openapi-auth — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openapi-auth (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
All Openapi services require a Bearer token created through OAuth v2. This skill manages that token lifecycle.
Two layers — never confuse them:
https://oauth.openapi.com, as HTTP Basic auth (username = email, password = API key).Authorization: Bearer <token>.Expect credentials in the environment as OPENAPI_EMAIL, OPENAPI_API_KEY (and optionally a ready-made OPENAPI_TOKEN). Never print or commit them.
curl -s -u "$OPENAPI_EMAIL:$OPENAPI_API_KEY" https://oauth.openapi.com/tokens \
-H 'Content-Type: application/json' \
-d '{
"scopes": ["GET:company.openapi.com/IT-start"],
"name": "agent token",
"ttl": 86400
}'METHOD:host/path-prefix (e.g. POST:sms.openapi.com/IT-messages). Request only the scopes the task needs, with a short ttl (max 1 year).GET https://oauth.openapi.com/scopes (Basic auth).limits object restricts token usage further.PATCH /tokens/{id} with the refresh token as Bearer.| Endpoint | Purpose | ||
|---|---|---|---|
GET /tokens, `GET\ | PATCH\ | DELETE /tokens/{token}` | Token lifecycle |
GET /scopes, GET /scopes/{id} | Available scopes | ||
GET /wallet, GET /wallet/transactions | Credit balance — check before expensive paid calls | ||
GET /subscriptions, GET /subscriptions/{id} | Active plans and remaining requests | ||
GET /stats, GET /stats/apis, GET /stats/apis/{domain}, GET /stats/ips | Usage analytics | ||
GET /errors, GET /callbacks | Error log and callback monitoring |
oauth.openapi.it) is deprecated — always use oauth.openapi.com.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.