Guide · Agent skill
How to use the offensive-api-abuse agent skill: setup and examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-api-abuse skill is a written penetration testing playbook that an AI agent can read and follow when you ask it to test the business logic of web and mobile APIs. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what to check before you point it at anything. It is written for people who may never have used an agent skill before.
Offensive API Abuse MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it so the folder containing SKILL.md is in place.
- 2Place or upload the skill. Copy the folder into ~/.claude/skills/ or a project's .claude/skills/, or upload it under Settings, Capabilities, Skills in the Claude apps.
- 3Prepare your authorized target. Confirm you have written permission to test the API and gather a test account bearer token or credentials.
- 4Install the tools. Install Python 3 with requests, curl, jq, and any of Arjun, ParamSpider, jwt_tool or GraphQL Voyager you plan to use.
- 5Ask with scope and goal. Describe the workflow or attack class to test, the target, and confirm the test is authorized.
- 6Review findings. Ask the agent to document each finding with its business impact and the evidence behind it.
What the skill makes the agent do
The skill is a single SKILL.md file that describes an advanced API testing methodology. It focuses on business logic, meaning workflows such as checkout, payments and account actions where each endpoint may look secure alone but the sequence between them has gaps. Automated scanners often miss these because they need to understand the order of steps and the trust between endpoints.
The source covers several areas: chaining API calls and manipulating workflows, GraphQL batching, query depth and introspection, pagination for data enumeration, webhook callbacks for SSRF, resource exhaustion, race conditions using parallel requests, JWT manipulation, API key leakage, and discovery of undocumented endpoints. It names the tools Arjun, ParamSpider, jwt_tool and GraphQL Voyager.
- Map the API surface, including undocumented endpoints, with Arjun, ParamSpider and manual discovery
- Model multi-step workflows and test them for race conditions
- Analyze JWTs for algorithm confusion, weak signing and claim tampering
- Probe GraphQL for batching, depth and introspection issues
- Search client code, error messages and repositories for leaked API keys
- Document business impact for each finding
Install the skill from a ZIP file
Download the ZIP for this skill from this page and unzip it. The skill folder contains SKILL.md. For a personal setup, place the folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder.
You can also upload the skill in the Claude apps. Open Settings, go to Capabilities, then Skills, and add the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings, then Capabilities, then Skills
Check what you need before running it
The skill itself runs no scripts. The Python and curl examples are code the agent can adapt, so you need the tools they use. The source lists Python 3 with the requests library for the included scripts, and curl and jq for the command examples.
You also need a target API you are authorized to test, plus a bearer token or credentials for that test. Arjun, ParamSpider, jwt_tool and GraphQL Voyager are referenced in the text, so install them if you want the agent to use them. The skill uses the network, so every request goes to the target you specify.
- Python 3 with the requests library
- curl and jq
- Arjun, ParamSpider, jwt_tool, GraphQL Voyager (referenced in the text)
- A target API and a bearer token or credentials for an authorized test
Ask for it with natural requests
You do not need to name the skill to use it, but naming the goal helps. Say what you want tested and give the agent the scope. Mention that the test is authorized and describe the target. The more specific the request, the more useful the agent's plan.
Good requests describe a workflow or an attack class, for example checking whether a checkout can be completed without payment, or testing a GraphQL endpoint for batched login attempts. Keep requests inside the scope you have permission for.
- Map the endpoints of our staging API at the URL I provide, using Arjun and ParamSpider, and list undocumented routes
- Test our checkout flow for steps that can be skipped or reordered, with my test account token
- Analyze this JWT for algorithm confusion and kid injection and explain what you would verify
- Check our GraphQL schema for introspection exposure and report which mutations need auth
- Look through this client bundle and error responses for leaked API keys
Example: inspect a GraphQL schema with curl
The skill includes curl commands for GraphQL introspection. This example asks the server for its object types and filters the output with jq. Replace the URL and token with values for your authorized test target. The query is taken from the skill's examples.
If introspection is enabled, the response shows the schema, which the skill treats as a finding to document rather than an end goal.
curl -s -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d '{"query": "{ __schema { types { name kind } } }"}' "https://target.example.com/graphql" | jq '.data.__schema.types[] | select(.kind == "OBJECT")'What people use it for
- Testing whether a checkout flow lets a tester skip payment or reorder steps on a staging environment
- Checking a GraphQL API for batched login attempts and introspection exposure during a penetration test
- Verifying JWT handling for algorithm confusion, kid injection and claim tampering in an application you own
- Hunting for leaked API keys in a client bundle or error responses as part of an application security review
- Building a checklist of API logic flaws for an assessment report with business impact notes
Frequently asked questions
Is the offensive-api-abuse skill free to use?
The skill is published under the MIT licence, as listed on this page. Check the licence file in the repository for the full terms before you use or redistribute it.
What do I need to run the offensive-api-abuse skill?
You need Python 3 with the requests library, curl and jq for the command examples, and the referenced tools Arjun, ParamSpider, jwt_tool and GraphQL Voyager. You also need a target API you are authorized to test and a bearer token or credentials for that test.
How do I install an agent skill like this one?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, Capabilities, Skills.
Is this skill safe to use on any API?
No. The skill is written for authorized security testing and contains no check that confirms you have permission before use. Brute force, race conditions and resource exhaustion can cause real harm, so only test systems you own or have written permission to test, and use a safe test plan.
Can beginners use the offensive-api-abuse skill to learn API security?
The skill assumes prior penetration testing knowledge. If you are new to API security, a general introduction will serve you better, and this skill is more useful once you already understand authentication, tokens and HTTP requests.
How does this skill compare with a normal API scanner?
Automated scanners check endpoints in isolation, while this skill focuses on the workflow between endpoints, such as skipped steps, race conditions and trust relationships. It complements a scanner rather than replacing it.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you run authorized penetration tests or bug bounty work against APIs and want a detailed checklist for business logic, GraphQL, JWT and key-leak testing. Pick something else if you are new to API security, need a general introduction, or test systems where you do not have written permission or a safe plan for disruptive techniques.
Download the skill