skills.rest
Kisilev13
Kisilev13COMMUNITY
Explore all skills by this author →
GitHub

hunt-api-misconfig

Detect API security misconfigurations including mass assignment, JWT attacks, and CORS issues.

Updated Jun 18, 2026
Search Tags:#API security#CORS#mass assignment#misconfiguration detection#JWT attack
One-click install
npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-api-misconfig-kisilev13
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-api-misconfig
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/hunt-api-misconfig
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-api-misconfig-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill unit helps identify and mitigate common API security misconfigurations, such as mass assignment, JWT attacks, prototype pollution, CORS issues, and HTTP verb tampering.

Core Features & Use Cases

  • Mass Assignment Detection: Identifies mass assignment vulnerabilities in API endpoints.
  • JWT Attack Detection: Detects JWT vulnerabilities like weak HMAC, token confusion, and path traversal.
  • Prototype Pollution Detection: Identifies prototype pollution vulnerabilities in JSON merge and object assignment.
  • CORS Exploitation Detection: Detects CORS misconfigurations like wildcard with credentials and null origin.
  • HTTP Verb Tampering Detection: Identifies GET-bypass-CSRF, X-HTTP-Method-Override, and TRACE enabled issues.
  • Use Case: For security auditors and developers who need to ensure API security and compliance.

Quick Start

Use the 'hunt-api-misconfig' skill to scan your API for common security misconfigurations.

Frequently Asked Questions about hunt-api-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect API security misconfigurations like mass assignment and CORS issues?▼

To detect API security misconfigurations, you analyze API responses and headers to identify vulnerabilities like mass assignment and CORS issues. This process applies directly to security audits and development workflows.

What is a JWT attack and how does it affect API security?▼

A JWT attack targets JSON Web Token vulnerabilities, including weak HMAC, token confusion, and path traversal. Detecting these API security misconfigurations requires analyzing token handling within your API endpoints during security audits.

How can I test for prototype pollution in JSON merge and object assignment?▼

Testing for prototype pollution involves identifying vulnerabilities in JSON merge and object assignment operations. This API security check helps mitigate misconfigurations that could compromise your application during development workflows.

Does this API security audit approach detect HTTP verb tampering and CSRF bypasses?▼

Yes, detecting HTTP verb tampering identifies GET-bypass-CSRF, X-HTTP-Method-Override, and TRACE enabled issues. Analyzing API responses and headers exposes these API security misconfigurations for mitigation.

Can I scan my existing development workflows for CORS misconfigurations?▼

Yes, you can scan existing development workflows for CORS misconfigurations by analyzing API responses and headers. This identifies wildcard with credentials and null origin issues, ensuring API security and compliance.

Related Skills

Explore More Software Engineering Skills→
k1lgork1lgor
2

api-designer

Standardize REST and GraphQL API designs with routes, schemas, and OpenAPI specifications.

Community
Intermediate
sandeepmvlsandeepmvl
21

rails-security-baseline

Audit Rails 8 code for security vulnerabilities against OWASP Top 10.

Community
Advanced
ericwang915ericwang915
38

http_request

Perform HTTP requests to any API endpoint with custom headers and JSON payloads.

Community
Intermediate
stephanjstephanj
9

security-reviewer

Conducts security audits and vulnerability assessments on codebases and infrastructure.

Community
Advanced