skills.rest
brucesongs
brucesongsCOMMUNITY
Explore all skills by this author →
GitHub

api-security

Test API security weaknesses across REST, GraphQL, and gRPC.

60|14|Updated Apr 27, 2026
Search Tags:#rest#graphql#api-security#grpc#pentest#security-testing#owasp-api-security
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill api-security-brucesongs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/api-security
Command: npx skills add https://github.com/brucesongs/kali-claw --skill api-security-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

API security testing across REST, GraphQL, and gRPC to identify authentication, authorization, data exposure, and rate-limiting weaknesses.

Core Features & Use Cases

  • Comprehensive API security assessment across REST, GraphQL, and gRPC architectures.
  • Aligns with OWASP API Security Top 10, covering Broken Authentication, BOLA, Mass Assignment, and rate-limiting bypass scenarios.
  • Use-case driven workflows including API discovery, authentication/authorization testing, input validation, and GraphQL-specific testing (introspection, batching, depth).

Quick Start

Run a focused API security assessment against your REST, GraphQL, and gRPC endpoints to detect authentication, authorization, and data-exposure weaknesses.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API security vulnerabilities across REST, GraphQL, and gRPC endpoints?▼

API security testing identifies authentication, authorization, data exposure, and rate-limiting weaknesses across REST, GraphQL, and gRPC architectures using OWASP API Security Top 10 guidance and targeted payloads.

What is the best way to detect Broken Authentication and BOLA in my API?▼

Detecting Broken Authentication and BOLA involves aligning API security assessments with the OWASP API Security Top 10, applying use-case workflows to expose authorization and mass assignment vulnerabilities.

How do I test GraphQL introspection and batching security issues?▼

Testing GraphQL introspection and batching security involves applying specialized workflows to evaluate depth limits, introspection exposure, and malicious batching payloads to uncover data exposure risks.

Can I use this approach for API discovery and input validation testing?▼

Yes, comprehensive API security assessments include use-case driven workflows for API discovery and input validation, alongside authentication testing and rate-limiting bypass detection across REST, GraphQL, and gRPC architectures.

Does API security testing require OWASP API Security Top 10 payloads?▼

API security testing requires OWASP API Security Top 10 guidance and a suite of targeted payloads and test cases to effectively identify vulnerabilities like Broken Authentication, BOLA, and mass assignment across API architectures.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

api-recon-and-docs

Enumerate API endpoints, schemas, versions, and hidden documentation from OpenAPI/Swagger artifacts.

Official
Intermediate
angelapaiaangelapaia
13

web-security-audit

Automates authorized black-box web security audits and generates HTML vulnerability reports with remediation guidance.

Community
Advanced
trilwutrilwu
109

testing-apis

Identify and exploit API security weaknesses across REST and GraphQL endpoints.

Community
Advanced
n4igmen4igme

hunt-graphql

Identify GraphQL vulnerabilities and misconfigurations across public and private endpoints.

Community
Advanced