Api Mapping

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/api-mappingThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Record and analyze API surfaces of web services

---
name: api-mapping
description: Record and analyze API surfaces of web services
compatibility: "Designed for Vellum personal assistants"
metadata:
  icon: assets/icon.svg
  emoji: "🗺️"
  vellum:
    category: "development"
    display-name: "API Mapping"
---

You can record and analyze the API surface of any web service using the `map` CLI.

## CLI Setup

**IMPORTANT: Always use `host_bash` (not `bash`) for all `map` commands.** The API mapping CLI needs host access for Chrome CDP, network recording, and browser automation - none of which are available inside the sandbox.

`map` is a CLI tool that should be available on your PATH. Do NOT search for the binary or try to discover how the CLI works. Just run the commands as documented below.

## Typical Flow

When the user wants to map a web service's API (e.g. "Map the Notion API" or "Figure out how Figma's API works"):

1. **Ask about the objective** - Ask the user: "What service do you want to map?" and "What are you trying to build or integrate with?" This helps focus the recording on the relevant parts of the API surface.

2. **Choose mode** - Ask the user: "Should I browse automatically, or do you want to drive?" This determines whether to use auto mode or manual mode:
   - **Auto mode**: The CLI launches a headless browser, navigates the service, and records API calls automatically. Best for broad discovery.
   - **Manual mode**: A Chrome window opens for the user to interact with the service while the CLI records all API traffic in the background. Best for capturing a specific workflow.

3. **Run the mapping** - Execute the appropriate `map` command:
   - Auto mode: `map <domain> --json`
   - Manual mode: `map <domain> --manual --json`
   - For longer sessions: `map <domain> --duration 120 --json`

4. **Wait for recording to complete** - In auto mode, the CLI will browse and record for the default duration (60 seconds) then stop. In manual mode, the CLI blocks until the user closes the browser or presses Ctrl+C. The command outputs a JSON summary of all discovered endpoints.

5. **Analyze the API map** - Review the output and present findings to the user:
   - List discovered endpoints grouped by resource type (e.g., `/api/v1/users`, `/api/v1/documents`)
   - Note authentication patterns (Bearer tokens, cookies, API keys)
   - Identify CRUD operations and their HTTP methods
   - Highlight any WebSocket or streaming endpoints
   - Call out rate limiting headers or pagination patterns

6. **Offer next steps** - Based on the discovered API surface, offer to:
   - Create CLI tools that wrap the discovered endpoints
   - Generate TypeScript types from observed request/response payloads
   - Build a focused integration for the user's specific use case
   - Re-record with a longer duration or manual mode to capture more endpoints

## Important Behavior

- **Be proactive.** If the user names a service, start mapping immediately rather than asking unnecessary clarifying questions. Ask about mode preference, then go.
- **Always use `--json` flag** on all commands for reliable parsing.
- **Present findings clearly.** Group endpoints logically, show HTTP methods, and highlight the most useful ones for the user's stated objective.
- **Suggest manual mode for authenticated services.** If auto mode returns mostly auth redirects or login pages, suggest switching to manual mode so the user can log in first.
- **Handle errors gracefully.** If the domain is unreachable or the recording captures no API calls, suggest checking the domain, trying manual mode, or increasing the duration.

## Command Reference

```
map <domain> --json                        # Auto mode: browse and record API calls (default 60s)
map <domain> --manual --json               # Manual mode: user drives the browser, CLI records
map <domain> --duration <secs> --json      # Auto mode with custom duration
map <domain> --manual --duration <secs> --json  # Manual mode with custom timeout
```

Excerpt, first 3,971 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Api Mapping

• github.com/vellum-ai/vellum-assistant/tree/main/skills/api-mappi — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology