skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

api-security

Review REST and GraphQL APIs against OWASP API Security Top 10:2023.

44|128|Updated Mar 6, 2026
Search Tags:#authorization#owasp#threat modeling#graphql#api security#cwe mapping#owasp api security top 10
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill api-security-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/appsec/api-security
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill api-security-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps you reliably find and prioritize API security weaknesses by evaluating REST and GraphQL implementations against the OWASP API Security Top 10:2023 with consistent, auditable output.

Core Features & Use Cases

  • Framework-grounded API findings (API1–API10): Produces findings mapped to the OWASP API Security Top 10:2023 risk categories, including severity and CWE identifiers.
  • Coverage across common API weaknesses: Reviews object-level and function-level authorization, authentication issues, resource consumption controls, SSRF vectors, security misconfiguration signals, and unsafe upstream API/data consumption.
  • Actionable remediation output: Requires structured evidence and remediation guidance, with an explicit findings schema (ID, Location, Evidence, Remediation, Status).
  • GraphQL-specific hardening: Includes guidance for introspection exposure, query depth/complexity abuse, resolver-level authorization, and alias-based attacks.

Quick Start

Run the api-security skill on your OpenAPI spec or API codebase and ask for an OWASP API Security Top 10:2023 mapped report with prioritized remediation steps.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review my OpenAPI spec for OWASP API Security Top 10 vulnerabilities?▼

You can review OpenAPI specifications by inventorying endpoints and authorization models, then evaluating each API1–API10 risk category to produce mapped findings with severity, CWE, and remediation details.

What is the best way to check GraphQL APIs for broken authorization and resource consumption issues?▼

Checking GraphQL APIs involves evaluating resolver-level authorization, introspection exposure, query depth and complexity abuse, and alias-based attacks against the OWASP API Security Top 10:2023 standard.

Can I use an API security review to map threats to CWE identifiers?▼

Yes, an API security review maps discovered threats to CWE identifiers, providing structured evidence and explicit remediation guidance for risks like broken authentication, SSRF, and unsafe API consumption.

Does API threat modeling cover Broken Object Level Authorization and SSRF vectors?▼

API threat modeling covers Broken Object Level Authorization, function-level authorization variants, SSRF vectors, security misconfigurations, and resource consumption controls to ensure comprehensive API endpoint protection.

How to generate an actionable API security remediation report from source code?▼

Generating an actionable remediation report from source code requires evaluating endpoint implementations against OWASP risks, outputting structured findings with location, evidence, remediation steps, and status.

Related Skills

Explore More Software Engineering Skills→
thimsluggathimslugga

api-documentation-generator

Generate API documentation with endpoints, schemas, and examples from source code.

Community
Intermediate
josavicentevwjosavicentevw
1

devsecops

Automate security scanning and governance across CI/CD pipelines and compliance workflows.

Community
Advanced
florianbuetowflorianbuetow
12

pasta-vulns

Scan code and dependencies for vulnerabilities mapped to CWEs.

Community
Advanced
foreverjojoforeverjojo

code_reviewer

Analyze Python files for API key leaks, file length limits, and Chinese comments.

Official
Basic