Review REST API endpoints for isolation, permissions, and serializer usage.
npx skills add https://github.com/aist-ai-sast/aist --skill aist-api-review
Please help me install this Agent Skill. Skill: aist-api-review Source: https://github.com/aist-ai-sast/aist/tree/main/.claude/skills/aist-api-review Command: npx skills add https://github.com/aist-ai-sast/aist --skill aist-api-review
Streamlines the process of validating new or modified REST API endpoints for organization isolation, permission correctness, and proper serializer usage, reducing risk in deployments.
Inspect the aist/api/ codebase and generate a structured API-review report focused on isolation, permissions, and serializer usage.
High-intent search queries and answers about installing and using this skill.
Reviewing REST API endpoints for organization isolation and RBAC involves verifying permission classes, view-level checks, and tenant access boundaries. This structured assessment ensures endpoints enforce proper access controls and align with security policies before deployment.
Superuser bypass detection in API security reviews identifies and mitigates risky admin-endpoint bypass scenarios. It verifies that superuser controls do not unintentionally circumvent organization isolation, RBAC permissions, or tenant access boundaries.
Checking serializer field usage for safety involves assessing how serializers expose data through REST API endpoints. You must verify that sensitive fields are properly restricted and align with organization isolation and permission policies.
You need to run a comprehensive REST API security review when adding or updating endpoints in your codebase. It surfaces design and security gaps, such as tenant isolation failures or incorrect permissions, before merging new or modified code.
This API review process is specifically applied during the integration of new or modified endpoints in aist/api/. While its structured criteria for security, design, and compliance can conceptually evaluate other REST APIs, its core logic targets the aist/api/ codebase.
giruclawbotBuild Django REST Framework APIs with ViewSets, serializers, filters, permissions, and pytest tests.
leadmind-aiAudit codebases for pre-deployment risks and generate severity-sorted findings reports.
marquesfelipDesign and review RBAC/ABAC authorization models for multi-tenant systems.
ozan-fnScan Golang code for vulnerabilities using govulncheck and golangci-lint.
