Web API Extractor

Extract web API traffic through browser authentication and CDP capture, analyze endpoints, and generate a Python FastMCP server.

5 starsSoftware Development

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add SH-DaWushi/web-api-extractor --skill web-api-extractor

Manual install

git clone --depth 1 https://github.com/SH-DaWushi/web-api-extractor.git /tmp/web-api-extractor
mkdir -p ~/.claude/skills
cp -r /tmp/web-api-extractor/. ~/.claude/skills/web-api-extractor

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Web API Extractor — 操作手册 (Runbook)

让 Agent 在真实站点上完成「登录 → 操作 → 抓包 → 分析 → 生成 MCP」的闭环。

本文件是**主索引**：只保留核心流程与硬性规则；各步骤的详细操作拆在 `runbook/` 下，
**按需加载**（顺利时不加载排错等无关章节，避免无关内容全量进上下文）。
需要环境变量、工具清单、项目结构等技术细节时查 `docs/reference.md`。

## 核心流程

按顺序执行；每步的「怎么做」见对应模块（`runbook/xx.md`，相对本目录）。

1. **环境准备 + 传输引导**（新部署一次）：`bootstrap` → `doctor`；工具无法直接调用时用 `start_server.py` + `mcp_call.py`。→ `runbook/00-environment.md`
2. **探测登录方式 → 登录**：`probe_login`；`open_browser_login`（或 `http_login`）；
   **用户确认登录完成后**调 `confirm_login` 拿 `auth_state`。→ `runbook/01-authentication.md`
3. **抓包**：`start_capture`（带 `auth_state_path`），用户操作目标功能，`stop_capture`。→ `runbook/02-capture.md`
4. **分析**：`analyze_traffic`。→ `runbook/03-analyze.md`
5. **加密与凭据核实**（强制，禁止跳过）：看 `crypto_found`，必要时 `extract_crypto_logic`。→ `runbook/04-crypto.md`
6. **生成**：`generate_mcp_server(session_id, output_dir)`。→ `runbook/05-generate.md`
7. **持续迭代**：`diff_capture` → `merge_capture` → `regenerate_server` → `export_project`。→ `runbook/06-iterate.md`

## 关键限制（硬规则）

- **步骤 5 不可跳过**：抓包中 JSON / 表单编码请求体里的凭据值被脱敏为 `***`，明文/密文不可区分，
  禁止假设，必须核实。（URL 与响应体**不**脱敏，别据此认定抓到的是明文。）
- **登录完成必须由用户确认**：`open_browser_login` 后先问用户是否已登录完成，得到答复再调
  `confirm_login`；抓包未带 `auth_state_path` 时，问用户后再调 `confirm_login_ready`。
  不便在对话里问时，改用 `request_login_confirm_dialog` / `request_capture_confirm_dialog`
  弹系统对话框让用户点选（点「否」不丢弃，可再次弹出）。
  工具返回的 `auth_evidence` 只是旁证，**不得据此自行判定并往下走**——用户确认前不要开始抓包或分析。
- **启动服务务必用 `start_server.py`**，不要直接在宿主 shell 后台跑 `run_http.py`（否则浏览器「打开后立刻消失」）。

Read the full skill on GitHub

Details

Skill name: web-api-extractor
Repository: SH-DaWushi/web-api-extractor
Repo updated: 1 October 2026

FAQ

What does the Web API Extractor skill do?

Extract web API traffic through browser authentication and CDP capture, analyze endpoints, and generate a Python FastMCP server.

How do I install the Web API Extractor skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add SH-DaWushi/web-api-extractor --skill web-api-extractor. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Web API Extractor popular?

It lives in SH-DaWushi/web-api-extractor, which has 5 GitHub stars and 0 forks.

Related skills

Zlib Skill

soluna/zlib-skill

Find and download ebooks from Z-Library and Anna's Archive. Use when the user wants to search by title, author, ISBN, or partial clues; compare editions, languages, or formats; download a chosen book; use Anna's Archive without an account; log in to Z-Library; or diagnose a source that is unavailable.

Software Development

Use Hln API

HLnames/use-hln-api

Consult & operate against the Hyperliquid Names API. Use when your agent needs to resolve `.hl` names, reverse-resolve addresses, fetch HLN profiles or records, inspect owner or list queries, diagnose HLN API failures, prepare a mint-pass request, or guide HyperEVM dApp integration with HL Names.

Software Development

Regulex Plus

PipeDream941/regulex-plus

Visualize a JavaScript regular expression as a railroad diagram (PNG/SVG) or a Mermaid flowchart by shelling out to the `regulex-plus` CLI. Use whenever the user asks to explain, debug, understand, optimize, or document a regex — especially complex patterns with quantifiers, lookarounds, alternations, or CJK/Chinese characters — and also proactively after you yourself generate or modify a non-trivial regex, so the user can verify it visually. Pick Mermaid for embedding in docs / PRs / chats that render Mermaid natively (GitHub, Notion, Obsidian, mermaid.live); pick PNG for inline image preview

Software DevelopmentIn 1 list

Upgrade Libxposed 102

Marukon/skill-upgrade-libxposed-102

Comprehensive guide and standard procedure for upgrading Android Xposed modules from legacy XposedBridge API (54-93) to modern LibXposed API 102 (LSPosed 1.9.3+ / Modern Xposed Module API). Use whenever the user asks to upgrade an Xposed module to API 102 or Modern Xposed API.

Software Development

Punchcard

Maksim-Burtsev/punchcard

Architecture-level design review of a code change: module boundaries, dependency direction, data model, error paths, cost of the next change — never naming, formatting, or anything a linter catches. Use when the user invokes /punchcard, says 'punchcard review', or asks for any design, architecture, or structural review of a diff, branch, merge request, or PR. Do not use for general correctness/bug review, style feedback, or whole-repo audits.

Software DevelopmentIn 1 list

Security Antipatterns Python

subhashdasyam/security-antipatterns-python

Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI

Software Development

Browse the most popular Claude skills, all software development skills, or write your own with the skills generator.