generate-api-collection — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited generate-api-collection (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Core principle: Every API surface (Rails app or engine) has a single API collection file that stays in sync with its endpoints.
| Aspect | Rule |
|---|---|
| When | Create or update collection when creating or modifying any REST API endpoint (route + controller action) |
| Format | Postman Collection JSON v2.1 (schema or info.schema references v2.1) |
| Location | One file per app or engine — docs/api-collections/<app-or-engine-name>.json or spec/fixtures/api-collections/; if a collection folder already exists, update the existing file |
| Language | All request names, descriptions, and variable names must be in English |
| Variables | Use {{base_url}} for the base URL so the collection works across environments |
| Per request | method, URL, headers, body, description, and test scripts (e.g. pm.response.to.have.status(200)) |
| Folders | Group related endpoints into folders using nested item arrays |
| Exception | GraphQL endpoints — use implement-graphql instead |
When you create or modify a REST API endpoint (new or changed route and controller action),
you MUST also create or update the corresponding API collection file so the
flow can be tested. Do not leave the collection missing or outdated.
Each request MUST include a description and at least one basic test script (e.g. status code check).
EXCEPTION: GraphQL endpoints — use implement-graphql instead.item arrays.{{base_url}} for the base URL.python -m json.tool collection.json or jq . collection.json — both print errors on invalid JSON.{{base_url}} is used consistently.Ensure the collection includes the info block, folders (nested item arrays), and event scripts:
{
"info": {
"name": "Products API",
"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
},
"item": [
{
"name": "Products",
"item": [
{
"name": "List products",
"request": {
"method": "GET",
"header": [],
"url": "{{base_url}}/api/v1/products",
"description": "Returns a list of all products in the catalog."
},
"event": [
{
"listen": "test",
"script": {
"exec": ["pm.test('Status code is 200', () => { pm.response.to.have.status(200); });"],
"type": "text/javascript"
}
}
]
}
]
}
],
"variable": [
{ "key": "base_url", "value": "http://localhost:3000" }
]
}| Mistake | Reality |
|---|---|
| Missing Content-Type or body for POST/PUT | Include headers and example body so the request works out of the box |
| Skipping validation after generation | Run jq . or python -m json.tool and fix any errors before committing (see HARD-GATE) |
Load only when a concrete collection example is needed:
| Skill | When to chain |
|---|---|
| create-engine | When the engine exposes HTTP endpoints |
| version-api | When a new version requires a collection update |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.