har-api-reverse-engineering SKILL.md skillA
har-api-reverse-engineering from jpeetz/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add jpeetz/agent-skills/har-api-reverse-engineering@v1.0.0Pins v1.0.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- jpeetz/agent-skills
- Path
skills/api-backend/har-api-reverse-engineering/SKILL.md- Versions recorded
- 2
- Latest version
- v1.0.0, committed Sep 14, 2026
- First version recorded
- Aug 31, 2026
- Size
- 6,007 bytes
- Repository stars
- 14
- License
- none declared
Use this skill when an agent needs to call a website's hidden or undocumented API: capture real browser requests into a HAR file, derive the exact request shape, build a clean replayable client, verify it outside the browser, and reuse the verified client. Activates when a backend has no documented API, or when you must reproduce the precise request (method, URL, headers, JSON body) of an action you can only perform in a browser. Authorized use only — never to bypass auth or bot detection.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# HAR-Capture API Reverse Engineering Turn a website's hidden/undocumented API into a verified, reusable client by **capturing real browser requests to a HAR file, then deriving and replaying them** — instead of reverse-engineering by trial and error against a "hidden" endpoint. ## When to use - A site you can *operate in a browser* has no documented API (or none is known) and you need an agent to call its backend directly instead of driving the UI. - You need the exact request shape (method, URL, headers, JSON body) of an action rather than guessing by trial and error. - A browser-only workflow is repeated often enough that a verified programmatic shortcut beats manual steps every time. ## Guardrails (read first — non-negotiable) - **Authorization:** only capture/replay APIs you are **authenticated AND authorized** to use (your own site, a client site you operate, or a service whose terms permit scripting). This technique does NOT bypass authentication or bot detection, and must never be used to defeat them. If the API needs auth you do not hold, STOP — the answer is to obtain proper access, not to replay someone else's session. …
Read the whole file at its exact version.
How to install
mdr add jpeetz/agent-skills/har-api-reverse-engineering@sha256:6639ff45e47f58deThe line at the top of this page pins the label v1.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_udefx33xgsck7opr)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Aug 31, 2026 and Sep 14, 2026, about one every 14 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.0.0 latest | 2026-09-14 | 5722530 | 6,007 B | A | view · diff |
| v1.0.0 | 2026-08-31 | 945bdcc | 6,006 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6007 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
jpeetz/agent-skills · 14 stars · license none declared · pushed 2026-10-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_udefx33xgsck7opr GET https://markdownregistry.com/api/v1/resolve?ref=jpeetz/agent-skills/har-api-reverse-engineering GET https://markdownregistry.com/api/v1/blob/6639ff45e47f58de9ede2a7e177ff3a8ee87ea738075cb0a7bdea1d7a5e6e98a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.