One request. A closer look.

Download the OpenAPI 3.1 specification for request fields, response schemas, and error codes. Browser and API submissions use the same bounded queue.

1. Queue a scan

Replace the example repository with your public GitHub source:

curl --fail-with-body --silent --show-error \
  https://lolskills.io/api/v1/scans \
  -H 'Content-Type: application/json' \
  -d '{"source":"https://github.com/owner/repository","intent":false}'

Add ref for a commit, branch, or tag and skillPath for a skill folder or its SKILL.md. Use a full commit SHA to check an exact version.

AI is optional: set intent: true to request an advisory assessment. It uses the shared AI allowance. If requested analysis cannot complete, the scan is incomplete; it is never silently downgraded to a scan without AI.

2. Save the returned links

A successful request returns 202 Accepted and a Location header. The response looks like this; the token shown is a placeholder:

{
  "reportUrl": "/reports/<report-token>",
  "statusUrl": "/api/v1/scans/<report-token>"
}

Both paths are relative to https://lolskills.io. The token grants read access to this unlisted report. Keep it out of logs and public posts unless you intend to share the result. Submitted scans do not enter the public discovery archive.

3. Poll for the result

Set STATUS_URL to the returned status path. No API key is required:

curl --fail-with-body --silent --show-error \
  "https://lolskills.io$STATUS_URL"

Poll every three seconds or slower. Stop when status becomes complete or incomplete. Nonterminal responses include Retry-After: 3. A scan may take several minutes, including queue time.

The response contains progress, the target, coverage, findings, raw matches, and requested AI assessment. A completed scan describes the configured checks for one version; it is not a guarantee of safety.

Shared public limits

• Five submission attempts per IP address in ten minutes, shared with the browser form.
• 100 scan admissions per 24-hour allowance window across the website and API, including at most 10 with AI. A 100/hour limit also applies. These are shared service limits, not per-user allowances.
• Limits use database counters with windows starting on first use. Rejected requests can consume earlier admission counters. 429 responses include a conservative Retry-After; do not automatically repeat POST requests.
• At most two queued user scans hold active worker leases. Each scan inspects up to 20 skills and has a 15-minute scanner deadline.
• The versioned submission API accepts public GitHub URLs. JSON bodies are limited to 8 KiB. File uploads are available through the homepage with bot verification and share the same allowances. A repeated accepted POST creates another scan.

Agent integrations

The Claude Code/Codex scan skill uses this keyless endpoint and the same limits. A ChatGPT integration is planned. Report polling and archive browsing do not start scans.

For integration questions or code-access requests, connect with the team through the MagicSword community.