property-scan

Derive and test API endpoint invariants to detect business-logic vulnerabilities.

1|Updated Mar 20, 2026

Search Tags:#automation #testing #security #vulnerability #api #invariant

Ready to run

npx skills add https://github.com/enderphan94/pentest-kit --skill property-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: property-scan
Source: https://github.com/enderphan94/pentest-kit/tree/main/skills/property-scan
Command: npx skills add https://github.com/enderphan94/pentest-kit --skill property-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables security testers and developers to find business-logic vulnerabilities in API endpoints by automatically deriving and testing invariants.

Core Features & Use Cases

Invariant Discovery: Derives invariants such as round-trip consistency, ownership boundaries, idempotency, and rate-limit enforcement for API endpoints.
Automated Testing: Generates adversarial inputs based on derived invariants and verifies if API responses violate expected behaviors.
Use Case: During API security assessments, automatically identify potential bypasses or inconsistency bugs in web services, saving manual effort and increasing coverage.

Quick Start

Run the property-scan skill to test a list of API endpoints for invariant violations using your API URL.

Frequently Asked Questions about property-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate testing for API business-logic vulnerabilities?▼

You can automate API business-logic vulnerability testing by deriving invariants like round-trip consistency and idempotency, then generating adversarial inputs to verify if API responses violate expected behaviors.

What is API invariant testing and how does it find security flaws?▼

API invariant testing discovers security flaws by establishing expected behavioral rules like ownership boundaries and rate-limit enforcement, then automatically verifying if the API response violates these constraints under adversarial conditions.

Can I automatically detect API rate-limiting and idempotency issues?▼

Yes, you can automatically detect API rate-limiting and idempotency issues by deriving these specific behaviors as invariants and testing the endpoints with generated adversarial inputs to identify inconsistencies or bypasses.

Do I need scripting to test API endpoints for ownership boundary breaches?▼

Yes, testing API endpoints for ownership boundary breaches requires scripting and request logic to effectively derive the expected invariants and generate the adversarial inputs needed to verify compliance.

What's the best way to find inconsistencies in web services during a security audit?▼

The best way to find inconsistencies during a security audit is to automatically derive and test API invariants, which identifies potential bypasses and business-logic bugs while increasing assessment coverage and saving manual effort.