API Agent Development

Creates API agents to wrap external HTTP services, enabling request/response transformations and webhook tracking.

Install this skill

or

28/100

Security score

The API Agent Development skill was audited on Feb 9, 2026 and we found 40 security issues across 2 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: Create API agents that wrap external HTTP services (n8n, LangGraph, CrewAI, OpenAI endpoints). Configure request/response transforms, webhook status tracking, A2A protocol compliance. CRI

medium line 9

Webhook reference - potential data exfiltration

SourceSKILL.md

9	CRITICAL: API agents wrap external HTTP services. They use request/response transforms to adapt between Orchestrator AI's format and the external service's format. Status webhook URLs MUST read fr

medium line 18

Webhook reference - potential data exfiltration

SourceSKILL.md

18	- Setting up webhook status tracking

low line 31

Webhook reference - potential data exfiltration

SourceSKILL.md

31	endpoint: "http://localhost:5678/webhook/f7387dc8-c6e4-460d-9a0c-685c86d76d1f"

low line 53

Webhook reference - potential data exfiltration

SourceSKILL.md

53	description: "API agent that calls n8n webhook for marketing campaign swarm processing"

low line 58

Webhook reference - potential data exfiltration

SourceSKILL.md

58	endpoint: "http://localhost:5678/webhook/marketing-swarm-flexible"

low line 73

Webhook reference - potential data exfiltration

SourceSKILL.md

73	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status",

low line 187

Webhook reference - potential data exfiltration

SourceSKILL.md

187	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status",

low line 331

Webhook reference - potential data exfiltration

SourceSKILL.md

331	"yaml": "\n{\n \"metadata\": {\n \"name\": \"marketing-swarm-n8n\",\n \"displayName\": \"Marketing Swarm N8N\",\n \"description\": \"API agent that calls n8n webhook for market

medium line 334

Webhook reference - potential data exfiltration

SourceSKILL.md

334	Note: This example has hardcoded `statusWebhook`. The correct format should use `{{env.API_BASE_URL}}`.

low line 364

Webhook reference - potential data exfiltration

SourceSKILL.md

364	"statusWebhook": "http://localhost:7100/webhooks/status", // From env

low line 373

Webhook reference - potential data exfiltration

SourceSKILL.md

373	POST http://localhost:5678/webhook/marketing-swarm-flexible

low line 381

Webhook reference - potential data exfiltration

SourceSKILL.md

381	"statusWebhook": "http://localhost:7100/webhooks/status",

medium line 432

Webhook reference - potential data exfiltration

SourceSKILL.md

432	## Status Webhook Configuration

low line 441

Webhook reference - potential data exfiltration

SourceSKILL.md

441	"statusWebhook": "http://host.docker.internal:7100/webhooks/status"

low line 452

Webhook reference - potential data exfiltration

SourceSKILL.md

452	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status"

low line 460

Webhook reference - potential data exfiltration

SourceSKILL.md

460	"statusWebhook": "{{env.API_BASE_URL \|\| env.VITE_API_BASE_URL \|\| 'http://host.docker.internal:7100'}}/webhooks/status"

low line 482

Webhook reference - potential data exfiltration

SourceSKILL.md

482	"description": "API agent that calls n8n webhook",

low line 635

Webhook reference - potential data exfiltration

SourceSKILL.md

635	endpoint: "http://localhost:5678/webhook/workflow-name"

low line 645

Webhook reference - potential data exfiltration

SourceSKILL.md

645	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status",

low line 668

Webhook reference - potential data exfiltration

SourceSKILL.md

668	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status"

medium line 693

Webhook reference - potential data exfiltration

SourceSKILL.md

693	### ❌ Mistake 1: Hardcoded Status Webhook

low line 697

Webhook reference - potential data exfiltration

SourceSKILL.md

697	"statusWebhook": "http://host.docker.internal:7100/webhooks/status"

low line 703

Webhook reference - potential data exfiltration

SourceSKILL.md

703	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status"

low line 722

Webhook reference - potential data exfiltration

SourceSKILL.md

722	"statusWebhook": "{{env.API_BASE_URL}}/webhooks/status"

medium line 758

Webhook reference - potential data exfiltration

SourceSKILL.md

758	- [ ] `endpoint` URL is correct (webhook URL for n8n, API URL for others)

medium line 761

Webhook reference - potential data exfiltration

SourceSKILL.md

761	- [ ] `statusWebhook` reads from environment (not hardcoded)

low line 31

External URL reference

SourceSKILL.md

31	endpoint: "http://localhost:5678/webhook/f7387dc8-c6e4-460d-9a0c-685c86d76d1f"

low line 58

External URL reference

SourceSKILL.md

58	endpoint: "http://localhost:5678/webhook/marketing-swarm-flexible"

low line 164

External URL reference

SourceSKILL.md

164	\| `{{env.API_BASE_URL}}` \| Environment variable \| `"http://localhost:7100"` \|

low line 331

External URL reference

SourceSKILL.md

331	"yaml": "\n{\n \"metadata\": {\n \"name\": \"marketing-swarm-n8n\",\n \"displayName\": \"Marketing Swarm N8N\",\n \"description\": \"API agent that calls n8n webhook for market

low line 364

External URL reference

SourceSKILL.md

364	"statusWebhook": "http://localhost:7100/webhooks/status", // From env

low line 373

External URL reference

SourceSKILL.md

373	POST http://localhost:5678/webhook/marketing-swarm-flexible

low line 381

External URL reference

SourceSKILL.md

381	"statusWebhook": "http://localhost:7100/webhooks/status",

low line 441

External URL reference

SourceSKILL.md

441	"statusWebhook": "http://host.docker.internal:7100/webhooks/status"

low line 460

External URL reference

SourceSKILL.md

460	"statusWebhook": "{{env.API_BASE_URL \|\| env.VITE_API_BASE_URL \|\| 'http://host.docker.internal:7100'}}/webhooks/status"

low line 635

External URL reference

SourceSKILL.md

635	endpoint: "http://localhost:5678/webhook/workflow-name"

low line 658

External URL reference

SourceSKILL.md

658	endpoint: "http://localhost:8000/api/orchestrate"

low line 679

External URL reference

SourceSKILL.md

679	endpoint: "https://api.example.com/v1/generate"

low line 697

External URL reference

SourceSKILL.md

697	"statusWebhook": "http://host.docker.internal:7100/webhooks/status"

Scanned on Feb 9, 2026

View Security Dashboard

Installation guide →

GitHub Stars 106

Rate this skill

Categorydevelopment

UpdatedMay 21, 2026

openclaw api backend ml-ai-engineer backend-developer data-engineer n8n openai development

majiayu000/claude-skill-registry