api-sec

Route API security testing into documentation, authorization, token, and parameter workflows.

11|4|Updated Jun 7, 2026

Search Tags:#authorization #security #api #routing #jwt #graphql #recon

Ready to run

npx skills add https://github.com/sayseven7/frameseven --skill api-sec-sayseven7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-sec
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/api-sec
Command: npx skills add https://github.com/sayseven7/frameseven --skill api-sec-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you decide how to approach API security testing when a target exposes REST, mobile backend, or GraphQL interfaces. It reduces wasted effort by routing you to the right next step before you dive into deeper authorization, token, or schema-specific analysis.

Core Features & Use Cases

API Triage: Quickly classify whether the issue is mainly documentation and recon, object authorization, token trust, or hidden-parameter abuse.
Workflow Routing: Choose the next specialized path for API recon and docs, BOLA and BFLA, JWT and header trust, or GraphQL and batching checks.
Practical Use Case: When you find a new endpoint set during a pentest, use this Skill to prioritize the right API testing track instead of treating every endpoint the same.

Quick Start

Use the api-sec skill to determine which API security path to follow first for the target you are testing.

Frequently Asked Questions about api-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage API security testing for REST and GraphQL endpoints?▼

Workflow routing directs your API testing toward specialized paths for recon and docs, BOLA and BFLA, JWT and header trust, or GraphQL and batching checks based on the initial triage classification of your target endpoints.

When do I need to prioritize BOLA and JWT trust checks during an API pentest?▼

You need to prioritize BOLA and JWT trust checks when a new endpoint set is discovered during a pentest, ensuring structured pre-assessment of object authorization and token abuse scenarios before selecting specialized downstream testing.

Does this API security routing approach work with mobile backends and GraphQL batching scenarios?▼

This API security routing approach works with mobile backends, GraphQL endpoints, and REST interfaces, specifically mapping schema-abuse and batching scenarios to the appropriate structured pre-assessment workflow for deeper testing.

What is the best way to approach GraphQL schema abuse and hidden-parameter triage?▼

The best way to approach GraphQL schema abuse and hidden-parameter triage is to classify the issue early, routing schema and batching checks into a dedicated workflow to reduce wasted effort before deeper testing.