Automate API security assessments across REST, GraphQL, gRPC, SOAP, and MCP backends.
npx skills add https://github.com/0x0pointer/skills --skill api-security-0x0pointer
Please help me install this Agent Skill. Skill: api-security Source: https://github.com/0x0pointer/skills/tree/main/api-security Command: npx skills add https://github.com/0x0pointer/skills --skill api-security-0x0pointer
Deep API security assessment tackles the challenge of identifying authorization gaps, data exposure, misconfigurations, and insecure API design across REST, GraphQL, gRPC, SOAP, and MCP endpoints. It automates discovery, testing, and documentation of security weaknesses that often go unnoticed by conventional testing.
Target a live API endpoint and let the skill perform surface discovery, vulnerability testing, and PoC generation.
High-intent search queries and answers about installing and using this skill.
Automated API security testing across REST, GraphQL, and gRPC uses tools like schemathesis and graphql-cop to discover endpoints, identify authorization gaps, and generate confirmed PoCs. You provide a target URL and depth setting to map the attack surface and chain findings into exploit paths.
API attack surface discovery extracts endpoints from OpenAPI/Swagger documents, GraphQL introspection, gRPC reflection, and traffic captures. Tools like kiterunner and ffuf parse these sources to map exposed routes and parameters before vulnerability testing begins.
Yes, OpenAPI fuzzing with schemathesis and restler-fuzzer tests for BOLA and BOPLA vulnerabilities by manipulating API parameters. The assessment chains these findings across the OWASP API Top 10 categories to produce threat models and remediation guidance.
API security assessment supports JWT token analysis with jwt_tool and tests MCP backends for misconfigurations and data exposure. It evaluates authorization gaps across multiple API protocols including SOAP and MCP to produce confirmed proof of concepts.
Chaining API security findings into exploit paths involves linking discovered vulnerabilities like SSRF and data exposure across the OWASP API Top 10. The assessment automates this process to produce documentation, threat models, and confirmed PoCs for developers and security teams.
GraphQL security testing uses graphql-cop, clairvoyance, batchql, and inql to perform introspection discovery and vulnerability analysis. These tools map GraphQL schemas and test for authorization gaps and data exposure within the API endpoints.
franroaDesign REST and GraphQL APIs with OpenAPI 3.1 specifications.
unheadedIdentify and exploit weaknesses in the Monad/Sophia/Wotan stack.
vaibhavk97Capture browser HTTP(S) traffic into a queryable SQLite database.
dmbs335Generate fuzzing wordlists and mutation seeds from vulnerability taxonomy documents.
