testing-apis

Identify and exploit API security weaknesses across REST and GraphQL endpoints.

109|11|Updated Nov 13, 2025

Search Tags:#authorization #rest #graphql #api-security #api-testing #fuzzing #auth-testing

Ready to run

npx skills add https://github.com/trilwu/secskills --skill testing-apis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: testing-apis
Source: https://github.com/trilwu/secskills/tree/main/secskills/skills/api-security-testing
Command: npx skills add https://github.com/trilwu/secskills --skill testing-apis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

REST and GraphQL API testing to identify authentication bypass, authorization flaws, IDOR, mass assignment, injection, and rate-limiting weaknesses across services.

Core Features & Use Cases

API endpoint discovery and reconnaissance for REST/GraphQL services
REST API testing: authentication, authorization, method abuse, and rate limiting
GraphQL testing: introspection checks, payload-based testing, and vulnerability probing
Authorization testing: horizontal/vertical privilege escalation and function-level access
Fuzzing, injection attacks, and excessive data exposure checks
API documentation analysis and vulnerability assessment

Quick Start

Initiate API security testing by specifying a target API and requesting endpoint discovery, vulnerability probing, and documentation review.

Frequently Asked Questions about testing-apis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test REST and GraphQL APIs for authentication and authorization vulnerabilities?▼

API security testing for REST and GraphQL involves identifying authentication bypass, authorization flaws, IDOR, mass assignment, injection, and rate-limiting weaknesses across services through endpoint discovery and payload probing.

How can I find IDOR and mass assignment flaws in microservices?▼

Finding IDOR and mass assignment flaws in microservices requires horizontal and vertical privilege escalation testing, validating function-level access controls, and fuzzing inputs to detect excessive data exposure across service endpoints.

Does this API pentesting approach work for cloud-native applications?▼

API pentesting applies directly to cloud-native apps, microservice security testing, and web services requiring authenticated sessions, validating input validation and rate limiting across distributed REST and GraphQL endpoints.

What is the best way to perform GraphQL introspection and vulnerability probing?▼

The best way to perform GraphQL introspection and vulnerability probing is to execute payload-based testing checks against the schema, probing for excessive data exposure and authorization weaknesses within the queries.

Can I use API documentation analysis to discover hidden endpoint vulnerabilities?▼

API documentation analysis helps discover hidden endpoint vulnerabilities by reviewing specifications to identify undocumented routes, assess input validation gaps, and guide targeted fuzzing attacks against REST and GraphQL services.