rest-graphql-debug
Facilitates debugging of REST and GraphQL APIs by isolating issues related to status codes, authentication, and schemas.
Install this skill
Security score
The rest-graphql-debug skill was audited on Jun 11, 2026 and we found 33 security issues across 5 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 400 | - Never hardcode tokens in scripts. Read from env (`os.environ["API_TOKEN"]`) or `${HERMES_HOME:-~/.hermes}/.env`. |
Curl to non-GitHub URL
| 49 | terminal('curl -v https://api.example.com/users/1') |
Curl to non-GitHub URL
| 52 | terminal("""curl -X POST https://api.example.com/users \\ |
Curl to non-GitHub URL
| 58 | terminal('curl -sI https://api.example.com/health') |
Curl to non-GitHub URL
| 61 | terminal('curl -s https://api.example.com/users | python3 -m json.tool') |
Curl to non-GitHub URL
| 67 | terminal("""curl -X POST https://api.example.com/graphql \\ |
Curl to non-GitHub URL
| 113 | terminal('curl -v --connect-timeout 5 https://api.example.com/health') |
Curl to non-GitHub URL
| 147 | terminal('curl -vI https://api.example.com 2>&1 | grep -E "SSL|subject|expire|issuer"') |
Curl to non-GitHub URL
| 156 | terminal('curl -s -o /dev/null -w "%{http_code}\\n" -H "Authorization: Bearer $TOKEN" https://api.example.com/me') |
Curl to non-GitHub URL
| 177 | terminal("""curl -v -X POST https://api.example.com/endpoint \\ |
Curl to non-GitHub URL
| 425 | terminal('curl -sI https://api.example.com') |
Curl to non-GitHub URL
| 499 | curl -X POST https://api.example.com/api/v1/users \ |
Webhook reference - potential data exfiltration
| 23 | - Webhook / callback integration debugging |
Access to hidden dotfiles in home directory
| 400 | - Never hardcode tokens in scripts. Read from env (`os.environ["API_TOKEN"]`) or `${HERMES_HOME:-~/.hermes}/.env`. |
Access to .env file
| 400 | - Never hardcode tokens in scripts. Read from env (`os.environ["API_TOKEN"]`) or `${HERMES_HOME:-~/.hermes}/.env`. |
Base64 decode operation
| 164 | print(json.dumps(json.loads(base64.urlsafe_b64decode(payload)), indent=2)) |
External URL reference
| 49 | terminal('curl -v https://api.example.com/users/1') |
External URL reference
| 52 | terminal("""curl -X POST https://api.example.com/users \\ |
External URL reference
| 58 | terminal('curl -sI https://api.example.com/health') |
External URL reference
| 61 | terminal('curl -s https://api.example.com/users | python3 -m json.tool') |
External URL reference
| 67 | terminal("""curl -X POST https://api.example.com/graphql \\ |
External URL reference
| 79 | "https://api.example.com/graphql", |
External URL reference
| 98 | "https://api.example.com/users/1", |
External URL reference
| 113 | terminal('curl -v --connect-timeout 5 https://api.example.com/health') |
External URL reference
| 124 | -o /dev/null -s https://api.example.com/endpoint''') |
External URL reference
| 147 | terminal('curl -vI https://api.example.com 2>&1 | grep -E "SSL|subject|expire|issuer"') |
External URL reference
| 156 | terminal('curl -s -o /dev/null -w "%{http_code}\\n" -H "Authorization: Bearer $TOKEN" https://api.example.com/me') |
External URL reference
| 177 | terminal("""curl -v -X POST https://api.example.com/endpoint \\ |
External URL reference
| 365 | BASE_URL = os.environ.get("API_BASE_URL", "https://api.example.com") |
External URL reference
| 425 | terminal('curl -sI https://api.example.com') |
External URL reference
| 438 | base = "https://api.example.com" |
External URL reference
| 474 | Base URL: https://api.example.com |
External URL reference
| 499 | curl -X POST https://api.example.com/api/v1/users \ |