api-security-tester

Detect API security weaknesses in REST and GraphQL code mapped to OWASP API Top 10:2023.

1|Updated Mar 25, 2026

Search Tags:#security #api #audit #rest #graphql #static-analysis #owasp-api-top-10

Ready to run

npx skills add https://github.com/kalshamsi/claude-security-skills --skill api-security-tester

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-security-tester
Source: https://github.com/kalshamsi/claude-security-skills/tree/main/skills/api-security-tester
Command: npx skills add https://github.com/kalshamsi/claude-security-skills --skill api-security-tester

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security and development teams identify and remediate vulnerabilities in REST and GraphQL APIs by mapping findings to CWE and the OWASP API Security Top 10:2023.

Core Features & Use Cases

Static code analysis across JavaScript/TypeScript (Express, Fastify, NestJS), Python (Flask, Django, FastAPI), Go, and Java (Spring Boot) to discover API security issues.
Findings are mapped to CWE IDs and OWASP API Top 10:2023 categories with remediation guidance and safe-fix examples.
Use Case: integrate into code reviews and CI pipelines to catch broken authentication, authorization flaws, misconfigurations, and insecure API patterns before deployment.

Quick Start

Analyze a sample API project by running the checks to generate a prioritized findings report.

Frequently Asked Questions about api-security-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit REST and GraphQL APIs for OWASP Top 10 vulnerabilities?▼

Static analysis detects vulnerable patterns in API route handlers and middleware, mapping findings to CWE categories and OWASP API Top 10:2023 to output a structured security report with remediation guidance.

Can I scan Spring Boot and FastAPI codebases for broken authentication flaws?▼

Yes, language-agnostic static pattern matching detects authentication and authorization flaws across Spring Boot, FastAPI, Express, Django, NestJS, and other web frameworks.

Does static API security analysis work with JavaScript and Python projects?▼

Static API security analysis works with JavaScript/TypeScript and Python projects by scanning route handlers and configurations in frameworks like Express, Fastify, NestJS, Flask, Django, and FastAPI to discover security issues.

What is the best way to integrate API security checks into CI pipelines?▼

The best way to integrate API security checks into CI pipelines is running static analysis on codebases containing route handlers and middleware to catch misconfigurations and insecure patterns during development and PR cycles.

How does static code analysis map insecure API patterns to CWE categories?▼

Static code analysis maps insecure API patterns to CWE categories by applying language-agnostic pattern matching to detect vulnerable route handlers and configurations, generating a prioritized findings report with safe-fix examples.