security-app-api

Assess REST, GraphQL, and gRPC APIs against OWASP API Security Top 10:2023.

Updated May 28, 2026
One-click install
npx skills add https://github.com/SensLiao/Claude-code-setting --skill security-app-api
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-app-api
Source: https://github.com/SensLiao/Claude-code-setting/tree/main/skills/security-app-api
Command: npx skills add https://github.com/SensLiao/Claude-code-setting --skill security-app-api

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill performs comprehensive security reviews of API endpoints, focusing on compliance with OWASP API Security Top 10:2023 standards.

Core Features & Use Cases

  • API Security Review: Checks endpoints for OWASP API Security Top 10 vulnerabilities (e.g., BOLA, Broken Authentication, Excessive Data Exposure).
  • Custom Triggers: Automatically activates when specific conditions are met, like endpoint creation or update.
  • Inventory Management: Ensures proper versioning, deprecation, and shadow endpoints are managed.
  • Use Case: For an e-commerce platform, use this Skill to scan REST, GraphQL, and gRPC APIs to identify and mitigate common security flaws before release.

Quick Start

To begin, trigger an API security review on all endpoints of the service 'example-service'.

Frequently Asked Questions about security-app-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate API security review for OWASP API Security Top 10:2023?

Automate API security review by triggering non-intrusive security assessments on REST, GraphQL, and gRPC endpoints to validate compliance with OWASP API Security Top 10:2023 standards and ASVS v5.0 requirements.

Can I check GraphQL and gRPC endpoints for BOLA and broken authentication vulnerabilities?

Yes, you can check GraphQL and gRPC endpoints for BOLA, broken authentication, and excessive data exposure by executing non-intrusive security assessments mapped to the OWASP API Security Top 10:2023.

Does API security compliance scanning require active exploitation of endpoints?

No, API security compliance scanning does not require active exploitation. The review process ensures adherence to ASVS v5.0 security requirements through non-intrusive security assessments without directly attacking the endpoints.

How do I manage shadow endpoints and API versioning during security assessments?

Manage shadow endpoints and API versioning during security assessments by utilizing inventory management features that ensure proper versioning, deprecation tracking, and endpoint protection compliance across the reviewed services.

What is the best way to ensure endpoint protection before an e-commerce API release?

The best way to ensure endpoint protection before an e-commerce API release is to scan REST, GraphQL, and gRPC APIs to identify and mitigate common OWASP API Security Top 10 flaws, ensuring complete security compliance.

Can I trigger API security assessments automatically when an endpoint is created or updated?

Yes, you can trigger API security assessments automatically by setting custom triggers that activate non-intrusive security reviews whenever specific conditions like endpoint creation or update events are met.