api-sec

What problem does it solve?

This skill helps choose the correct API security testing track by examining high-level indicators and routing the assessment to focused sub-skills, preventing wasted effort and ensuring systematic coverage.

Core Features & Use Cases

• High-level triage: Map observable signs like OpenAPI/Swagger, IDs in URLs/JSON, visible JWTs, and GraphQL endpoints to the most relevant testing workflows.
• Prioritized workflow guidance: Recommend an order of testing such as recon/docs first, then object authorization/BOLA, followed by token/JWT abuse checks, and GraphQL/hidden-parameter analysis if applicable.
• Use Case: When assessing a mobile backend that exposes REST endpoints and shows JWTs in traffic, use this skill to determine whether to begin with API recon, authorization checks, or token abuse tests.

Quick Start

Ask the api-sec skill to analyze the target API and recommend which specialized API security skill to run first based on observed documentation, IDs, JWTs, or GraphQL indicators.