[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D22PFX5M4YNW6ZXRHEVDYF":3,"skill-same:01M6D22PFX5M4YNW6ZXRHEVDYF":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":55,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6D22PFX5M4YNW6ZXRHEVDYF","pentest-api",null,"Testing an authorized REST, GraphQL or gRPC API: object- and function-level authorization, injection, mass assignment, rate limiting and resource abuse, and token handling, working from the schema or observed traffic. Read before testing an API.","enowdev\u002Fenowxcli","enowdev","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F179420349?v=4","01M6D1MVX2KC0X3Z9NESE7P22K","Enow Dev.","01M6D1MW1FMZGBDKWAJY4GQX81",67,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fpentest-api\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44],"api","pentest","pentest api","testing","grpc","REST","GraphQL","authorization","injection","read","schema","token","rate limiting","2026-11-10 10:12:30",false,"---\nname: pentest-api\ndescription: \"Testing an authorized REST, GraphQL or gRPC API: object- and function-level authorization, injection, mass assignment, rate limiting and resource abuse, and token handling, working from the schema or observed traffic. Read before testing an API.\"\n---\n\n# API testing\n\nAPIs fail most often at authorization, because the client is no longer the\ngatekeeper. Test only authorized endpoints, with benign proofs.\n\n## Authorization (BOLA\u002FBFLA: the top API risks)\n\n- **Object level (BOLA\u002FIDOR):** call an endpoint with another object's id from\n  your own token. If you get data that is not yours, that is broken object-level\n  authorization, the most common API vulnerability.\n- **Function level (BFLA):** call admin or privileged operations from a normal\n  token. Try hidden and undocumented methods.\n\n## The rest\n\n- **Mass assignment:** send extra fields (`\"role\":\"admin\"`, `\"verified\":true`)\n  and see if the API binds them.\n- **Injection:** the same classes as web, plus NoSQL and GraphQL query abuse.\n- **Rate limiting and resource abuse:** unbounded page sizes, expensive GraphQL\n  queries, missing limits on costly endpoints. Prove the gap without actually\n  degrading the service.\n- **Tokens:** scope and audience enforcement, expiry, refresh-token reuse, JWT\n  algorithm and secret strength.\n\n## How\n\nWork from the schema (OpenAPI\u002FGraphQL introspection) or from observed traffic.\nEnumerate every operation and its parameters, then test each against the checks\nabove. Record confirmed issues with `report_finding`, with the exact request.\n\nSee also: [[pentest-web]], [[pentest-reporting]].\n","# API testing\n\nAPIs fail most often at authorization, because the client is no longer the\ngatekeeper. Test only authorized endpoints, with benign proofs.\n\n## Authorization (BOLA\u002FBFLA: the top API risks)\n\n- **Object level (BOLA\u002FIDOR):** call an endpoint with another object's id from\n  your own token. If you get data that is not yours, that is broken object-level\n  authorization, the most common API vulnerability.\n- **Function level (BFLA):** call admin or privileged operations from a normal\n  token. Try hidden and undocumented methods.\n\n## The rest\n\n- **Mass assignment:** send extra fields (`\"role\":\"admin\"`, `\"verified\":true`)\n  and see if the API binds them.\n- **Injection:** the same classes as web, plus NoSQL and GraphQL query abuse.\n- **Rate limiting and resource abuse:** unbounded page sizes, expensive GraphQL\n  queries, missing limits on costly endpoints. Prove the gap without actually\n  degrading the service.\n- **Tokens:** scope and audience enforcement, expiry, refresh-token reuse, JWT\n  algorithm and secret strength.\n\n## How\n\nWork from the schema (OpenAPI\u002FGraphQL introspection) or from observed traffic.\nEnumerate every operation and its parameters, then test each against the checks\nabove. Record confirmed issues with `report_finding`, with the exact request.\n\nSee also: [[pentest-web]], [[pentest-reporting]].\n",{"name":5,"description":7},"main","38293fe1b096e6bf3646c7344c38786ed688f464","crates\u002Fenowx-core\u002Fskills\u002Fpentest-api",21,"https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli","https:\u002F\u002Fenowx.ai","https:\u002F\u002Fgithub.com\u002Fenowdev","Pretending to be a Developer","2026-10-06 02:05:35",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add enowdev\u002Fenowxcli --skill pentest-api",{"tool":65,"command":66},"bunx","bunx skills add enowdev\u002Fenowxcli --skill pentest-api",{"tool":68,"command":69},"pnpm","pnpm dlx skills add enowdev\u002Fenowxcli --skill pentest-api","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fpentest-api\u002FSKILL.md",true,[73,79,83,87],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Ffiltering.md","REFERENCE","参考文档",10038,"https:\u002F\u002Fgithub.com\u002Ffadrienne\u002FMyGitHub\u002Fblob\u002Fmain\u002Fopenscience\u002Fbackend\u002Fcli\u002Fskills\u002Fchemistry\u002Fmatchms\u002Freferences\u002Ffiltering.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fimporting_exporting.md",10894,"https:\u002F\u002Fgithub.com\u002Ffadrienne\u002FMyGitHub\u002Fblob\u002Fmain\u002Fopenscience\u002Fbackend\u002Fcli\u002Fskills\u002Fchemistry\u002Fmatchms\u002Freferences\u002Fimporting_exporting.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fsimilarity.md",12974,"https:\u002F\u002Fgithub.com\u002Ffadrienne\u002FMyGitHub\u002Fblob\u002Fmain\u002Fopenscience\u002Fbackend\u002Fcli\u002Fskills\u002Fchemistry\u002Fmatchms\u002Freferences\u002Fsimilarity.md",{"path":88,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fworkflows.md",22230,"https:\u002F\u002Fgithub.com\u002Ffadrienne\u002FMyGitHub\u002Fblob\u002Fmain\u002Fopenscience\u002Fbackend\u002Fcli\u002Fskills\u002Fchemistry\u002Fmatchms\u002Freferences\u002Fworkflows.md",[92,106,129,145,170,192],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":101,"publishedAt":45},"01M6D2HQYSQD9N7MTNDT4A7CBM","demo-skill","Project-scope demo skill for tests.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fworkspace\u002F.agents\u002Fskills\u002Fdemo-skill\u002FSKILL.md",[98],{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[102,103,104,105,41],"demo skill","demo","tests","project",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":118,"publishedAt":45},"01M6D2HM0GCPM0TM2HPG9HHR2R","writing","Writing words people read: the specific thing instead of claims, words to drop, sentences, interface copy (buttons, labels, errors, empty states, confirmations), page copy, notifications and emails, alt text and link text, numbers and dates, words that translate well, documentation and voice. Read before writing a page's copy, an interface's text or a document.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fwriting\u002FSKILL.md",[112,115],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[108,119,120,121,122,123,41,124,125,126,127,128],"text","emails","empty","drop","document","page","voice","notifications","documentation","translate",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":138,"publishedAt":45},"01M6D2HG07YS49NM196Q0R3AZ8","ui","Designing or restyling an interface: direction, layout, type, colour, icons, components, states, responsive behaviour. Read before building a page, a screen or a set of components.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fui\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000032","设计师",[131,139,140,141,142,124,143,41,144],"icons","components","SET","responsive","layout","before building",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":155,"publishedAt":45},"01M6D2HB59HZHWG1RYZDV4SJ91","ui-themes","Light and dark themes, and colour that holds in both: tokens with a value per theme, and what each kind of content needs to stay visible (icons, SVG drawings and line art, logos, photos, screenshots, charts, code, maps, borders, shadows, focus, form controls), switching without a flash, and checking both. Read before building a second theme or a theme toggle, and before any drawing, logo or chart on a page that has two themes.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fui-themes\u002FSKILL.md",[151,154],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[131,156,157,158,159,160,161,162,163,41,144,164,124,165,166,167,139,168,169],"ui themes","switching","photos","tokens","drawing","focus","maps","Art","flash","code","Charts","content","screenshots","logo",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":179,"publishedAt":45},"01M6D2H5R5KRAE524C8QX0T7Q0","ui-structure","Structure before styling: the blueprint written before any interface code (the screen's job, the regions its kind of page needs, their order and why, the layout skeleton in numbers, the components and their states), the anatomy and order of a homepage, a dashboard, a list, a detail page, settings, a form, sign-in, pricing, docs, an article and a checkout, and how to turn the blueprint into code (tokens, layout primitives, components, sections, page). Read first, before building or rebuilding any page or screen.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fui-structure\u002FSKILL.md",[176,177,178],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},[180,131,181,140,182,183,165,184,185,186,143,159,187,188,189,41,144,124,190,191],"structure","ui structure","pricing","dashboard","Blueprint","article","anatomy","styling","primitives","list","why","how",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":203,"publishedAt":45},"01M6D2H0ZZBJG77MBGPZHA6MWD","ui-stack-vue","Building interfaces in Vue 3 and Nuxt: project layout, script setup with typed defineProps, defineEmits and defineModel, attribute fallthrough, slots and scoped slots, template refs, ref, reactive and computed, watch versus watchEffect, composables and VueUse, provide and inject, Pinia, keyed v-for, transitions, Nuxt 4 (app directory, pages, layouts, useFetch and useAsyncData keys, $fetch in handlers, server routes, runtime config, useSeoMeta, NuxtImg, middleware), VeeValidate forms, Reka UI and Nuxt UI, testing, vue-tsc, and the traps. Read when the project uses Vue or Nuxt.","https:\u002F\u002Fgithub.com\u002Fenowdev\u002Fenowxcli\u002Fblob\u002Fmain\u002Fcrates\u002Fenowx-core\u002Fskills\u002Fui-stack-vue\u002FSKILL.md",[198,199,202],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":200,"categoryName":201,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":136,"categoryName":137,"taxonomyType":29,"taxonomyTypeDesc":30},[131,204,205,206,207,208,209,210,143,105,211,212,41,213,214,215,216,217,218,35],"vue","stack","ui stack vue","forms","pages","watch","runtime","transitions","fetch","pinia","nuxt","template","server","config","directory"]