Skip to content
Get packs

API Security Testing

Lets the agent run structured security tests against REST, GraphQL and gRPC APIs following the OWASP API Top 10.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a step-by-step methodology for finding security weaknesses in APIs, the interfaces that apps use to talk to servers. It covers discovering endpoints, testing logins and tokens, checking whether users can reach data or actions they should not, probing inputs for injection flaws, and checking whether responses leak too much information. It also includes a small Python script that automates a basic check for broken object-level authorization by comparing responses for two user IDs.

Great for

  • Security engineers or penetration testers who have written authorization to test a specific API
  • Developers doing a security review of their own API before release, in a staging or lab environment
  • Students learning the OWASP API Security Top 10 in a deliberately vulnerable lab

Skip it if

  • Testing someone else's API or production systems without written permission, which is illegal in most places and is explicitly ruled out by the skill itself
  • Load testing or denial-of-service testing, which the skill says to avoid unless explicitly scoped, because it can take services down
  • Production APIs that handle real payments without safeguards, since active injection and brute-force payloads can cause damage or trigger lockouts

Try asking

  • “Test the staging API at https://staging.example.com for broken object-level authorization using two test accounts”
  • “Review our GraphQL endpoint for introspection exposure and authorization bypasses”
  • “Walk me through checking our JWT implementation for algorithm confusion and weak secrets”
  • “Build a Postman test plan covering unauthenticated, user and admin privilege levels for our REST API”
Step-by-step guide: how to use API Security TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-api-security-testing.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-api-security-testing.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-api-security-testing.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the agent at systems you own or have explicit written authorization to test, and state the scope in your request.
  • Start with a staging or lab environment and review scripts/agent.py before running it, since it sends live HTTP requests with your bearer token.
  • Provide the OpenAPI spec or Postman collection and separate test accounts at each privilege level to get the most useful results.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.