qa-rest-api SKILL.md skillA
qa-rest-api from thameema/memnos is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add thameema/memnos/qa-rest-api@git:20261028.22056ebPins git:20261028.22056eb in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- thameema/memnos
- Path
plugins/tommy-qa/skills/qa-rest-api/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261028.22056eb, committed Oct 28, 2026
- Size
- 1,947 bytes
- Repository stars
- 5
- License
- Apache-2.0
QA a REST API: contract, status codes, validation, auth and authorization, pagination, idempotency and error shapes, against a running instance or an OpenAPI spec. Use when asked to test an endpoint, verify an API change, or check a service for contract drift.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# REST API QA Test the API as a client sees it: real HTTP against a local or staging instance you were pointed at. Never run this against a production or third-party service you do not own. 1. **Get the contract.** Read the OpenAPI spec or the route definitions and handlers. List every endpoint, method, input and documented response. 2. **Per endpoint, check:** - Happy path: status, body shape, headers, content type. - Validation: missing, wrong-type, oversized and malformed fields each return a 4xx with a useful, consistent error body, never a 500. - Auth: no credential gives 401; a valid credential without access gives 403 (or 404 by policy); another tenant's or user's ID is refused, not just hidden in the UI. - Idempotency: repeating a PUT or DELETE is safe; a retried POST does not create duplicates if the API promises that. - Pagination, filtering and sorting: first page, last page, empty result, a limit above the maximum, stable order. - Concurrency: two simultaneous writes to the same resource. - Side effects: the write actually persisted and a follow-up GET shows it. …
Read the whole file at its exact version.
How to install
mdr add thameema/memnos/qa-rest-api@sha256:a78ba9a3db1e31faThe line at the top of this page pins the label git:20261028.22056eb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bgekrlarp3kxfsq2)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 28, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1947 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
thameema/memnos · 5 stars · license Apache-2.0 · pushed 2026-11-05 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_bgekrlarp3kxfsq2 GET https://markdownregistry.com/api/v1/resolve?ref=thameema/memnos/qa-rest-api GET https://markdownregistry.com/api/v1/blob/a78ba9a3db1e31fa2fdaf58ac52a6d5c150363c9a65e6b609ebed1cc8e0f94ea
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.