api-sec

Route API security tasks to appropriate deep-dive sub-skills.

5|1|Updated Apr 20, 2026
One-click install
npx skills add https://github.com/Yliken/ai4 --skill api-sec-yliken
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: api-sec
Source: https://github.com/Yliken/ai4/tree/main/skills/api-sec
Command: npx skills add https://github.com/Yliken/ai4 --skill api-sec-yliken

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Route API security tasks by category to select the appropriate deep-dive skill before performing detailed testing.

Core Features & Use Cases

  • Classifies API security scenarios (REST, GraphQL, tokens) into focused sub-skills.
  • Provides a decision gateway to API Recon & Docs, API Authorization & BOLA, API Auth & JWT Abuse, and GraphQL and Hidden Parameters.
  • Ensures consistent triage order for API security assessments in multi-skill playbooks.

Quick Start

Analyze a target API and choose between docs/recon, authorization, token abuse, and hidden-parameter paths to proceed into the corresponding sub-skill.

Frequently Asked Questions about api-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage API security tasks to determine the right testing path?

Triage API security tasks by classifying REST, GraphQL, and token-based APIs to route workflows to specialized sub-skills like API Recon and Docs or API Auth and JWT Abuse for deeper testing.

What is the best way to assess authorization vulnerabilities like BOLA in an API?

Assess API authorization vulnerabilities like BOLA by routing the target API through a decision gateway to select the API Authorization and BOLA deep-dive skill for focused testing.

Can I test GraphQL APIs for hidden parameters using this routing approach?

Yes, you can test GraphQL APIs for hidden parameters by classifying the target scenario to trigger the GraphQL and Hidden Parameters deep-dive path for specialized security testing.

Does this API security triage handle token abuse and JWT vulnerabilities?

Yes, this API security triage handles token abuse by directing token-based API scenarios to the API Auth and JWT Abuse sub-skill to perform detailed authentication vulnerability testing.

When do I need to route an API security assessment to API Recon and Docs?

You need to route an API security assessment to API Recon and Docs when the initial analysis determines that mapping documentation and performing reconnaissance are required before deeper testing.