API Security Best Practices
Guides an agent to review and build secure API endpoints: auth, authorization, input validation, and abuse controls.
- Repository
- sickn33/agentic-awesome-skills
- Stars
- 49,023
- Licence
- MIT
- Files
- 1 file
What it does
When installed, the agent reviews API code with a security checklist in mind: how callers are identified, whether they may act on a specific object, whether input is strictly validated, and how abuse like brute force or rate abuse is handled. It gives code patterns (for example JWT verification with a fixed algorithm and issuer/audience checks, ownership-scoped database deletes, strict schema validation) and warns about common mistakes such as token refresh reuse, SSRF in outbound URLs, and unsafe uploads. It is guidance for an agent rather than a tool that scans or changes systems by itself.
Great for
- Backend developers adding a protected endpoint or reviewing an existing API route
- Teams auditing object-level access control or multi-tenant data isolation
- Developers replacing loose request parsing with strict validation
Skip it if
- Production penetration testing or live scanning, since the skill itself says production scans need separate authority and it provides no scanner
- Non-developers looking for a finished, runnable secure service; the examples are sketches that need adapting and testing against the installed library versions
Try asking
- “Review this Express route for missing ownership checks before a user can delete a post”
- “Add JWT verification to my API using jsonwebtoken with fixed algorithm and issuer checks”
- “Design a refresh token flow that prevents concurrent reuse and supports revocation”
- “Check this endpoint's request body validation and reject unexpected properties”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
api-security-best-practices.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip api-security-best-practices.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip api-security-best-practices.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at a specific route or file so it reviews concrete code instead of generic advice.
- Confirm every library API against your installed versions, as the skill itself instructs.
- Test with synthetic identities in a non-production environment before trusting the flows.
What's inside
- SKILL.md
Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.