cURL Command Writer
network.generate_curl
Overview
You describe the request and we return the cURL command for it, with every value in single quotes using one published escaping rule — so a body containing a quote, a space or a shell operator stays a value instead of becoming syntax. Header order and duplicates are kept. Credentials are replaced with a placeholder by default, which makes the command safe to paste into a ticket but means it will not authenticate until you put the real value back. The result is a string: this skill never runs it, never opens a socket, and never resolves the host, and --location is rendered only because you asked for it.
Hand-written cURL commands break on the values that matter: an apostrophe in a body, a space in a header, a URL with an ampersand. Rendering the command from structured fields with one escaping rule makes the string correct by construction, and redacting credentials by default means the command you paste into a ticket is not the one that leaks a key.
Reliability
Fully deterministic: the same request always renders byte-for-byte the same command. Every value is single-quoted and an embedded quote is escaped as '\'', which is the one POSIX form that interprets nothing, so a value beginning with @ or looking like an option stays a value. -X is omitted when cURL would infer the method anyway — GET without a body, POST with one — so parsing the command back with network.parse_curl returns the same request. Failures, none of which are worth retrying unchanged: CURL_REQUEST_INVALID means a field is not usable — a malformed URL, a control character, or a NUL in the body — so correct the field. CURL_URL_UNSUPPORTED means the URL is not absolute http or https. CURL_HEADER_INVALID means a header name is not a legal HTTP name or a value carries a line break that would split it into extra headers. CURL_BODY_TOO_LARGE and CURL_OUTPUT_TOO_LARGE mean a published limit was passed: 1000000 bytes of body, or a 1048576-byte command.
Context footprint
Returns one command string roughly the size of the request you sent, plus a few short notes. A successful call costs 1 execution credit.
When to use it
When you have the request as data and want a command a person can read, paste, or store in documentation.
When you need the request performed, when it needs options outside this subset, or when you want a Windows shell command.
Scope
Non-goals
- Never executes the command, opens a socket, or resolves the host
- Does not send the request or check that the URL exists
- Does not add options you did not ask for, such as -s, -k or --retry
- Does not produce cmd.exe or PowerShell syntax
- Does not invent a body, a content type, or authentication
Properties
Capabilities
Cost & billing
Flat rate per invocation
File handling
How we handle your data
What this means
This skill may receive sensitive content and may return submitted, transformed, extracted, or reformatted content.
Squillify guarantees
- Runs inside Squillify
- This skill runs inside Squillify.
- Payloads are not sent to an external service by this skill.
- Squillify does not permanently store submitted payloads.
- Telemetry records metadata only, not submitted content.
- Submitted payloads are not used for training.
- Submitted payloads are not reviewed by humans.
- This skill does not target sensitive data.
- The response may contain submitted or transformed content.
Your responsibility
Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.
Input schema
| Field | Type | Required | Description |
|---|---|---|---|
| request | object | Yes | Closed request to render: required url plus optional method, headers, body, followRedirects and compressed. |
| redactSecrets | boolean | No | Whether credentials are replaced with <redacted>; omit it for true. |
| shell | string | No | Quoting rule; omit it for POSIX_SH, the only admitted value. |
Output schema
| Field | Type | Required | Description |
|---|---|---|---|
| curl | string | Yes | Rendered POSIX-quoted command, at most 1048576 UTF-8 bytes. |
| redacted | boolean | Yes | True when at least one credential was replaced. |
| redactions | array | Yes | One string per replaced credential naming the location, never the value, from 0 through 128 strings. |
| warnings | array | Yes | Advisory strings about redaction or GET-with-body; from 1 through 64 because a redaction note always applies. |
| _meta | object | No | Always present on success, with shell, commandBytes and headerCount. |
API contract
POST /v1/executecurl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"network.generate_curl","input":{"request":{"url":"https://example.com/v1/ping","headers":[{"name":"Accept","value":"application/json"}]}}}'import { Squillify } from "@squillify/sdk";
const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });
const { output } = await sq.execute("network.generate_curl", {"request":{"headers":[{"name":"Authorization","value":"Bearer sk-live-not-a-real-key"},{"name":"Content-Type","value":"application/json"}],"url":"https://api.example.com/v1/orders","method":"POST","body":"{\"sku\":\"A-1\",\"qty\":2}"}});Errors
| Code | HTTP | Retryable | Description |
|---|---|---|---|
| VALIDATION_ERROR | 400 | No | The request payload failed schema validation. |
| UNAUTHORIZED | 401 | No | Missing or invalid API key. |
| SKILL_NOT_ACCESSIBLE | 403 | No | The API key is not granted access to this skill. |
| SKILL_NOT_AVAILABLE_FOR_PLAN | 403 | No | This skill is not included in your current plan. |
| PLAN_ELIGIBILITY_UNAVAILABLE | 503 | Yes | Plan eligibility could not be decided. Retry after backoff. |
| SKILL_NOT_FOUND | 404 | No | The requested skill or version does not exist. |
| TENANT_RATE_LIMITED | 429 | Yes | Request rate limit exceeded. Retry after backoff. |
| QUOTA_EXCEEDED | 429 | Yes | Plan quota exhausted. Retryable once the quota period resets. |
| EXECUTION_TIMEOUT | 504 | Yes | Execution exceeded the allowed time budget. |
| CURL_REQUEST_INVALID | 400 | No | The request payload failed this skill's input validation. |
| CURL_URL_UNSUPPORTED | 400 | No | The skill does not support the requested variant. |
| CURL_HEADER_INVALID | 400 | No | The request payload failed this skill's input validation. |
| CURL_BODY_TOO_LARGE | 429 | No | A size, quota, rate, or time limit was exceeded. |
| CURL_OUTPUT_TOO_LARGE | 429 | No | A size, quota, rate, or time limit was exceeded. |
Other limits
| Limit | Value |
|---|---|
| Recommended inline bytes | 32 KiB |
Limitations
- Never executes the command, opens a socket, or resolves the host
- Does not send the request or check that the URL exists
- Does not add options you did not ask for, such as -s, -k or --retry
- Does not produce cmd.exe or PowerShell syntax
- Does not invent a body, a content type, or authentication
- Performing the request — this skill has no network access at all
- Building commands that need proxies, certificates, or file uploads
- Producing shell scripts with several commands or pipelines
How to call
POST /v1/execute (requires authentication)
{
"skillKey": "network.generate_curl",
"input": {
"request": {
"headers": [
{
"name": "Authorization",
"value": "Bearer sk-live-not-a-real-key"
},
{
"name": "Content-Type",
"value": "application/json"
}
],
"url": "https://api.example.com/v1/orders",
"method": "POST",
"body": "{\"sku\":\"A-1\",\"qty\":2}"
}
}
}Examples
A JSON POST whose bearer token is redacted by default
{
"request": {
"headers": [
{
"name": "Authorization",
"value": "Bearer sk-live-not-a-real-key"
},
{
"name": "Content-Type",
"value": "application/json"
}
],
"url": "https://api.example.com/v1/orders",
"method": "POST",
"body": "{\"sku\":\"A-1\",\"qty\":2}"
}
}{
"warnings": [
"Credentials were replaced with <redacted>, so the command shows the shape of the request but will not authenticate; set redactSecrets to false to render it as given"
],
"redacted": true,
"redactions": [
"headers[0] Authorization"
],
"curl": "curl -H 'Authorization: <redacted>' -H 'Content-Type: application/json' --data-raw '{\"sku\":\"A-1\",\"qty\":2}' 'https://api.example.com/v1/orders'",
"_meta": {
"headerCount": 2,
"commandBytes": 142,
"shell": "POSIX_SH"
}
}A GET whose value contains a quote, rendered without redaction
{
"redactSecrets": false,
"request": {
"url": "https://example.com/search?q=it%27s",
"followRedirects": true,
"headers": [
{
"name": "X-Note",
"value": "it's fine"
}
]
}
}{
"warnings": [
"Redaction is off, so this command may contain live credentials; treat the output as a secret and do not log or store it"
],
"redacted": false,
"redactions": [],
"curl": "curl -H 'X-Note: it'\\''s fine' --location 'https://example.com/search?q=it%27s'",
"_meta": {
"headerCount": 1,
"commandBytes": 79,
"shell": "POSIX_SH"
}
}Recommended use cases
- Give a user a copy-pasteable reproduction of a request
- Document an API call from the same structured request your code sends
- Round-trip a request parsed by network.parse_curl back into a command
Avoid for
- Performing the request — this skill has no network access at all
- Building commands that need proxies, certificates, or file uploads
- Producing shell scripts with several commands or pipelines
Related skills
Composable with
Safety & privacy
- Runs without calling any external service.
- Your payloads are never stored permanently.
- Telemetry captures metadata only — never your payload contents.
- We never train models on your payloads.
- No human reviews your payloads.