skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

api

Audit REST and RPC APIs for OWASP API Security Top 10 vulnerabilities.

12|1|Updated Feb 9, 2026
Search Tags:#authorization#owasp#rest api#api security#vulnerability scanning#bola
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill api-florianbuetow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/api
Command: npx skills add https://github.com/florianbuetow/claude-code --skill api-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, bandit, brakeman, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in REST and RPC APIs, protecting against data breaches, unauthorized access, and denial-of-service attacks.

Core Features & Use Cases

  • Vulnerability Auditing: Detects issues like Broken Object-Level Authorization (BOLA), mass assignment, and excessive data exposure.
  • OWASP API Top 10 Alignment: Focuses on the most significant API security risks.
  • Use Case: Automatically audit your new /api/v1/users endpoint to ensure that users can only access and modify their own data, not that of other users.

Quick Start

Analyze the current API endpoints for security vulnerabilities, focusing on BOLA and mass assignment.

Frequently Asked Questions about api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit REST APIs for Broken Object Level Authorization vulnerabilities?▼

To audit REST APIs for Broken Object Level Authorization (BOLA), trace data flow and authorization middleware chains to verify users can only access their own data.

What is mass assignment in API security and how do I detect it?▼

Mass assignment in API security occurs when user input is blindly mapped to object properties, which you can detect by auditing endpoint inputs against the OWASP API Security Top 10.

How do I scan an API for the OWASP API Security Top 10 vulnerabilities?▼

Scan APIs for OWASP API Security Top 10 vulnerabilities by auditing endpoints for excessive data exposure, missing rate limiting, and broken function-level authorization using static analysis tools.

Does this API security audit work with semgrep and bandit?▼

Yes, this API security audit leverages semgrep, bandit, and brakeman as underlying dependencies to perform deep static vulnerability scanning across your REST and RPC endpoints.

What is the best way to secure a new API endpoint against excessive data exposure?▼

The best way to secure a new API endpoint against excessive data exposure is to perform a comprehensive vulnerability audit that deeply traces data flow and authorization middleware chains.

Can I check my RPC endpoints for missing rate limiting automatically?▼

Yes, you can automatically check RPC and REST endpoints for missing rate limiting by running an audit aligned with the OWASP API Security Top 10 vulnerability scanning workflows.

Related Skills

Explore More Software Engineering Skills→
TECHKNOWMAD-LABSTECHKNOWMAD-LABS

security-audit

Scan code repositories for vulnerabilities and leaked secrets using static analysis tools.

Official
Advanced
MacPhobosMacPhobos

API Security Review Skill

Review API endpoints against a security checklist with framework-specific code examples.

Community
Advanced
TymorIbrahimTymorIbrahim

springboot-verification

Automates build, static analysis, tests, security scan, and code review for Spring Boot projects.

Community
Advanced
SensLiaoSensLiao

security-app-api

Assess REST, GraphQL, and gRPC APIs against OWASP API Security Top 10:2023.

Community
Advanced