endpoint-validator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited endpoint-validator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deterministic HTTP endpoint validation: discover config, test each endpoint against expectations, report pass/fail with CI-compatible exit codes.
Load on demand when the signal matches.
| Signal | Reference | Content |
|---|---|---|
| Security header WARNs, HSTS/CSP/X-Frame | references/security-headers.md | Header checks, required values, remediation |
| Config errors, hardcoded IPs, timeouts | references/endpoint-config-preferred-patterns.md | Configuration failure modes and fixes |
| 401/403 failures, auth patterns | references/auth-endpoint-patterns.md | Bearer, API-key, cookie auth validation |
Read repository CLAUDE.md for base URL conventions or env var names.
Search for endpoint config in order: endpoints.json in project root, tests/endpoints.json, inline specification from user. Prefer version-controlled config over ad-hoc lists.
Config shape:
{
"base_url": "http://localhost:8000",
"endpoints": [
{"path": "/health", "expect_status": 200},
{"path": "/api/v1/users", "expect_key": "data", "timeout": 10},
{"path": "/api/v1/search?q=test", "max_time": 2.0}
]
}Endpoint fields: path (required), expect_status (default 200), expect_key (top-level JSON key), timeout (default 5s), max_time (SLOW threshold), method (default GET), headers (per-endpoint).
Rules:
${ENV_VAR} in base_url, not hardcoded IPs.Gate: config parsed, base URL reachable, at least one endpoint defined.
Execute, do not reason. Run the request. Paste the exit code and output.
Test endpoints sequentially. For each:
expect_status. Mismatch -> FAIL.expect_key set, parse JSON and check key exists. Missing/invalid -> FAIL.max_time set and elapsed exceeds it -> SLOW.frame-ancestors.Failure handling: connection refused -> FAIL "Connection refused"; timeout -> FAIL "Timeout after Ns"; invalid JSON on expect_key -> FAIL "Invalid JSON response".
Gate: all endpoints tested, each has PASS/FAIL/SLOW verdict.
Format:
ENDPOINT VALIDATION REPORT
==========================
Base URL: http://localhost:8000
/api/health 200 OK 45ms
/api/products 500 FAIL "Internal Server Error"
/api/slow 200 SLOW 3.2s > 2.0s threshold
SUMMARY: Passed 13/15 (86.7%), Failed 1, Slow 1Exit 0 if all passed. Exit 1 if any failed.
| Error | Cause | Fix |
|---|---|---|
| Base URL unreachable | Wrong port or service down | ss -tlnp to confirm port |
| All endpoints timeout | Wrong host or proxy issue | curl -v a single endpoint |
JSON parse failure on expect_key | Non-JSON response (HTML/XML) | Remove expect_key or check Content-Type |
| FAIL on intentional 404 | Default expect_status is 200 | Set "expect_status": 404 |
| 401 on auth endpoint | Missing/expired credentials | Add auth header; see references/auth-endpoint-patterns.md |
# Pre-deployment gate with curl
jq -r '.endpoints[].path' endpoints.json | while read path; do
curl -sf "http://localhost:8000$path" > /dev/null || { echo "FAIL: $path"; exit 1; }
done~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.