api-security-testing
API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
- License 许可
- MIT
- 最近更新
- 2026-11-11
- Stars
- ★ 3.3w
- Forks
- 3.9k
01 前言 Front Matter
- name
- api-security-testing
- metadata
- { "risk": "safe", "source": "personal", "category": "granular-workflow-bundle", "date_added": "2026-02-27" }
- description
- API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
03 SKILL.md 正文
API Security Testing Workflow
Overview
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
When to Use This Workflow
Use this workflow when:
- Testing REST API security
- Assessing GraphQL endpoints
- Validating API authentication
- Testing API rate limiting
- Bug bounty API testing
Workflow Phases
Phase 1: API Discovery
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingscanning-tools- API scanning
Actions
- Enumerate endpoints
- Document API methods
- Identify parameters
- Map data flows
- Review documentation
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to discover API endpoints
Phase 2: Authentication Testing
Skills to Invoke
broken-authentication- Auth testingapi-security-best-practices- API auth
Actions
- Test API key validation
- Test JWT tokens
- Test OAuth2 flows
- Test token expiration
- Test refresh tokens
Copy-Paste Prompts
Use @broken-authentication to test API authentication
Phase 3: Authorization Testing
Skills to Invoke
idor-testing- IDOR testing
Actions
- Test object-level authorization
- Test function-level authorization
- Test role-based access
- Test privilege escalation
- Test multi-tenant isolation
Copy-Paste Prompts
Use @idor-testing to test API authorization
Phase 4: Input Validation
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingsql-injection-testing- Injection testing
Actions
- Test parameter validation
- Test SQL injection
- Test NoSQL injection
- Test command injection
- Test XXE injection
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API parameters
Phase 5: Rate Limiting
Skills to Invoke
api-security-best-practices- Rate limiting
Actions
- Test rate limit headers
- Test brute force protection
- Test resource exhaustion
- Test bypass techniques
- Document limitations
Copy-Paste Prompts
Use @api-security-best-practices to test rate limiting
Phase 6: GraphQL Testing
Skills to Invoke
api-fuzzing-bug-bounty- GraphQL fuzzing
Actions
- Test introspection
- Test query depth
- Test query complexity
- Test batch queries
- Test field suggestions
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to test GraphQL security
Phase 7: Error Handling
Skills to Invoke
api-security-best-practices- Error handling
Actions
- Test error messages
- Check information disclosure
- Test stack traces
- Verify logging
- Document findings
Copy-Paste Prompts
Use @api-security-best-practices to audit API error handling
API Security Checklist
- [ ] Authentication working
- [ ] Authorization enforced
- [ ] Input validated
- [ ] Rate limiting active
- [ ] Errors sanitized
- [ ] Logging enabled
- [ ] CORS configured
- [ ] HTTPS enforced
Quality Gates
- [ ] All endpoints tested
- [ ] Vulnerabilities documented
- [ ] Remediation provided
- [ ] Report generated
Related Workflow Bundles
security-audit- Security auditingweb-security-testing- Web securityapi-development- API development
04 同仓库更多 Skills
wealthville-pool-scoring
Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter/Hold/Exit/Reduce/Avoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.
technical-debt-auditor
Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO/FIXME/HACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like "where should I focus refactoring", "find code smells", "audit my codebase", "what technical debt do we have", "prioritize cleanup work", or asks about code quality metrics. Also trigger when the user mentions "code rot", "legacy cleanup", "refactoring priorities", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say "technical debt" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.
readonly-sql-guard
Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production/ERP/analytics database (a "query" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write/DDL/side-effect/transaction-escape risks. Checks what a statement CALLS, not just its shape.
web-artifacts-builder
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
discernment-nudge
After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.