[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EXADHR74YEQ0WZMB10YQVR":3,"skill-same:01M6EXADHR74YEQ0WZMB10YQVR":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6EXADHR74YEQ0WZMB10YQVR","api-security-testing",null,"API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fapi-security-testing\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"security","Security Testing","api security","api","testing","api security testing","authorization","Input Validation","testing workflow","input","bundle","rate limiting","GraphQL","REST","security best practices","validation","best practices","authentication","workflow","safe","2026-11-10 10:12:30",false,"---\nname: api-security-testing\ndescription: \"API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.\"\nsource: personal\nrisk: safe\ndomain: security\ncategory: granular-workflow-bundle\nversion: 1.0.0\n---\n\n# API Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing REST API security\n- Assessing GraphQL endpoints\n- Validating API authentication\n- Testing API rate limiting\n- Bug bounty API testing\n\n## Workflow Phases\n\n### Phase 1: API Discovery\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `scanning-tools` - API scanning\n\n#### Actions\n1. Enumerate endpoints\n2. Document API methods\n3. Identify parameters\n4. Map data flows\n5. Review documentation\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to discover API endpoints\n```\n\n### Phase 2: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Auth testing\n- `api-security-best-practices` - API auth\n\n#### Actions\n1. Test API key validation\n2. Test JWT tokens\n3. Test OAuth2 flows\n4. Test token expiration\n5. Test refresh tokens\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test API authentication\n```\n\n### Phase 3: Authorization Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n\n#### Actions\n1. Test object-level authorization\n2. Test function-level authorization\n3. Test role-based access\n4. Test privilege escalation\n5. Test multi-tenant isolation\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test API authorization\n```\n\n### Phase 4: Input Validation\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `sql-injection-testing` - Injection testing\n\n#### Actions\n1. Test parameter validation\n2. Test SQL injection\n3. Test NoSQL injection\n4. Test command injection\n5. Test XXE injection\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API parameters\n```\n\n### Phase 5: Rate Limiting\n\n#### Skills to Invoke\n- `api-security-best-practices` - Rate limiting\n\n#### Actions\n1. Test rate limit headers\n2. Test brute force protection\n3. Test resource exhaustion\n4. Test bypass techniques\n5. Document limitations\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to test rate limiting\n```\n\n### Phase 6: GraphQL Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - GraphQL fuzzing\n\n#### Actions\n1. Test introspection\n2. Test query depth\n3. Test query complexity\n4. Test batch queries\n5. Test field suggestions\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to test GraphQL security\n```\n\n### Phase 7: Error Handling\n\n#### Skills to Invoke\n- `api-security-best-practices` - Error handling\n\n#### Actions\n1. Test error messages\n2. Check information disclosure\n3. Test stack traces\n4. Verify logging\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit API error handling\n```\n\n## API Security Checklist\n\n- [ ] Authentication working\n- [ ] Authorization enforced\n- [ ] Input validated\n- [ ] Rate limiting active\n- [ ] Errors sanitized\n- [ ] Logging enabled\n- [ ] CORS configured\n- [ ] HTTPS enforced\n\n## Quality Gates\n\n- [ ] All endpoints tested\n- [ ] Vulnerabilities documented\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `web-security-testing` - Web security\n- `api-development` - API development\n","# API Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing REST API security\n- Assessing GraphQL endpoints\n- Validating API authentication\n- Testing API rate limiting\n- Bug bounty API testing\n\n## Workflow Phases\n\n### Phase 1: API Discovery\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `scanning-tools` - API scanning\n\n#### Actions\n1. Enumerate endpoints\n2. Document API methods\n3. Identify parameters\n4. Map data flows\n5. Review documentation\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to discover API endpoints\n```\n\n### Phase 2: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Auth testing\n- `api-security-best-practices` - API auth\n\n#### Actions\n1. Test API key validation\n2. Test JWT tokens\n3. Test OAuth2 flows\n4. Test token expiration\n5. Test refresh tokens\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test API authentication\n```\n\n### Phase 3: Authorization Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n\n#### Actions\n1. Test object-level authorization\n2. Test function-level authorization\n3. Test role-based access\n4. Test privilege escalation\n5. Test multi-tenant isolation\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test API authorization\n```\n\n### Phase 4: Input Validation\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `sql-injection-testing` - Injection testing\n\n#### Actions\n1. Test parameter validation\n2. Test SQL injection\n3. Test NoSQL injection\n4. Test command injection\n5. Test XXE injection\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API parameters\n```\n\n### Phase 5: Rate Limiting\n\n#### Skills to Invoke\n- `api-security-best-practices` - Rate limiting\n\n#### Actions\n1. Test rate limit headers\n2. Test brute force protection\n3. Test resource exhaustion\n4. Test bypass techniques\n5. Document limitations\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to test rate limiting\n```\n\n### Phase 6: GraphQL Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - GraphQL fuzzing\n\n#### Actions\n1. Test introspection\n2. Test query depth\n3. Test query complexity\n4. Test batch queries\n5. Test field suggestions\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to test GraphQL security\n```\n\n### Phase 7: Error Handling\n\n#### Skills to Invoke\n- `api-security-best-practices` - Error handling\n\n#### Actions\n1. Test error messages\n2. Check information disclosure\n3. Test stack traces\n4. Verify logging\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit API error handling\n```\n\n## API Security Checklist\n\n- [ ] Authentication working\n- [ ] Authorization enforced\n- [ ] Input validated\n- [ ] Rate limiting active\n- [ ] Errors sanitized\n- [ ] Logging enabled\n- [ ] CORS configured\n- [ ] HTTPS enforced\n\n## Quality Gates\n\n- [ ] All endpoints tested\n- [ ] Vulnerabilities documented\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `web-security-testing` - Web security\n- `api-development` - API development\n",{"name":5,"risk":54,"domain":35,"source":60,"version":61,"category":62,"description":7},"personal","1.0.0","granular-workflow-bundle","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fapi-security-testing",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill api-security-testing",{"tool":78,"command":79},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill api-security-testing",{"tool":81,"command":82},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill api-security-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fapi-security-testing\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"skill-report.json","REFERENCE","参考文档",8793,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fapi-security-testing\u002Fskill-report.json",[93,103,113,122,128,135],{"skillNo":94,"name":95,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":99,"publishedAt":55},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[98],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[100,101,102],"model","model hierarchy","model hierarchy skill",{"skillNo":104,"name":105,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":55},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[108],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112],"MCP","zoom","zoom mcp",{"skillNo":114,"name":115,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":55},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[119,120,121,111],"sdk","zoom apps sdk","apps",{"skillNo":123,"name":124,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":55},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[124],{"skillNo":129,"name":130,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":55},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[133],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[130],{"skillNo":136,"name":137,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":55},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[137]]