curl-command-generator
Generates cURL commands for API testing from various frameworks, simplifying command line interactions with proper headers and authentication.
Install this skill
Security score
The curl-command-generator skill was audited on Feb 9, 2026 and we found 63 security issues across 4 threat categories, including 7 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 80 | parts.push(`-X ${route.method}`); |
Template literal with variable interpolation in command context
| 83 | let url = `${options.baseUrl}${route.path}`; |
Template literal with variable interpolation in command context
| 91 | .map((p) => `${p.name}=${p.value}`) |
Template literal with variable interpolation in command context
| 93 | url += `?${queryString}`; |
Template literal with variable interpolation in command context
| 96 | parts.push(`"${url}"`); |
Template literal with variable interpolation in command context
| 104 | parts.push(`-H "${options.authHeader}"`); |
Template literal with variable interpolation in command context
| 110 | parts.push(`-d '${bodyJson}'`); |
Template literal with variable interpolation in command context
| 125 | lines.push(`Base URL: \`${options.baseUrl}\``); |
Template literal with variable interpolation in command context
| 130 | lines.push(`BASE_URL="${options.baseUrl}"`); |
Template literal with variable interpolation in command context
| 140 | lines.push(`## ${capitalize(resource)}`); |
Template literal with variable interpolation in command context
| 143 | lines.push(`# ${capitalize(resource)}`); |
Template literal with variable interpolation in command context
| 149 | lines.push(`### ${route.name}`); |
Template literal with variable interpolation in command context
| 156 | lines.push(`# ${route.name}`); |
Template literal with variable interpolation in command context
| 263 | ```bash |
Template literal with variable interpolation in command context
| 387 | ```bash |
Template literal with variable interpolation in command context
| 448 | console.log(`Generated ${options.output} with ${routes.length} commands`); |
Curl to non-GitHub URL
| 23 | curl -X GET "http://localhost:3000/api/users" |
Curl to non-GitHub URL
| 26 | curl -X POST "http://localhost:3000/api/users" \ |
Curl to non-GitHub URL
| 31 | curl -X GET "http://localhost:3000/api/users" \ |
Curl to non-GitHub URL
| 35 | curl -X GET "http://localhost:3000/api/users?page=1&limit=10" |
Curl to non-GitHub URL
| 38 | curl -i -X GET "http://localhost:3000/api/users" |
Curl to non-GitHub URL
| 41 | curl -v -X GET "http://localhost:3000/api/users" |
Curl to non-GitHub URL
| 206 | curl -X POST "http://localhost:3000/api/auth/login" \ |
Curl to non-GitHub URL
| 214 | curl -X POST "http://localhost:3000/api/auth/register" \ |
Curl to non-GitHub URL
| 224 | curl -X GET "http://localhost:3000/api/users?page=1&limit=10" \ |
Curl to non-GitHub URL
| 231 | curl -X GET "http://localhost:3000/api/users/{id}" \ |
Curl to non-GitHub URL
| 238 | curl -X POST "http://localhost:3000/api/users" \ |
Curl to non-GitHub URL
| 247 | curl -X PUT "http://localhost:3000/api/users/{id}" \ |
Curl to non-GitHub URL
| 256 | curl -X DELETE "http://localhost:3000/api/users/{id}" \ |
Curl to non-GitHub URL
| 336 | curl -X GET "http://localhost:3000/api/users" \ |
Curl to non-GitHub URL
| 351 | curl -s "http://localhost:3000/api/users" | jq . |
Curl to non-GitHub URL
| 354 | curl -c cookies.txt -b cookies.txt "http://localhost:3000/api/auth/login" |
Curl to non-GitHub URL
| 357 | curl -X POST "http://localhost:3000/api/upload" \ |
Curl to non-GitHub URL
| 362 | curl -X POST "http://localhost:3000/api/form" \ |
Curl to non-GitHub URL
| 366 | curl -X GET "http://localhost:3000/api/users" \ |
Access to .env file
| 373 | # .env.curl |
Access to .env file
| 392 | source .env.curl |
External URL reference
| 23 | curl -X GET "http://localhost:3000/api/users" |
External URL reference
| 26 | curl -X POST "http://localhost:3000/api/users" \ |
External URL reference
| 31 | curl -X GET "http://localhost:3000/api/users" \ |
External URL reference
| 35 | curl -X GET "http://localhost:3000/api/users?page=1&limit=10" |
External URL reference
| 38 | curl -i -X GET "http://localhost:3000/api/users" |
External URL reference
| 41 | curl -v -X GET "http://localhost:3000/api/users" |
External URL reference
| 199 | Base URL: `http://localhost:3000/api` |
External URL reference
| 206 | curl -X POST "http://localhost:3000/api/auth/login" \ |
External URL reference
| 214 | curl -X POST "http://localhost:3000/api/auth/register" \ |
External URL reference
| 224 | curl -X GET "http://localhost:3000/api/users?page=1&limit=10" \ |
External URL reference
| 231 | curl -X GET "http://localhost:3000/api/users/{id}" \ |
External URL reference
| 238 | curl -X POST "http://localhost:3000/api/users" \ |
External URL reference
| 247 | curl -X PUT "http://localhost:3000/api/users/{id}" \ |
External URL reference
| 256 | curl -X DELETE "http://localhost:3000/api/users/{id}" \ |
External URL reference
| 267 | BASE_URL="${BASE_URL:-http://localhost:3000/api}" |
External URL reference
| 336 | curl -X GET "http://localhost:3000/api/users" \ |
External URL reference
| 351 | curl -s "http://localhost:3000/api/users" | jq . |
External URL reference
| 354 | curl -c cookies.txt -b cookies.txt "http://localhost:3000/api/auth/login" |
External URL reference
| 357 | curl -X POST "http://localhost:3000/api/upload" \ |
External URL reference
| 362 | curl -X POST "http://localhost:3000/api/form" \ |
External URL reference
| 366 | curl -X GET "http://localhost:3000/api/users" \ |
External URL reference
| 375 | DEV_URL="http://localhost:3000/api" |
External URL reference
| 379 | STAGING_URL="https://staging-api.example.com" |
External URL reference
| 383 | PROD_URL="https://api.example.com" |
External URL reference
| 430 | .option("-b, --base-url <url>", "Base URL", "http://localhost:3000/api") |
External URL reference
| 458 | BASE_URL ?= http://localhost:3000/api |