endpoint-validator

# Endpoint Validator Skill Deterministic HTTP endpoint validation: discover config, test each endpoint against expectations, report pass/fail with CI-compatible exit codes. ## Deep References Load on demand when the signal matches. | Signal | Reference | Content | |--------|-----------|---------| | Security header WARNs, HSTS/CSP/X-Frame | `references/security-headers.md` | Header checks, required values, remediation | | Config errors, hardcoded IPs, timeouts | `references/endpoint-config-preferred-patterns.md` | Configuration failure modes and fixes | | 401/403 failures, auth patterns | `references/auth-endpoint-patterns.md` | Bearer, API-key, cookie auth validation | ## Instructions ### Phase 1: DISCOVER Read repository CLAUDE.md for base URL conventions or env var names. Search for endpoint config in order: `endpoints.json` in project root, `tests/endpoints.json`, inline specification from user. Prefer version-controlled config over ad-hoc lists. Config shape: ```json { "base_url": "http://localhost:8000", "endpoints": [ {"path": "/health", "expect_status": 200}, {"path": "/api/v1/users", "expect_key": "data", "timeout": 10}, {"path": "/api/v1/search?q=test", "max_time": 2.0} ] } ``` Endpoint fields: `path` (required), `expect_status` (default 200), `expect_key` (top-level JSON key), `timeout` (default 5s), `max_time` (SLOW threshold), `method` (default GET), `headers` (per-endpoint). Rules: - Warn before POST/PUT/DELETE against production bas...