api-token-sec

Name: api-token-sec
Availability: InStock
Author: Q16G

Detect API token, CORS, and JWT security weaknesses in REST APIs.

83|8|Updated May 6, 2026

Search Tags:#jwt #api-security #cors #pentest #token-security #vulnerability-testing

Ready to run

npx skills add https://github.com/Q16G/aster --skill api-token-sec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-token-sec
Source: https://github.com/Q16G/aster/tree/main/skills/pentest/api-token-sec
Command: npx skills add https://github.com/Q16G/aster --skill api-token-sec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams and developers identify API token handling weaknesses, misconfigurations in CORS, and JWT vulnerabilities across API endpoints.

Core Features & Use Cases

CORS misconfiguration detection for REST APIs and services with Bearer tokens.
JWT weakness testing, including weak signing keys and misclaims.
Deterministic, modular evaluation flow that loads and runs sub-skills to validate protections.
Use Case: when securing public and internal APIs, you can quickly assess token handling, cross-origin policies, and access controls and produce actionable remediation steps.

Quick Start

Provide a target API URL to begin a focused API-token security assessment.

Frequently Asked Questions about api-token-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test JWT tokens for weak signing keys?▼

To test JWT tokens for weak signing keys, decode tokens, inspect claims, and apply tests against HS256-like algorithms to detect weak-key scenarios. This skill validates results by testing protected resources with Bearer tokens.

What is CORS misconfiguration detection for REST APIs?▼

CORS misconfiguration detection identifies cross-origin policy weaknesses in REST APIs and microservices using Bearer tokens. It applies tests to evaluate cross-origin policies and produce actionable remediation steps.

How do I audit API token security for microservices?▼

Auditing API token security for microservices requires providing a target API URL to run a focused assessment. This identifies token handling weaknesses, misconfigurations, and weak-key scenarios across endpoints.

Can I use this to enumerate API token vulnerabilities in target services?▼

Yes, you can enumerate API token vulnerabilities in target services. It identifies and enumerates security weaknesses in API tokens, CORS, and JWT configurations across target services.

What's the best way to detect misconfigurations in JWT claims?▼

The best way to detect misconfigurations in JWT claims is to decode tokens and inspect claims for misclaims. This skill applies deterministic, modular evaluation flows to validate protection and detect weaknesses.

Does API token security testing require specific dependencies?▼

API token security testing does not require specific dependencies. It uses a modular evaluation flow that loads and runs sub-skills to validate protections and generate remediation steps.