Audit REST and RPC APIs against OWASP API Top 10 with CWE mappings.
npx skills add https://github.com/0x1337c0d3/claude-security --skill api-0x1337c0d3
Please help me install this Agent Skill. Skill: api Source: https://github.com/0x1337c0d3/claude-security/tree/main/skills/sentinel/skills/api Command: npx skills add https://github.com/0x1337c0d3/claude-security --skill api-0x1337c0d3
This Skill enables teams to audit REST and RPC APIs for security vulnerabilities aligned with the OWASP API Top 10 (2023), reducing the risk of data exposure and misconfigurations.
Run an OWASP API Top 10–aligned security audit on the target REST/RPC APIs and return a structured findings report.
High-intent search queries and answers about installing and using this skill.
To audit REST and RPC APIs for OWASP API Top 10 vulnerabilities, identify API endpoints and data flows, then run scanners like semgrep, bandit, or brakeman alongside manual access control checks to produce actionable findings with CWE mappings.
Detecting BOLA and broken function-level authorization requires mapping data flows to API endpoints and validating access controls manually. This process identifies exposure risks and provides remediation guidance aligned with the OWASP API Top 10 (2023) standard.
Checking APIs for mass assignment and rate limiting issues involves identifying route controllers and schemas, running static scanners, and performing manual checks to validate data exposure controls and generate structured findings with remediation steps.
Yes, the API security audit approach supports Sentinel integration by providing structured findings with CWE mappings and remediation guidance, ensuring detected vulnerabilities align with broader security monitoring and response workflows.
API security auditing can run without dedicated dependencies by leveraging standard static analysis scanners like semgrep, bandit, and brakeman to evaluate routes, controllers, and schemas for data exposure and misconfiguration risks.
Mapping API endpoints and data flows is necessary for security audits because it enables accurate assessment of access control boundaries and data exposure risks, forming the baseline for applying OWASP API Top 10 checks like BOLA and mass assignment validation.
YusufkotavomExtract API endpoints from *.controller.ts files and update the inventory markdown.
AgentSecOpsAnalyze Python code for security vulnerabilities and generate JSON reports.
florianbuetowAnalyze source code for broken access control vulnerabilities.
Renzo-TognellaAutomate API security testing against OWASP API Security Top 10 risks.
