29 skills · sorted by relevance
Turn API code into documentation covering available operations, inputs, outputs, authentication, and errors. Add practical request examples and usage guides, with OpenAPI specifications or Postman collections where possible to help developers explore and use the API.
Generates Postman collection JSON files from Express, Next.js, Fastify, Hono, or other API routes. Scans route definitions, extracts endpoints, methods, params, and creates importable collections. Use when users request "generate postman collection", "export to postman", "create postman file", or "postman import".
The English summary is being prepared. Showing the original description.
Turn API code into documentation covering endpoints, inputs, authentication, responses, and errors. Add request examples in multiple languages and usage guides to help developers understand and start using the API.
Turn a Bifrost PR or GitHub issue into API regression tests that catch recurring bugs. Review existing coverage, add cases to the Postman collection, and validate collection processing and provider filtering.
Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, aut...
The English summary is being prepared. Showing the original description.
Diagnose REST and GraphQL API failures by checking connectivity, authentication, request formats, and returned data. Prepare reproducible commands, identify likely causes, and build regression tests that check whether a fix keeps working.
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
Test and debug REST and GraphQL APIs using curl, httpie, Postman collections, or scripted tests. Check authentication, invalid inputs, pagination, and response details to identify failures that a successful status code alone may miss.
Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
API security testing and validation for REST/GraphQL/gRPC endpoints, contract testing, load testing, fuzzing, and Postman/Bruno/Hurl workflows
The English summary is being prepared. Showing the original description.
Virtual QA Lead that turns requirements into review-ready, TestRail-importable test cases in one conversation. Use it whenever the user has requirements, a spec, a user story, or acceptance criteria (PDF, DOCX, XLSX, TXT, MD, or pasted text) and wants test cases, a test plan, a checklist, test coverage, a regression suite, or a TestRail/Qase/Zephyr export, even without saying "test cases" ("write tests for this spec", "what should we check here?"). Especially useful when they attach their team's existing test cases to match. When the spec describes an API (endpoints, status codes, schemas, auth, OpenAPI/Swagger), Casely also builds a runnable Postman collection, so use it for "API tests", "Postman collection", or "tests I can run in Newman/CI". Triggers on the same request in any language.
The English summary is being prepared. Showing the original description.
Automated API testing with Postman collections via Newman CLI. Use when user requests API testing, collection execution, automated testing, CI/CD integration, or mentions "Postman", "Newman", "API tests", "run collection", or "automated testing".
The English summary is being prepared. Showing the original description.
Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.
Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.
Choose a small validation experiment based on your hypothesis, risks, time, and resources. Compare five methods, from technical checks to user interaction tests, and define pass, fail, and learning criteria before investing in a larger build.
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
The English summary is being prepared. Showing the original description.
Use when styling UI for postman.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.
The English summary is being prepared. Showing the original description.
Write clear, developer-facing API documentation. Use when asked to document an API endpoint, write API reference docs, create a developer guide, or turn a raw spec/Postman collection into documentation. Produces endpoint documentation with descriptions, parameters, request/response examples, and error codes.
The English summary is being prepared. Showing the original description.
Test REST and GraphQL APIs with Playwright APIRequestContext, Supertest, or standalone HTTP clients. Covers schema validation with Zod 4/AJV, auth flow testing, CRUD lifecycle tests, error and header validation, pagination, and performance assertions. Use when: "API test," "endpoint test," "REST test," "GraphQL test," "schema validation," "Postman replacement." Not for: consumer-driven contract verification (Pact, broker) — use contract-testing; browser UI flows — use playwright-automation. Related: contract-testing, test-data-management, ci-cd-integration, playwright-automation.
The English summary is being prepared. Showing the original description.
测试后端接口时使用。适用于 REST/GraphQL/RPC 接口测试、契约验证、API 集成测试。融合契约测试、Postman/REST Assured、OpenAPI 校验。
The English summary is being prepared. Showing the original description.
Bruno is an open-source, offline-first API client that stores collections as plain-text .bru files on your filesystem. It serves as a privacy-focused, git-friendly alternative to Postman and Insomnia with no cloud sync and no account required.
The English summary is being prepared. Showing the original description.
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
The English summary is being prepared. Showing the original description.
Debugs REST and GraphQL APIs: unexpected status codes or bodies, auth failures (401/403, OAuth, API keys), schema mismatches, rate limits, pagination, and webhooks. Use when a request works in Postman but not in code, an integration test fails, or a callback misbehaves; not for UI rendering or DB tuning.
The English summary is being prepared. Showing the original description.