skills.rest
hardw00t
hardw00tCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

api-security

Tests API security vulnerabilities across REST, GraphQL, gRPC, and WebSocket interfaces.

90|14|Updated Jan 12, 2026
Search Tags:#jwt#openapi#graphql#api-security#fuzzing#pentest
One-click install
npx skills add https://github.com/hardw00t/ai-security-arsenal --skill api-security-hardw00t
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/hardw00t/ai-security-arsenal/tree/main/skills/api-security
Command: npx skills add https://github.com/hardw00t/ai-security-arsenal --skill api-security-hardw00t

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

API security testing for REST, GraphQL, gRPC, and WebSocket APIs to identify vulnerabilities and misconfigurations before attackers exploit them.

Core Features & Use Cases

  • Comprehensive API security testing across REST, GraphQL, gRPC, and WebSocket protocols.
  • Coverage of OWASP API Top 10 with practical testing workflows, including authentication/authorization validation and endpoint fuzzing.
  • Ability to analyze OpenAPI/Swagger specs and discover security gaps; supports JWT/OAuth testing and rate-limiting checks.

Quick Start

Command the skill to initiate API security testing against a target API, e.g., https://api.example.com, focusing on vulnerability discovery, auth checks, and spec validation.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my API for the OWASP API Top 10 vulnerabilities?▼

API security testing verifies OWASP API Top 10 vulnerabilities across REST, GraphQL, gRPC, and WebSocket interfaces. It validates authentication, authorization, and fuzzes endpoints to detect misconfigurations before attackers exploit them.

Can I analyze OpenAPI Swagger specs to discover security gaps?▼

Analyzing OpenAPI/Swagger specs is supported during API security testing to discover security gaps. This involves parsing endpoint definitions to target specific parameters for fuzzing and validating authentication mechanisms.

What tools are needed for API pentest fuzzing and endpoint scanning?▼

API pentest fuzzing and endpoint scanning require tools including nuclei, arjun, jwt_tool, graphql-cop, and ffuf. These facilitate vulnerability discovery, parameter fuzzing, and JWT/OAuth testing across various API protocols.

Does API security testing work with GraphQL and gRPC interfaces?▼

API security testing comprehensively covers GraphQL and gRPC interfaces alongside REST and WebSocket. It supports endpoint fuzzing and authentication validation, ensuring security checks span modern API architectures.

How do I validate JWT and OAuth implementations in my API?▼

Validating JWT and OAuth implementations requires running targeted API security tests against authentication flows. This uses tools like jwt_tool to analyze tokens for vulnerabilities and verify authorization mechanisms.

Related Skills

Explore More Software Engineering Skills→
xloxn69xloxn69
7

api-documentation-generator

Generate OpenAPI 3.0 YAML/JSON specifications for REST API endpoints.

Community
Basic
kaivyykaivyy
66

perseus-api

Identify and remediate API security vulnerabilities across REST, GraphQL, WebSocket, and gRPC endpoints.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
sky770825sky770825

Security Scanner

Scans public Git repositories for known vulnerabilities using the Burp Suite tool.

Community
Basic