What problem does it solve? APIs often lack enforced server-side limits on pagination, batch operations, exports, search complexity, and async jobs, leaving them open to resource abuse. This Skill provides a disciplined, authorization-gated workflow to verify whether those quota and cost controls actually exist, without performing denial-of-service testing. ## Core Features & Use Cases - Evidence-Gated Validation: Follows a fixed baseline → single-variable probe → post-baseline → oracle → evidence pipeline so every finding is backed by observable server behavior. - Abuse Surface Coverage: Targets pagination limits, batch sizes, GraphQL complexity hints, export jobs, search endpoints, and async task queues using only self-owned accounts and test data. - Strict Stop Conditions: Halts immediately on third-party data exposure, shared infrastructure impact, or irreversible side effects, and routes specialized cases to ReDoS, GraphQL, or rate-limit skills. - Use Case: During an authorized assessment, you suspect an export endpoint accepts arbitrarily large batch requests. Use this Skill to plan minimal no-op probes that compare server acceptance against documented quotas and record the evidence. ## Quick Start Use $hunt-api-abuse to plan an evidence-gated, authorized validation of quota controls on my API's batch and export endpoints.
