skills.rest
cmaenner
cmaennerCOMMUNITY
Explore all skills by this author →
Website𝕏@dafingaGitHub

api-security-review

Review API specifications against the OWASP API Security Top 10.

5|1|Updated Mar 5, 2026
Search Tags:#authorization#authentication#owasp#vulnerability assessment#penetration testing#api security
One-click install
npx skills add https://github.com/cmaenner/agent-security-playbook --skill api-security-review-cmaenner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security-review
Source: https://github.com/cmaenner/agent-security-playbook/tree/main/skills/api-security-review
Command: npx skills add https://github.com/cmaenner/agent-security-playbook --skill api-security-review-cmaenner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for comprehensive security assessments of APIs, protecting against common vulnerabilities that can lead to data breaches and system compromise.

Core Features & Use Cases

  • OWASP API Security Top 10 Coverage: Systematically reviews APIs against the latest OWASP API Security Top 10 risks.
  • Authentication & Authorization Testing: Deep dives into JWT, OAuth, API keys, and checks for Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA).
  • Use Case: Audit a newly developed e-commerce API to ensure that users can only access their own order data (BOLA) and that unauthenticated users cannot access sensitive endpoints.

Quick Start

Use the api-security-review skill to audit the provided OpenAPI specification for security vulnerabilities.

Frequently Asked Questions about api-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my OpenAPI specification for OWASP API security vulnerabilities?▼

To conduct an API security review, provide your OpenAPI/Swagger specification to systematically identify vulnerabilities like BOLA, broken authentication, and mass assignment against the OWASP API Security Top 10 standard.

What is broken object level authorization and how do I test for it in REST APIs?▼

Broken Object Level Authorization (BOLA) allows users to access unauthorized data. You can test for BOLA and Broken Function Level Authorization (BFLA) by analyzing REST implementations to validate authentication mechanisms and endpoint access controls.

Can I perform penetration testing on GraphQL and gRPC implementations?▼

Yes, you can perform penetration testing on GraphQL and gRPC implementations. The security review analyzes these specific architectures alongside REST APIs to identify misconfigurations, rate limiting issues, and SSRF vulnerabilities.

Does this API security audit cover JWT and OAuth authentication mechanisms?▼

Yes, the API security audit validates authentication mechanisms by deep diving into JWT, OAuth, and API keys to detect broken authentication vulnerabilities and ensure proper access management across your endpoints.

How do I detect rate limiting issues and resource consumption abuse in my APIs?▼

You can detect rate limiting issues and resource consumption abuse by analyzing API gateway configurations. This process identifies business flow abuse and misconfigurations that could lead to system compromise or denial of service.

What is the best way to secure an e-commerce API against mass assignment vulnerabilities?▼

The best way to secure an e-commerce API is to conduct a comprehensive vulnerability assessment against the OWASP API Security Top 10, analyzing OpenAPI specifications to identify and remediate mass assignment and authorization flaws.

Related Skills

Explore More Software Engineering Skills→
wfukatsuwfukatsu
8

design-api

Generate REST, GraphQL, gRPC, and AsyncAPI specifications for microservices.

Community
Advanced
OpenLaborOpenLabor
4

API Design

Design RESTful APIs with OpenAPI documentation, versioning, pagination, and error codes.

Official
Intermediate
AeonDaveAeonDave
15

wireshark

Capture and inspect network packets for credential extraction and anomaly detection.

Community
Intermediate
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate