Assess REST and GraphQL API security through checks of authentication, access permissions, input validation, and request limits. The workflow guides endpoint discovery, testing, and documentation of findings and remediation within an authorized scope.
API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
Review the instructions the agent will receive before you install.
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
Use this workflow when:
Select approved phases and test accounts; do not dispatch every listed skill automatically. Use owned fixtures for destructive methods, injections, brute-force, resource exhaustion and deep/complex GraphQL requests. Define request, concurrency, byte and duration limits, stop conditions and cleanup before testing. Keep third-party systems and real customer data out of tests. Public schemas, missing headers and an HTTP success response alone do not prove an authorization flaw or exploitable limit bypass. Record untested endpoints and observed impact instead of checking “all endpoints tested” by assumption.
api-fuzzing-bug-bounty - API fuzzingscanning-tools - API scanningUse @api-fuzzing-bug-bounty to discover API endpoints
broken-authentication - Auth testingapi-security-best-practices - API authUse @broken-authentication to test API authentication
idor-testing - IDOR testingUse @idor-testing to test API authorization
api-fuzzing-bug-bounty - API fuzzingsql-injection-testing - Injection testingUse @api-fuzzing-bug-bounty to fuzz API parameters
api-security-best-practices - Rate limitingUse @api-security-best-practices to test rate limiting
api-fuzzing-bug-bounty - GraphQL fuzzingUse @api-fuzzing-bug-bounty to test GraphQL security
api-security-best-practices - Error handlingUse @api-security-best-practices to audit API error handling
security-audit - Security auditingweb-security-testing - Web securityapi-design-principles - API contract designNo reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Assess a new or existing AI project by examining its code, goals, and constraints. Recommend skills confirmed to exist in the available registry, then outline tasks and implementation phases with dependencies, completion criteria, and checks.
Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.
Turn a repeatable task into an Andru.ia skill with clear inputs, outputs, examples, and limits. Draft SKILL.md, check the folder structure and required validations, and prepare a pull request describing the changes for review.
Prepare an industry briefing once a project's sector is defined. It covers sector context, potentially applicable regulations, familiar interface patterns, technology choices, and risks, while separating verified evidence from hypotheses and questions requiring further review.
Create presentation drafts from text, outlines, or documents through the 2slides API. Match a reference image's style, choose themes, add AI voice narration, and export slide images or audio for review and use.
Plan a 360-degree or peer feedback process and create empty response templates from confirmed requirements. Produces consistent CSV, SQL, JSON Schema, or Notion property mappings while keeping visibility choices and scoring configuration separate.