SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Security · Backend / AGENT SKILL
api-sec
0
Routes API security assessments to reconnaissance, authorization, token, or hidden-parameter workflows.
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# API Security Router This is the routing entry point for API security testing. Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill. ## When to Use - The target exposes REST APIs, mobile backends, or GraphQL endpoints - You need to define API testing order before going into specific topics - You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks ## Skill Map - [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation - [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields - [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass - [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters ## Quick Triage | Observation | Route | |---|---| | Swagger or OpenAPI is present | [api-recon-and-docs](../api-recon-and-docs/SKILL.md) | | IDs appear in URL, JSON, headers, or GraphQL args | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) | | JWT token visible in traffic | [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) | | `/graphql` or batched JSON arrays are present | [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/SKILL.md) | | Registration, login, or profile updates accept extra fields | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) then [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) | ## Recommended Flow 1. Start with exposed endpoints and documentation assets 2. Then evaluate object-level and function-level authorization 3. Then evaluate token, header, signature, and rate-limit boundaries 4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse ## Related Categories - [auth-sec](../auth-sec/SKILL.md) - [business-logic-vuln](../business-logic-vuln/SKILL.md) - [recon-for-sec](../recon-for-sec/SKILL.md)