api-sec

Categorize API security testing into recon, authorization, token, and parameter issues.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/bingook/bingo --skill api-sec-bingook
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: api-sec
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/api-sec
Command: npx skills add https://github.com/bingook/bingo --skill api-sec-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The Skill addresses the challenge of navigating complex API security issues by providing a structured approach to testing and analysis.

Core Features & Use Cases

  • API Recon and Docs: Facilitates discovery and documentation of API endpoints.
  • Authorization and BOLA: Handles object-level authorization issues and object ID enumeration.
  • JWT and Auth Abuse: Identifies and mitigates vulnerabilities in JWT tokens and authorization flows.
  • GraphQL and Hidden Parameters: Assesses GraphQL endpoint security and hidden parameters.

Quick Start

Utilize the api-sec skill to evaluate the security of an API endpoint by running 'api-sec scan https://api.example.com'.

Frequently Asked Questions about api-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API endpoints for Broken Object Level Authorization vulnerabilities?

To test API endpoints for Broken Object Level Authorization, you can route your security testing through pre-defined skill maps that categorize object authorization issues and handle object ID enumeration.

What is the best way to assess JWT token trust and authorization flow abuse?

Assessing JWT token trust involves identifying and mitigating vulnerabilities in JWT tokens and authorization flows by categorizing them under token trust issues for in-depth testing.

How do I discover hidden parameters and test GraphQL endpoint security?

Discovering hidden parameters and testing GraphQL endpoint security is handled by evaluating GraphQL endpoints and hidden parameters through structured vulnerability assessment skill maps.

Do I need prior API security knowledge to perform vulnerability assessments?

Yes, performing vulnerability assessments requires prior knowledge of API security concepts and potential vulnerabilities to effectively navigate the structured testing analysis.

How do I run a security scan on a specific API endpoint?

To run a security scan on a specific API endpoint, utilize the api-sec skill to evaluate the endpoint by running the command 'api-sec scan https://api.example.com'.