skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

detecting-shadow-api-endpoints

Detect undocumented API endpoints by comparing observed traffic against OpenAPI specifications.

2|Updated Apr 14, 2026
Search Tags:#openapi#api-security#log-analysis#threat-hunting#api-discovery#attack-surface-management#shadow-apis
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill detecting-shadow-api-endpoints
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-shadow-api-endpoints
Source: https://github.com/Acczdy/MoZiSec/tree/main/api-security/.claude/skills/detecting-shadow-api-endpoints
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill detecting-shadow-api-endpoints

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Shadow and undocumented API endpoints create hidden attack surfaces by operating outside of documentation and governance, allowing unauthenticated or poorly monitored access that can lead to data exposure and unauthorized actions. This Skill provides a structured approach to discover, inventory, and prioritize those endpoints so teams can close gaps in API visibility and monitoring.

Core Features & Use Cases

  • Traffic vs Specification Comparison: Align observed API traffic with OpenAPI/Swagger specs to flag undocumented paths and parameterized routes.
  • Repository and Cloud Mining: Find route definitions in source code and enumerate cloud API gateway, Lambda URLs, and ALB rules to detect orphaned or legacy endpoints.
  • Risk Scoring & Reporting: Classify endpoints by authentication presence, traffic volume, status codes, and sensitive path patterns and produce a consolidated report for SOC or DevSecOps remediation.
  • Use Case: A SOC analyst investigating suspicious API activity can run access log analysis, compare with exported OpenAPI specs, and generate a prioritized list of shadow endpoints for immediate mitigation.

Quick Start

Use this skill to scan your API access logs and OpenAPI specifications and produce a prioritized shadow API discovery report.

Frequently Asked Questions about detecting-shadow-api-endpoints

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find undocumented API endpoints in my access logs?▼

To detect shadow APIs, compare observed API traffic from access logs against exported OpenAPI specifications to identify undocumented paths and parameterized routes. This comparison flags active endpoints missing from your documentation.

What are shadow APIs and why do they create security risks?▼

Shadow APIs are undocumented endpoints operating outside governance, creating hidden attack surfaces that allow unauthenticated or poorly monitored access leading to data exposure. Discovering them involves inventorying active routes to close visibility gaps.

Can I use OpenAPI specifications to discover orphaned endpoints in cloud gateways?▼

Yes, you can enumerate cloud API gateway configurations, Lambda URLs, and ALB rules against OpenAPI specifications to detect orphaned endpoints. This requires optional cloud CLI tools to extract live configurations for comparison against documented specs.

How do I prioritize shadow API endpoints for SOC remediation?▼

Prioritize shadow API endpoints by classifying them based on authentication presence, traffic volume, status codes, and sensitive path patterns. This risk scoring generates a consolidated report for DevSecOps teams to target immediate mitigation.

Do I need Python to compare API traffic with OpenAPI specs?▼

Yes, you need a Python 3.8+ runtime to execute the bundled agent for comparing API traffic with OpenAPI specs. You also need access to web access logs and exported OpenAPI files to perform the shadow API analysis.

Related Skills

Explore More Software Engineering Skills→
delorenjdelorenj

skf-forger

Compile skills from code repositories, documentation, and developer discourse.

Community
Advanced
FaysilAlshareefFaysilAlshareef
4

scalar-docs

Configure gateway API endpoints with Scalar to centralize OpenAPI documentation and UI.

Community
Advanced
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
Muath2000Muath2000

attack-surface-analyst

Discover and monitor internet-facing assets for external attack surface management.

Community
Advanced