Identify API endpoints and insecure patterns in REST and GraphQL services.
npx skills add https://github.com/n4igme/randscript --skill vuln-api
Please help me install this Agent Skill. Skill: vuln-api Source: https://github.com/n4igme/randscript/tree/main/llm/skills/scode/vuln-api Command: npx skills add https://github.com/n4igme/randscript --skill vuln-api
This skill helps security teams and developers identify API-specific vulnerabilities in REST and GraphQL services, reducing the time and effort required to discover misconfigurations and insecure patterns.
Use vuln-api to scan your API threat model and reconnaissance notes, and append the vulnerabilities to ./assessment/vulnerabilities.md.
High-intent search queries and answers about installing and using this skill.
To find API vulnerabilities, scan API endpoints and request/response surfaces to identify insecure patterns like mass assignment, excessive data exposure, and broken function-level authorization. This approach prioritizes threat-model and recon findings to locate risks safely.
Detecting GraphQL API security issues involves applying pattern-based scanning to request and response surfaces to surface GraphQL-specific vulnerabilities and excessive data exposure. It prioritizes threat-model and recon findings to locate insecure patterns effectively.
Scanning REST APIs for weak rate limiting requires identifying API endpoints and their request/response surfaces to surface misconfigurations. You must verify the presence of threat-model.md and recon.md before reporting weak rate limiting or other insecure patterns.
Yes, you need threat-model.md and recon.md files before testing for API vulnerabilities. The skill verifies the presence of these files to prioritize threat-model and recon findings, ensuring accurate reporting of mass assignment risks and authorization issues.
Yes, you can use this approach for bug bounty reconnaissance on REST and GraphQL APIs. It applies pattern-based scanning to identify insecure patterns and appends discovered vulnerabilities to an assessment file for audit and reporting.
Limitations when scanning APIs for insecure patterns include the strict requirement to verify threat-model.md and recon.md before reporting. It also requires explicit input filtering, output sanitization, and proper authorization checks to avoid false positives.
n4igmeDetect authentication and session management flaws from threat-model.md and recon.md.
narlyseorgIdentify and assess API security vulnerabilities across REST, GraphQL, gRPC, WebSocket, and SOAP endpoints.
trilwuIdentify and exploit API security weaknesses across REST and GraphQL endpoints.
brucesongsTest API security weaknesses across REST, GraphQL, and gRPC.
