Skip to content
Get packs

API Security Assessment

Guides authorized security testing of REST, GraphQL, WebSocket and SOAP APIs for auth and access flaws

Source Download skill
Repository
sickn33/agentic-awesome-skills
Stars
49,023
Licence
MIT
Files
3 files

What it does

When installed, the agent gets a structured 10-phase playbook for testing web APIs that you are explicitly authorized to assess. It walks through discovering endpoints, checking JWT and OAuth login weaknesses, looking for one user reading another user's data (BOLA/IDOR) or misusing admin functions (BFLA), and reviewing input handling, rate limits and data over-exposure, then reporting findings. It is built to pause and ask for the exact target, written permission and scope before any intrusive command, and otherwise stays read-only and defensive.

Great for

  • Security engineers or pentesters with written authorization to test a specific API
  • Developers wanting a checklist to self-audit their own API's authentication and authorization before release
  • Teams planning an API security review who need a structured methodology

Skip it if

  • Testing APIs you do not own or lack written permission for, since the skill itself is offensive and misuse is illegal
  • Production systems without agreed rate and stop conditions, because many checks (DoS, Slowloris, credential cracking) are intrusive
  • Anyone expecting a turnkey scanner: the tools it names are references and are not bundled or verified as installed

Try asking

  • “Review this OpenAPI spec and list the BOLA/IDOR checks I should run against our staging API, with a confirmation step before any request is sent”
  • “Help me test our JWT implementation for alg:none and weak HMAC secrets on our authorized test environment”
  • “Create a defensive checklist for our GraphQL endpoint covering introspection, batching and GET mutations”
  • “Plan a multi-role authorization test matrix for admin, user and readonly accounts”
Step-by-step guide: how to use API Security AssessmentInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    api-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip api-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip api-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State the exact target, account and permitted scope up front so the mandatory confirmation gate can be satisfied quickly
  • Use staging or a controlled lab with canary objects rather than real user records, and agree request-rate limits beforehand
  • Treat named tool flags and capabilities as historical references and verify them against the installed version before relying on them

What's inside

  • references/jwt-oauth-testing.md
  • references/rest-graphql-testing.md
  • SKILL.md

Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.