api-sec
starsforks
How to install api-sec?
prohao42/aimy-skill/api-sec
$npx -y skills add Prohao42/aimy-skill --skill api-sec--- name: api-sec description: >- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill. ---
SKILL.md
| 1 | # API Security Router |
| 2 | |
| 3 | This is the routing entry point for API security testing. |
| 4 | |
| 5 | Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill. |
| 6 | |
| 7 | ## When to Use |
| 8 | |
| 9 | - The target exposes REST APIs, mobile backends, or GraphQL endpoints |
| 10 | - You need to define API testing order before going into specific topics |
| 11 | - You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks |
| 12 | |
| 13 | ## Skill Map |
| 14 | |
| 15 | - [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation |
| 16 | - [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields |
| 17 | - [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass |
| 18 | - [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters |
| 19 | |
| 20 | ## Quick Triage |
| 21 | |
| 22 | | Observation | Route | |
| 23 | |---|---| |
| 24 | | Swagger or OpenAPI is present | [api-recon-and-docs](../api-recon-and-docs/SKILL.md) | |
| 25 | | IDs appear in URL, JSON, headers, or GraphQL args | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) | |
| 26 | | JWT token visible in traffic | [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) | |
| 27 | | `/graphql` or batched JSON arrays are present | [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/SKILL.md) | |
| 28 | | Registration, login, or profile updates accept extra fields | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) then [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) | |
| 29 | |
| 30 | ## Recommended Flow |
| 31 | |
| 32 | 1. Start with exposed endpoints and documentation assets |
| 33 | 2. Then evaluate object-level and function-level authorization |
| 34 | 3. Then evaluate token, header, signature, and rate-limit boundaries |
| 35 | 4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse |
| 36 | |
| 37 | ## Related Categories |
| 38 | |
| 39 | - [auth-sec](../auth-sec/SKILL.md) |
| 40 | - [business-logic-vuln](../business-logic-vuln/SKILL.md) |
| 41 | - [recon-for-sec](../recon-for-sec/SKILL.md) |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
