Integrations & APIs

Integration agent skills teach AI agents to work with specific external services and APIs: third-party platforms, webhooks, MCP servers, and data syncs. Instead of re-explaining an API every session, install the skill and the agent knows the endpoints and conventions.

vincentchuwaichow Bundle

Typescript Public API And Declaration Governance

Use this skill to statically review a published TypeScript type surface: `.d.ts` correctness and emit strategy (`declaration`, `isolatedDeclarations`, rollups, API reports), public-versus-accidental exports, breaking-change classification and the semver decision, the consumer compilation matrix, and compile-time type-contract tests (`expectTypeOf`/`assertType` under `--typecheck`, `@ts-expect-error`). Reads declarations and configuration only; it never compiles, publishes, or runs the package.

Sep 17
mouadja02 Skill

Power Apps Code App Scaffold

Scaffold a complete Power Apps Code App project with PAC CLI setup, SDK integration, and connector configuration

Sep 17
mouadja02 Bundle

HTTP Early Hints Proxy Conformance

Use when HTTP 103 Early Hints may be dropped, merged, reordered, or corrupted across reverse proxies—replay bounded synthetic exchanges, compare normalized hop captures, and preserve the final response.

Sep 17
mouadja02 Bundle

OAUTH Dpop Nonce Retry Conformance

Use when OAuth DPoP clients, authorization servers, or resource servers disagree on DPoP-Nonce challenges, proactive rotation, endpoint scope, CORS exposure, concurrency, or bounded retry behavior.

Sep 17
mouadja02 Bundle

W3c Baggage Propagation Conformance

Use when W3C Baggage members disappear across hops, repeated baggage fields are only partly read, percent encoding changes values, metadata is rewritten, or propagation limits disagree.

Sep 17
mouadja02 Bundle

Multipart Form Data Wire Conformance

Use when multipart/form-data uploads succeed in one emitter/parser but fail, truncate, or disagree through another runtime or proxy. Inspect redacted raw bytes offline, reject ambiguous framing and disposition parameters, compare normalized part trees, and make a bounded rollout decision.

Sep 17
mouadja02 Bundle

Webauthn Rpid Origin Drift Preflight

Use when WebAuthn or passkeys fail after hostname, port, proxy, RP-ID, public-URL, or native-app origin changes and the team needs a fail-closed migration and parity preflight.

Sep 17
mouadja02 Bundle

Grpc Trailer Preservation Conformance

Use when gRPC status or trailing metadata disappears or changes across proxies, gateways, meshes, tunnels, or runtimes, especially for trailers-only and size-boundary failures.

Sep 17
mouadja02 Bundle

GRAPHQL Incremental Hydration Preflight

Use when a GraphQL @defer/@stream multipart response parses but a patch disappears after client, proxy, cache, or SSR hydration. Replay a pinned current ID-based or legacy path-based envelope offline, reject unknown shapes, and make a bounded rollout or recovery decision.

Sep 17
mouadja02 Bundle

HTTP Content Encoding Chain Conformance

Use when HTTP clients, proxies, or tests mishandle repeated or comma-listed Content-Encoding values, stacked gzip/deflate bodies, unknown codings, or decompression limits; validates the complete chain before bounded inverse decoding.

Sep 17
mouadja02 Bundle

Openapi Nullability Migration Conformance

Use when OpenAPI 3.0 nullable schemas are ignored, rewritten, or generate unusable types after an OpenAPI 3.1 migration. Inventory requiredness, null acceptance, references, composition, and fixtures offline before changing a contract.

Sep 17
mouadja02 Bundle

JSON Duplicate Member Boundary Conformance

Use when JSON authorization, signing, canonicalization, APIs, or distributed runtimes may disagree on repeated object names—inspect original bytes before lossy parsing and fail closed with scoped duplicate paths and offsets.

Sep 17
mouadja02 Bundle

Jose Critical Header Validation Conformance

Use when a JWS/JWT library or service accepts, rejects, or misinterprets the `crit` (critical) header parameter — unknown extensions silently ignored, standard JOSE names listed in `crit`, duplicate or dangling entries, or `b64` (RFC 7797) not enforced. Validate structural and fail-closed `crit` handling across runtimes before deployment.

Sep 17
mouadja02 Bundle

Websocket Permessage Deflate Resource Limits

Use when validating WebSocket permessage-deflate implementations for decompressed-size, compressed-size, expansion-ratio, fragmentation, timeout, or context-takeover resource boundaries.

Sep 17
mouadja02 Bundle

HTTP Content Disposition Filename Conformance

Use when an HTTP download gets the wrong, garbled, unsafe, or client-dependent filename—especially Content-Disposition filename/filename*, RFC 8187 percent encoding, duplicate parameters, redirects, path traversal, device names, or media-type extension mismatches.

Sep 17
mouadja02 Bundle

HTTP Redirect Credential Boundary Conformance

Use when an HTTP client follows redirects and credentials are silently dropped or may cross host, scheme, or port boundaries—especially Authorization, Cookie, Proxy-Authorization, API-key headers, 301/302/303/307/308, or default-port confusion.

Sep 17
mouadja02 Bundle

Ipv6 Zone Identifier Uri Portability Conformance

Use when scoped or link-local IPv6 input containing an interface name/index works in one CLI, URL parser, HTTP client, resolver, or OS but fails or changes in another. Classify UI, URI, socket, and wire boundaries offline before any network probe.

Sep 17
killvxk Bundle

Configuring Oauth2 Authorization Flow

配置安全的 OAuth 2.0 授权流程，包括带 PKCE 的授权码流、客户端凭据和设备授权授予。本技能涵盖流程选择、PKCE 实施、令牌生命周期管理、范围设计以及符合 OAuth 2.1 安全要求。

Sep 17
killvxk Bundle

Performing GRAPHQL Depth Limit Attack

使用深度嵌套递归查询执行和测试 GraphQL 深度限制攻击，以识别 GraphQL API 中的拒绝服务（DoS）漏洞。

Sep 17
killvxk Bundle

Analyzing Android Malware With Apktool

使用 apktool 进行反编译、jadx 恢复 Java 源码、androguard 进行权限分析，对 Android APK 恶意软件样本执行静态分析，包括清单检查和可疑 API 调用检测。

Sep 17
killvxk Bundle

Detecting Process Injection Techniques

检测和分析恶意软件使用的进程注入技术，包括经典 DLL 注入、进程空洞化、APC 注入、线程劫持和反射式加载。使用内存取证、API 监控和行为分析来识别注入痕迹。适用于进程注入检测、代码注入分析、空洞化进程调查或内存威胁检测等请求场景。

Audited Sep 17
killvxk Bundle

Exploiting Mass Assignment In REST Apis

发现并利用 REST API 中的批量赋值漏洞，通过在 API 请求中注入意外参数来提升权限、修改受限字段并绕过授权控制。

Sep 17
killvxk Bundle

Implementing Soar Playbook For Phishing

使用 Splunk SOAR REST API 自动化网络钓鱼事件响应，包括创建容器、添加制品并触发剧本

Sep 17
killvxk Bundle

Performing GRAPHQL Introspection Attack

执行 GraphQL 自省（Introspection）攻击，从 GraphQL 端点提取完整的 API Schema，包括类型、查询（Query）、变更（Mutation）、订阅（Subscription）和字段定义。测试人员使用自省查询绘制攻击面，识别敏感字段和变更操作，测试查询深度和复杂度限制，并利用 GraphQL 特有漏洞，包括批量攻击、基于别名的暴力破解和嵌套查询 DoS。适用于涉及 GraphQL 安全测试、自省攻击、GraphQL 枚举或 GraphQL API 渗透测试的请求。

Sep 17
killvxk Bundle

Implementing Stix Taxii Feed Integration

STIX（结构化威胁信息表达式）和 TAXII（可信自动化情报信息交换）是 OASIS 开放标准，用于表示和传输网络威胁情报。

Sep 17
killvxk Bundle

Intercepting Mobile Traffic With Burpsuite

使用 Burp Suite 代理拦截和分析移动应用的 HTTP/HTTPS 流量，以识别不安全的 API 通信、认证缺陷、数据泄露和服务器端漏洞。适用于移动应用渗透测试、API 安全评估或评估客户端-服务器通信模式。适合移动流量拦截、Burp Suite 移动代理、API 安全测试或移动 HTTPS 分析相关请求。

Sep 17
killvxk Bundle

Performing OAUTH Scope Minimization Review

执行 OAuth 2.0 权限范围最小化审查，识别过度授权的第三方应用集成、过多的 API 范围、未使用的令牌授权以及跨身份提供商和 SaaS 平台的高风险 OAuth 同意模式。适用于 OAuth 范围审计、API 权限审查、第三方应用风险评估或同意授权最小化的请求。

Sep 17
killvxk Bundle

Performing Oil Gas Cybersecurity Assessment

本技能涵盖针对石油和天然气设施（包括上游探采、中游管道运输和下游炼化分销）进行网络安全评估。内容涉及控制管道运营的SCADA系统、炼厂过程控制DCS、危险工艺安全仪表系统、无人井口现场RTU，以及对API 1164、TSA管道安全指令、IEC 62443和NIST网络安全框架关键基础设施合规性评估。

Sep 17
killvxk Bundle

Implementing Aes Encryption For Data At REST

AES（高级加密标准）是由 NIST（FIPS 197）标准化的对称分组密码，用于保护机密和敏感数据。本技能涵盖在 GCM 模式下实现 AES-256 加密，用于加密静态文件和数据存储，包括正确的密钥派生、IV/nonce 管理和认证加密。

Sep 17
killvxk Bundle

Bypassing Authentication With Forced Browsing

在授权安全评估中，通过枚举 URL 并绕过身份验证控制，发现和访问未受保护的页面、API 及管理界面。

Sep 17
killvxk Bundle

Implementing API Rate Limiting And Throttling

使用令牌桶、滑动窗口和固定窗口算法实施API速率限制和节流控制，防止暴力破解、凭据填充、资源耗尽和API滥用。使用Redis支持的计数器、API网关插件或应用中间件配置按用户、按IP和按端点的速率限制，并实施带Retry-After头的正确HTTP 429响应。

Sep 17
killvxk Bundle

Implementing Zero Trust For Saas Applications

使用 CASB、SSPM、条件访问策略、OAuth 应用治理和会话控制，为 SaaS 应用实施零信任访问控制，对云托管服务强制执行身份验证、设备合规性检查和数据保护。

Sep 17
killvxk Bundle

Performing Ip Reputation Analysis With Shodan

使用 Shodan API 分析 IP 地址声誉，识别开放端口、运行服务、已知漏洞和托管上下文，用于威胁情报富化和事件分类。

Sep 17
killvxk Bundle

Analyzing Malware Behavior With Cuckoo Sandbox

在 Cuckoo Sandbox 中执行恶意软件样本以观察运行时行为，包括进程创建、文件系统修改、注册表更改、网络通信和 API 调用。生成全面的行为报告，用于恶意软件分类和 IOC 提取。适用于动态恶意软件分析、沙箱引爆、行为分析或自动化恶意软件执行相关请求。

Sep 17
killvxk Bundle

Conducting Mobile Application Penetration Test

对 Android 和 iOS 应用执行移动应用渗透测试，使用 Frida、Objection 和 MobSF 识别不安全的数据存储、证书固定绕过、API 漏洞、二进制保护缺陷和运行时操控问题。

Sep 17
mouadja02 Skill

Gsap Core

Official GSAP — the core API — gsap.to(), from(), fromTo(), easing, duration, stagger, defaults, gsap.matchMedia() (responsive, prefers-reduced-motion)

Audited Sep 17

Frequently asked questions

What are Integrations & APIs agent skills?

Which Integrations & APIs skills are most installed?

Popular Integrations & APIs skills on SkillMD right now include performing-ip-reputation-analysis-with-shodan, typescript-public-api-and-declaration-governance, power-apps-code-app-scaffold. Rankings shift as installs change; sort this page by "Most installs" for the live list.

Do Integrations & APIs skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.