when planning the persuasion architecture of a sales page, VSL, or long-form email before drafting copy. Not for writing the open (use convert-open) or the close (use convert-close) - this designs the middle architecture they bridge.

Audited 37 Sep 17
wgpsec Bundle

Harbor Tactics

Harbor 容器镜像仓库攻击。当发现目标运行 Harbor 实例、默认凭据 admin/Harbor12345 未修改、Harbor API 暴露、或需要从 Harbor 窃取镜像或注入后门时使用。覆盖未授权访问与公开仓库枚举、默认凭据攻击、镜像后门注入（供应链攻击）、Webhook 滥用、复制策略利用（跨仓库数据窃取）、镜像扫描绕过

Sep 17
wgpsec Bundle

Evasion Technique Integrate

免杀技术整合：将免杀技术（API 混淆、字符串加密、Syscall、反调试、AMSI 绕过等）植入已有 Loader 代码。当需要向已有 Loader 添加新加载技术、或现有 Loader 被检测到需要替换组件时使用。先读 references/evasion-techniques-db.json 确认组件库中有你需要的技术，再执行集成

Sep 17
wgpsec Bundle

Rabbitmq Tactics

RabbitMQ 未授权访问与利用。当发现目标开放 5672/15672 端口、RabbitMQ Management API 暴露、默认凭据 guest/guest 未修改、或需要从 RabbitMQ 窃取消息数据时使用。覆盖默认凭据攻击、Management API 枚举、队列消息批量导出、Exchange 滥用、用户创建与密码修改、VHost 操控、Shovel/Federation 数据外传、集群信息窃取、Erlang Cookie RCE、消息篡改

Sep 17
wgpsec Bundle

Sonarqube Tactics

SonarQube 代码审计平台攻击。当发现目标运行 SonarQube 实例（默认 9000 端口）、默认凭据 admin/admin 未修改、或需要从 SonarQube 窃取项目源代码和漏洞信息时使用。覆盖默认凭据攻击、项目源代码窃取、漏洞/Issue 枚举（CRITICAL 优先）、用户凭据与 Token 窃取、Quality Gate 绕过、配置文件提取（数据库/SCM 凭据）、Webhook 滥用、插件分析、热点与度量数据导出

Sep 17
ftshare-lab Bundle

Sub Skills

查询股票列表。接口：GET /api/v1/market/data/stock-list。所有请求必须设置 FTSHARE_API_KEY。

Sep 17
ftshare-lab Bundle

Stk Surv

查询个股严重异常波动。接口：GET /api/v2/market/data/stk-surv。所有请求必须设置 FTSHARE_API_KEY。

Sep 17
ftshare-lab Bundle

Stk Shock

查询个股异常波动。接口：GET /api/v2/market/data/stk-shock。所有请求必须设置 FTSHARE_API_KEY。

Sep 17
ftshare-lab Bundle

Limit List

查询涨跌停池。接口：GET /api/v1/market/data/limit-list。所有请求必须设置 FTSHARE_API_KEY。

Sep 17

Frequently asked questions

What are Integrations & APIs agent skills?

Which Integrations & APIs skills are most installed?

Popular Integrations & APIs skills on SkillMD right now include Secrets Bundled in Published Packages, harbor-tactics, JWT Without Expiration. Rankings shift as installs change; sort this page by "Most installs" for the live list.

Do Integrations & APIs skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.