api

Audit REST and RPC APIs against OWASP API Top 10 with CWE mappings.

3|Updated Apr 13, 2026

Search Tags:#authorization #security #api #rate-limiting #owasp-api-top-10 #bola

Ready to run

npx skills add https://github.com/0x1337c0d3/claude-security --skill api-0x1337c0d3

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api
Source: https://github.com/0x1337c0d3/claude-security/tree/main/skills/sentinel/skills/api
Command: npx skills add https://github.com/0x1337c0d3/claude-security --skill api-0x1337c0d3

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables teams to audit REST and RPC APIs for security vulnerabilities aligned with the OWASP API Top 10 (2023), reducing the risk of data exposure and misconfigurations.

Core Features & Use Cases

OWASP-aligned API security audit for REST and RPC endpoints, focusing on BOLA, mass assignment, rate limiting, and broken function-level authorization.
Structured findings workflow with step-by-step guidance: identify API files (routes, controllers, schemas), run scanners (semgrep, bandit, brakeman), and perform manual checks to validate access controls and data exposure.
Remediation guidance and CWE mappings to help developers fix vulnerabilities and align with Sentinel integration.

Quick Start

Run an OWASP API Top 10–aligned security audit on the target REST/RPC APIs and return a structured findings report.

Frequently Asked Questions about api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit REST and RPC APIs for OWASP API Top 10 vulnerabilities?▼

To audit REST and RPC APIs for OWASP API Top 10 vulnerabilities, identify API endpoints and data flows, then run scanners like semgrep, bandit, or brakeman alongside manual access control checks to produce actionable findings with CWE mappings.

What is the best way to detect BOLA and broken function-level authorization in APIs?▼

Detecting BOLA and broken function-level authorization requires mapping data flows to API endpoints and validating access controls manually. This process identifies exposure risks and provides remediation guidance aligned with the OWASP API Top 10 (2023) standard.

How do I check my API for mass assignment and rate limiting issues?▼

Checking APIs for mass assignment and rate limiting issues involves identifying route controllers and schemas, running static scanners, and performing manual checks to validate data exposure controls and generate structured findings with remediation steps.

Can I use this API security audit approach for Sentinel integration?▼

Yes, the API security audit approach supports Sentinel integration by providing structured findings with CWE mappings and remediation guidance, ensuring detected vulnerabilities align with broader security monitoring and response workflows.

Does API security auditing work without dedicated dependencies?▼

API security auditing can run without dedicated dependencies by leveraging standard static analysis scanners like semgrep, bandit, and brakeman to evaluate routes, controllers, and schemas for data exposure and misconfiguration risks.

Why do I need to map API endpoints and data flows for security audits?▼

Mapping API endpoints and data flows is necessary for security audits because it enables accurate assessment of access control boundaries and data exposure risks, forming the baseline for applying OWASP API Top 10 checks like BOLA and mass assignment validation.