api-security-review

Name: api-security-review
Author: thomast1906

13installs53forks

How to install api-security-review?

thomast1906/github-copilot-agent-skills/api-security-review

$npx -y skills add thomast1906/github-copilot-agent-skills --skill api-security-review

Installs into the current project.

Summary

Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or com

Files · 1

View on GitHub

SKILL.md

1	# API Security Review Skill
2
3	Performs comprehensive security reviews of Azure API Management configurations, policies, and network architecture with focus on OWASP API Security Top 10 and Azure Security Benchmark.
4
5	## When to Use This Skill
6
7	Activate this skill when users need:
8
9	- Security audits: Comprehensive review of APIM configuration and policies
10	- Pre-deployment validation: Security checklist before production deployment
11	- Compliance reviews: OWASP API Top 10, Azure Security Benchmark, CIS Azure alignment
12	- Vulnerability assessments: Identify security gaps in authentication, network, policies
13	- Incident response: Review configuration after security incident
14	- Architecture validation: Verify VNet Internal mode, Private Link, authentication setup
15
16	---
17
18	## Security Review Framework
19
20	### 1. OWASP API Security Top 10 (2023 RC)
21
22	\| ID \| Threat \| APIM Mitigation \|
23	\|----\|--------\|-----------------\|
24	\| API1 \| Broken Object Level Authorization \| Policy: validate-jwt + check user claims for resource ownership \|
25	\| API2 \| Broken Authentication \| Policy: OAuth 2.0 (validate-jwt), no plaintext credentials \|
26	\| API3\| Broken Object Property Level Authorization \| Policy: Validate input/output schemas, mask sensitive fields \|
27	\| API4 \| Unrestricted Resource Consumption \| Policy: rate-limit-by-key (per user/subscription), quota enforcement \|
28	\| API5 \| Broken Function Level Authorization \| Policy: Validate JWT scopes/roles per operation \|
29	\| API6 \| Unrestricted Access to Sensitive Business Flows \| Policy: Advanced rate limiting, CAPTCHA integration \|
30	\| API7 \| Server Side Request Forgery (SSRF) \| Network: VNet Internal mode, Private Link to backends \|
31	\| API8 \| Security Misconfiguration \| Infrastructure: TLS 1.3, disable weak ciphers, NSG rules \|
32	\| API9 \| Improper Inventory Management \| Governance: Azure API Center, version tracking, deprecation \|
33	\| API10 \| Unsafe Consumption of APIs \| Policy: Validate backend responses, timeout policies \|
34
35	---
36
37	## Security Controls Checklist
38
39	See [references/SECURITY_CONTROLS.md](references/SECURITY_CONTROLS.md) for complete 60+ control checklist across 9 categories
40
41	### Quick Control Summary
42
43	1. Network Security (NS-): VNet Internal, Private Link, NSG, no public IPs
44	2. Identity & Access (IA-): OAuth 2.0, MFA, PIM, no service accounts
45	3. Data Protection (DP-): TLS 1.3, Key Vault, no PII in logs
46	4. Logging & Threat (LT-): App Insights, correlation IDs, SIEM integration
47	5. Identity Management (IM-): Managed Identity, RBAC, least privilege
48	6. Recovery (RA-): Backups, zone redundancy, DR plan
49	7. Governance (GS-): API Center, policy enforcement, compliance
50	8. Posture (PS-): Azure Policy, Defender for APIs, vulnerability scanning
51	9. DevSecOps (DV-): APIOps, IaC security, secret scanning
52
53	---
54
55	## Important: MCP Tools (ALWAYS Use)
56
57	### 1. Call Security Best Practices FIRST
58
59	```
60	Tool: mcp_azure_mcp_get_azure_bestpractices
61	Intent: "Azure API Management security best practices"
62	```
63
64	### 2. Search Security Documentation
65
66	```
67	Tool: mcp_azure_mcp_documentation search
68	Query: "APIM security best practices OWASP"
69	```
70
71	### 3. Query Existing Resources (If Reviewing Deployed Environment)
72
73	```
74	Tool: azure_resources-query_azure_resource_graph
75	Intent: "Get API Management instances with network configuration and SKU details"
76	```
77
78	---
79
80	## Critical Security Validations
81
82	### 1. VNet Internal Mode Validation
83
84	Check: APIM instances deployed in VNet Internal mode (no public IP)
85
86	```kql
87	// Azure Resource Graph Query
88	resources
89	\| where type == 'microsoft.apimanagement/service'
90	\| extend vnetType = properties.virtualNetworkType
91	\| where vnetType != 'Internal'
92	\| project name, resourceGroup, location, vnetType, sku=properties.sku.name
93	```
94
95	Expected: `vnetType == 'Internal'` for all production APIM instances
96
97	Risk if External: Gateway endpoint exposed to public internet, larger attack surface
98
99	---
100
101	### 2. Private Link Validation
102
103	Check: Azure Front Door connects to APIM via Private Link (not public origin)
104
105	Validation Steps:
106	1. Front Door origin type = `Private Link` (not `Custom` or `Public`)
107	2. Private Link target = APIM resource ID
108	3. Private Link status = `Approved` (not `Pending`)
109	4. APIM has no public DNS record resolving to public IP
110
111	Risk if Public: Traffic goes over public internet, no zero-trust architecture
112
113	---
114
115	### 3. Authentication

People who liked this also viewed

6 picks

Type

api-security-review

13installs53forks

View on GitHub

How to install api-security-review?

thomast1906/github-copilot-agent-skills/api-security-review

$npx -y skills add thomast1906/github-copilot-agent-skills --skill api-security-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Security Review Skill
2
3	Performs comprehensive security reviews of Azure API Management configurations, policies, and network architecture with focus on OWASP API Security Top 10 and Azure Security Benchmark.
4
5	## When to Use This Skill
6
7	Activate this skill when users need:
8
9	- Security audits: Comprehensive review of APIM configuration and policies
10	- Pre-deployment validation: Security checklist before production deployment
11	- Compliance reviews: OWASP API Top 10, Azure Security Benchmark, CIS Azure alignment
12	- Vulnerability assessments: Identify security gaps in authentication, network, policies
13	- Incident response: Review configuration after security incident
14	- Architecture validation: Verify VNet Internal mode, Private Link, authentication setup
15
16	---
17
18	## Security Review Framework
19
20	### 1. OWASP API Security Top 10 (2023 RC)
21
22	\| ID \| Threat \| APIM Mitigation \|
23	\|----\|--------\|-----------------\|
24	\| API1 \| Broken Object Level Authorization \| Policy: validate-jwt + check user claims for resource ownership \|
25	\| API2 \| Broken Authentication \| Policy: OAuth 2.0 (validate-jwt), no plaintext credentials \|
26	\| API3\| Broken Object Property Level Authorization \| Policy: Validate input/output schemas, mask sensitive fields \|
27	\| API4 \| Unrestricted Resource Consumption \| Policy: rate-limit-by-key (per user/subscription), quota enforcement \|
28	\| API5 \| Broken Function Level Authorization \| Policy: Validate JWT scopes/roles per operation \|
29	\| API6 \| Unrestricted Access to Sensitive Business Flows \| Policy: Advanced rate limiting, CAPTCHA integration \|
30	\| API7 \| Server Side Request Forgery (SSRF) \| Network: VNet Internal mode, Private Link to backends \|
31	\| API8 \| Security Misconfiguration \| Infrastructure: TLS 1.3, disable weak ciphers, NSG rules \|
32	\| API9 \| Improper Inventory Management \| Governance: Azure API Center, version tracking, deprecation \|
33	\| API10 \| Unsafe Consumption of APIs \| Policy: Validate backend responses, timeout policies \|
34
35	---
36
37	## Security Controls Checklist
38
39	See [references/SECURITY_CONTROLS.md](references/SECURITY_CONTROLS.md) for complete 60+ control checklist across 9 categories
40
41	### Quick Control Summary
42
43	1. Network Security (NS-): VNet Internal, Private Link, NSG, no public IPs
44	2. Identity & Access (IA-): OAuth 2.0, MFA, PIM, no service accounts
45	3. Data Protection (DP-): TLS 1.3, Key Vault, no PII in logs
46	4. Logging & Threat (LT-): App Insights, correlation IDs, SIEM integration
47	5. Identity Management (IM-): Managed Identity, RBAC, least privilege
48	6. Recovery (RA-): Backups, zone redundancy, DR plan
49	7. Governance (GS-): API Center, policy enforcement, compliance
50	8. Posture (PS-): Azure Policy, Defender for APIs, vulnerability scanning
51	9. DevSecOps (DV-): APIOps, IaC security, secret scanning
52
53	---
54
55	## Important: MCP Tools (ALWAYS Use)
56
57	### 1. Call Security Best Practices FIRST
58
59	```
60	Tool: mcp_azure_mcp_get_azure_bestpractices
61	Intent: "Azure API Management security best practices"
62	```
63
64	### 2. Search Security Documentation
65
66	```
67	Tool: mcp_azure_mcp_documentation search
68	Query: "APIM security best practices OWASP"
69	```
70
71	### 3. Query Existing Resources (If Reviewing Deployed Environment)
72
73	```
74	Tool: azure_resources-query_azure_resource_graph
75	Intent: "Get API Management instances with network configuration and SKU details"
76	```
77
78	---
79
80	## Critical Security Validations
81
82	### 1. VNet Internal Mode Validation
83
84	Check: APIM instances deployed in VNet Internal mode (no public IP)
85
86	```kql
87	// Azure Resource Graph Query
88	resources
89	\| where type == 'microsoft.apimanagement/service'
90	\| extend vnetType = properties.virtualNetworkType
91	\| where vnetType != 'Internal'
92	\| project name, resourceGroup, location, vnetType, sku=properties.sku.name
93	```
94
95	Expected: `vnetType == 'Internal'` for all production APIM instances
96
97	Risk if External: Gateway endpoint exposed to public internet, larger attack surface
98
99	---
100
101	### 2. Private Link Validation
102
103	Check: Azure Front Door connects to APIM via Private Link (not public origin)
104
105	Validation Steps:
106	1. Front Door origin type = `Private Link` (not `Custom` or `Public`)
107	2. Private Link target = APIM resource ID
108	3. Private Link status = `Approved` (not `Pending`)
109	4. APIM has no public DNS record resolving to public IP
110
111	Risk if Public: Traffic goes over public internet, no zero-trust architecture
112
113	---
114
115	### 3. Authentication

People who liked this also viewed

6 picks

Type