skills.rest
kalshamsi
kalshamsiCOMMUNITY
Explore all skills by this author →
GitHub

api-security-tester

Detect API security weaknesses in REST and GraphQL code mapped to OWASP API Top 10:2023.

1|Updated Mar 25, 2026
Search Tags:#security#api#audit#rest#graphql#static-analysis#owasp-api-top-10
One-click install
npx skills add https://github.com/kalshamsi/claude-security-skills --skill api-security-tester
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security-tester
Source: https://github.com/kalshamsi/claude-security-skills/tree/main/skills/api-security-tester
Command: npx skills add https://github.com/kalshamsi/claude-security-skills --skill api-security-tester

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security and development teams identify and remediate vulnerabilities in REST and GraphQL APIs by mapping findings to CWE and the OWASP API Security Top 10:2023.

Core Features & Use Cases

  • Static code analysis across JavaScript/TypeScript (Express, Fastify, NestJS), Python (Flask, Django, FastAPI), Go, and Java (Spring Boot) to discover API security issues.
  • Findings are mapped to CWE IDs and OWASP API Top 10:2023 categories with remediation guidance and safe-fix examples.
  • Use Case: integrate into code reviews and CI pipelines to catch broken authentication, authorization flaws, misconfigurations, and insecure API patterns before deployment.

Quick Start

Analyze a sample API project by running the checks to generate a prioritized findings report.

Frequently Asked Questions about api-security-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit REST and GraphQL APIs for OWASP Top 10 vulnerabilities?▼

Static analysis detects vulnerable patterns in API route handlers and middleware, mapping findings to CWE categories and OWASP API Top 10:2023 to output a structured security report with remediation guidance.

Can I scan Spring Boot and FastAPI codebases for broken authentication flaws?▼

Yes, language-agnostic static pattern matching detects authentication and authorization flaws across Spring Boot, FastAPI, Express, Django, NestJS, and other web frameworks.

Does static API security analysis work with JavaScript and Python projects?▼

Static API security analysis works with JavaScript/TypeScript and Python projects by scanning route handlers and configurations in frameworks like Express, Fastify, NestJS, Flask, Django, and FastAPI to discover security issues.

What is the best way to integrate API security checks into CI pipelines?▼

The best way to integrate API security checks into CI pipelines is running static analysis on codebases containing route handlers and middleware to catch misconfigurations and insecure patterns during development and PR cycles.

How does static code analysis map insecure API patterns to CWE categories?▼

Static code analysis maps insecure API patterns to CWE categories by applying language-agnostic pattern matching to detect vulnerable route handlers and configurations, generating a prioritized findings report with safe-fix examples.

Related Skills

Explore More Software Engineering Skills→
OirancaOiranca

route-mapper

Map application routes from framework conventions into a route inventory.

Community
Intermediate
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
ysyecustysyecust
40

verification-loop

Automate end-to-end project verification across builds, type checks, linting, tests, and security scans.

Community
Intermediate
philo-grovesphilo-groves
12

maxtac-sast-opengrep

Author and execute OpenGrep rules for static application security testing.

Community
Advanced