Is this skill actually defined anywhere in this PC?

exec.sendFile() is for bb not for general use right?

this was from a claude memory i think lol...

Is this plan mode slop lol

I would still like a different name, like /discover-api or /browser-to-api or /website-to-api

I'm not sure this is what a REFERENCE.md file should be - it should exhaustively describe all commands used by the skill, I would maybe recommend removing the Pipeline portion here

Extra redaction keys silently fail for body matching

Medium Severity

isKeySecret normalizes the input name by stripping underscores and hyphens via .replace(/[_-]/g, ''), but extraKeys stores user-provided --redact values with only toLowerCase() applied — no underscore/hyphen stripping. A user passing --redact my_secret_key stores my_secret_key in extraKeys, but the lookup normalizes the JSON key to mysecretkey, which never matches. User-specified body key redactions containing _ or - are silently ignored, potentially leaking credentials the user explicitly asked to scrub.

 

^{Reviewed by Cursor Bugbot for commit 9446f91. Configure here.}

Regex \b in character class matches backspace, not word boundary

Medium Severity

Several NOISE_PATH_PATTERNS use [\/\b] intending to match a slash or word boundary. However, \b inside a character class [...] matches the backspace character (U+0008), not a word boundary assertion. This affects patterns like /\/track(ing)?[\/\b]/i, /\/log[\/\b]/i, /\/click[\/\b]/i, and /\/experiment[\/\b]/i. Paths ending with these segments (e.g., /api/track, /api/log) without a trailing slash will not be classified as noise and will leak through into the discovered spec.

 

^{Reviewed by Cursor Bugbot for commit dc07d29. Configure here.}

HASHES constant redeclared for multiple persisted-query endpoints

Medium Severity

When multiple GraphQL parent paths use persisted queries, the generated client.mjs emits const HASHES = {...} once per parent path. Since all declarations are at the module's top-level scope, the second const HASHES declaration produces a JavaScript SyntaxError, making the entire generated client unusable. The variable name needs to be unique per parent path (e.g., incorporating the path or a counter).

 

^{Reviewed by Cursor Bugbot for commit dc07d29. Configure here.}

Replace callback keeps method name instead of stripping prefix

Low Severity

The replace callback (_, m) => m returns the captured HTTP method name (get, post, etc.) instead of an empty string. This replaces get_ with get (only removing the underscore), producing function names like getv1_items_id instead of the intended v1_items_id. The replacement string should be '' to properly strip the method prefix.

 

^{Reviewed by Cursor Bugbot for commit dc07d29. Configure here.}

Unescaped dynamic values injected into generated JavaScript source

Medium Severity

Header values from HTTP traces are interpolated directly into single-quoted JavaScript string literals in the generated client.mjs without escaping. If any observed header value contains a single quote (or backslash, newline, etc.), the generated code will have a syntax error and fail to parse. Values need to be escaped, e.g., using JSON.stringify().

 

^{Reviewed by Cursor Bugbot for commit dc07d29. Configure here.}

HTML report hardcodes "POST" for every endpoint card

High Severity

The method badge in buildHtmlReport is hardcoded to POST for every endpoint card, regardless of the actual HTTP method. ep.method is available and used correctly on line 659, but line 650 emits a static POST string. Every GET, PUT, DELETE, and PATCH endpoint in the generated index.html will incorrectly display as POST.

 

^{Reviewed by Cursor Bugbot for commit 5eee2ab. Configure here.}

Redaction stats loaded and passed but never used

Low Severity

The redaction variable is read from disk via readJson on line 297 and passed to buildReport, where it's destructured as a parameter but never referenced in the function body. This is dead code — the redaction statistics (header count, body key count, body value count) are computed and persisted but never displayed in the report.

 

^{Reviewed by Cursor Bugbot for commit 5eee2ab. Configure here.}

All-null fields produce invalid empty type array schema

Medium Severity

When all samples for a field are null, toSchema falls through every branch to the mixed-types case and produces { type: [] } — an empty type array. This is because nonNull is empty and nullable is false (it requires nonNull.length > 0). The correct output for an always-null field is { type: 'null' }. This produces an invalid JSON Schema fragment in the emitted OpenAPI spec.

 

^{Reviewed by Cursor Bugbot for commit 5eee2ab. Configure here.}