Skip to content
cccskills
FreePublished on GitHub

pentest-api-attacker

Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.

The English summary is being prepared. Showing the original description.

See how to install

Files included (5)

  • SKILL.md1.3 KB
  • agents/openai.yaml287 B
  • assets/.gitkeep0 B
  • references/tools.md288 B
  • scripts/api_attacker.py3.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Pentest API Attacker

Stage

  • PTES: 5
  • MITRE: T1190

Objective

Enumerate and test API endpoints and business logic attack vectors.

Required Workflow

  1. Validate scope before any active action and reject out-of-scope targets.
  2. Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.
  3. Write findings in canonical finding_schema format with reproducible PoC notes.
  4. Honor dry-run mode and require explicit --i-have-authorization for live execution.
  5. Export deterministic artifacts for downstream skill consumption.

Execution

python skills/pentest-api-attacker/scripts/api_attacker.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run

Outputs

  • api-endpoints.json
  • api-findings.json
  • api-attack-report.json

References

  • references/tools.md
  • skills/autonomous-pentester/shared/scope_schema.json
  • skills/autonomous-pentester/shared/finding_schema.json

Legal and Ethical Notice

WARNING AUTHORIZED USE ONLY
This skill executes real security testing tools against live targets.
Use only with written authorization.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Scaffold MCP server projects and baseline tool contract checks. Use for defining tool schemas, generating starter server layouts, and validating MCP-ready structure.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

Generate reusable multi-step agent workflow blueprints. Use for trigger/action orchestration, deterministic workflow definitions, and automation handoff artifacts.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

Prioritize vulnerability remediation using KEV-style exploitation context plus asset criticality. Use for CVE triage, patch order decisions, and remediation reporting.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

Build transformer fine-tuning run plans with task settings, hyperparameters, and model-card outputs. Use for repeatable Hugging Face or PyTorch finetuning workflows.

The English summary is being prepared. Showing the original description.

0x-Professor/Agent-Skills-Hub11Updated Feb 27, 2026

See all skills by 0x-Professor

Report a problem with this skill