[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B7K90WGS2SFT6ZMMTQ1T3":3,"skill-same:01M71B7K90WGS2SFT6ZMMTQ1T3":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":80},"01M71B7K90WGS2SFT6ZMMTQ1T3","cyber-implementing-api-security-testing-with-42crunch",null,"Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-implementing-api-security-testing-with-42crunch\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"implementing","with","Security Testing","implementing api security testing with 42crunch","42crunch","api security","security","api security testing","cyber implementing api security testing with 42crunch","api","testing","owasp-api","static","ci","api-security","cybersecurity","false","subdomain","top","apache","2026-11-10 10:12:30",false,"---\nname: cyber-implementing-api-security-testing-with-42crunch\ndescription: \"Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: implementing-api-security-testing-with-42crunch | description: Implement comprehensive API security testing using the 42Crunch platform |   to perform static audit and dynamic conformance scanning of OpenAPI specifications. | domain: cybersecurity | subdomain: api-security | tags: | - api-security | - 42crunch | - openapi | - api-audit | - api-scan | - conformance-testing | - shift-left | - ci-cd-security | - owasp-api-top-10 | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Implementing API Security Testing with 42Crunch\n\n## Overview\n\n42Crunch is an API security platform that combines Shift-Left security testing with Shield-Right runtime protection. It provides API Audit for static security analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability detection, and API Protect for real-time threat prevention. The platform integrates into CI\u002FCD pipelines and IDEs to identify OWASP API Security Top 10 vulnerabilities before and after deployment.\n\n\n## When to Use\n\n- When deploying or configuring implementing api security testing with 42crunch capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- 42Crunch platform account (free tier available for evaluation)\n- OpenAPI Specification (OAS) v2.0, v3.0, or v3.1 definitions for target APIs\n- IDE with 42Crunch extension (VS Code, IntelliJ, or Eclipse)\n- CI\u002FCD pipeline (Jenkins, GitHub Actions, Azure DevOps, or GitLab CI)\n- Running API instance for dynamic scanning (conformance scan)\n- Node.js or Python environment for CLI tooling\n\n## Core Concepts\n\n### API Audit (Static Analysis)\n\nAPI Audit performs static security analysis of OpenAPI definitions without requiring a running API. It evaluates the specification against 300+ security checks organized into categories:\n\n**Security Score Categories:**\n- **Data Validation**: Schema definitions, parameter constraints, response validation\n- **Authentication**: Security scheme definitions, scope requirements\n- **Transport Security**: Server URL schemes, TLS requirements\n- **Error Handling**: Error response definitions, information leakage prevention\n\n**Running API Audit via VS Code Extension:**\n\n1. Install the 42Crunch extension from the VS Code marketplace\n2. Open an OpenAPI specification file (YAML or JSON)\n3. Click the security audit icon in the editor toolbar\n4. Review the security score (0-100) and individual findings\n5. Address issues using the inline remediation guidance\n\n**Example OpenAPI Definition with Security Controls:**\n\n```yaml\nopenapi: 3.0.3\ninfo:\n  title: Secure User API\n  version: 1.0.0\nservers:\n  - url: https:\u002F\u002Fapi.example.com\u002Fv1\n    description: Production server (HTTPS only)\nsecurity:\n  - BearerAuth: []\npaths:\n  \u002Fusers\u002F{userId}:\n    get:\n      operationId: getUserById\n      summary: Retrieve user by ID\n      parameters:\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n            format: uuid\n            pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'\n            maxLength: 36\n      responses:\n        '200':\n          description: User details\n          content:\n            application\u002Fjson:\n              schema:\n                $ref: '#\u002Fcomponents\u002Fschemas\u002FUser'\n        '400':\n          description: Invalid request\n          content:\n            application\u002Fjson:\n              schema:\n                $ref: '#\u002Fcomponents\u002Fschemas\u002FError'\n        '401':\n          description: Unauthorized\n        '404':\n          description: User not found\ncomponents:\n  securitySchemes:\n    BearerAuth:\n      type: http\n      scheme: bearer\n      bearerFormat: JWT\n  schemas:\n    User:\n      type: object\n      required:\n        - id\n        - email\n      properties:\n        id:\n          type: string\n          format: uuid\n          readOnly: true\n        email:\n          type: string\n          format: email\n          maxLength: 254\n        name:\n          type: string\n          maxLength: 100\n          pattern: '^[a-zA-Z\\s\\-]+$'\n      additionalProperties: false\n    Error:\n      type: object\n      required:\n        - code\n        - message\n      properties:\n        code:\n          type: integer\n          format: int32\n        message:\n          type: string\n          maxLength: 256\n      additionalProperties: false\n```\n\n### API Conformance Scan (Dynamic Testing)\n\nThe conformance scan dynamically tests a running API against its OpenAPI contract to detect runtime vulnerabilities including OWASP API Security Top 10 issues:\n\n**Scan v2 Configuration:**\n\n```yaml\n# 42c-conf.yaml\nversion: \"2.0\"\nscan:\n  target:\n    url: https:\u002F\u002Fapi.example.com\u002Fv1\n  authentication:\n    - type: bearer\n      token: \"${API_TOKEN}\"\n      in: header\n      name: Authorization\n  settings:\n    maxScanTime: 3600\n    requestsPerSecond: 10\n    followRedirects: false\n  tests:\n    owasp:\n      - bola\n      - bfla\n      - injection\n      - ssrf\n      - massAssignment\n      - excessiveDataExposure\n```\n\n**Running Conformance Scan via CLI:**\n\n```bash\n# Install the 42Crunch CLI\nnpm install -g @42crunch\u002Fcicd-cli\n\n# Run conformance scan\n42crunch-cli scan \\\n  --api-definition .\u002Fopenapi.yaml \\\n  --target-url https:\u002F\u002Fapi.example.com\u002Fv1 \\\n  --token $CRUNCH_TOKEN \\\n  --min-score 70 \\\n  --report-format sarif \\\n  --output scan-report.sarif\n```\n\n### CI\u002FCD Pipeline Integration\n\n**GitHub Actions Integration:**\n\n```yaml\nname: API Security Testing\non:\n  push:\n    paths:\n      - 'api\u002F**'\n      - 'openapi\u002F**'\njobs:\n  api-security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: 42Crunch API Audit\n        uses: 42Crunch\u002Fapi-security-audit-action@v3\n        with:\n          api-token: ${{ secrets.CRUNCH_API_TOKEN }}\n          collection-name: \"my-api-collection\"\n          min-score: 75\n          upload-to-code-scanning: true\n\n      - name: 42Crunch Conformance Scan\n        if: github.ref == 'refs\u002Fheads\u002Fmain'\n        uses: 42Crunch\u002Fapi-conformance-scan@v1\n        with:\n          api-token: ${{ secrets.CRUNCH_API_TOKEN }}\n          target-url: ${{ secrets.STAGING_API_URL }}\n          scan-config: .\u002F42c-conf.yaml\n```\n\n**Jenkins Pipeline Integration:**\n\n```groovy\npipeline {\n    agent any\n    stages {\n        stage('API Security Audit') {\n            steps {\n                script {\n                    def auditResult = sh(\n                        script: '''\n                            42crunch-cli audit \\\n                              --api-definition openapi.yaml \\\n                              --token ${CRUNCH_TOKEN} \\\n                              --min-score 75 \\\n                              --report-format json \\\n                              --output audit-report.json\n                        ''',\n                        returnStatus: true\n                    )\n                    if (auditResult != 0) {\n                        error(\"API Security Audit failed - score below threshold\")\n                    }\n                }\n            }\n        }\n        stage('Conformance Scan') {\n            when { branch 'main' }\n            steps {\n                sh '''\n                    42crunch-cli scan \\\n                      --api-definition openapi.yaml \\\n                      --target-url ${STAGING_URL} \\\n                      --token ${CRUNCH_TOKEN} \\\n                      --scan-config 42c-conf.yaml\n                '''\n            }\n        }\n    }\n    post {\n        always {\n            archiveArtifacts artifacts: '*-report.*'\n            publishHTML([\n                reportDir: '.',\n                reportFiles: 'audit-report.html',\n                reportName: 'API Security Report'\n            ])\n        }\n    }\n}\n```\n\n### API Protect (Runtime Protection)\n\nAPI Protect deploys as a micro-gateway in front of API endpoints to enforce the OpenAPI contract at runtime:\n\n```yaml\n# api-protect-config.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: api-protect-config\ndata:\n  protection-config.json: |\n    {\n      \"apiDefinition\": \"\u002Fconfig\u002Fopenapi.yaml\",\n      \"enforcement\": {\n        \"validateRequests\": true,\n        \"validateResponses\": true,\n        \"blockOnFailure\": true,\n        \"logLevel\": \"warn\"\n      },\n      \"rateLimit\": {\n        \"enabled\": true,\n        \"requestsPerMinute\": 100,\n        \"burstSize\": 20\n      },\n      \"allowlist\": {\n        \"contentTypes\": [\"application\u002Fjson\"],\n        \"methods\": [\"GET\", \"POST\", \"PUT\", \"DELETE\"]\n      }\n    }\n```\n\n## Remediation Workflow\n\nWhen 42Crunch identifies issues, follow this remediation process:\n\n1. **Triage**: Review findings sorted by severity (Critical, High, Medium, Low)\n2. **Analyze**: Understand the specific security control missing from the OpenAPI definition\n3. **Fix**: Apply the recommended changes to the specification\n4. **Validate**: Re-run audit to confirm the score improvement\n5. **Deploy**: Push the updated specification through the CI\u002FCD pipeline\n\n**Common Audit Findings and Fixes:**\n\n| Finding | Severity | Fix |\n|---------|----------|-----|\n| No authentication defined | Critical | Add securitySchemes and security requirements |\n| Missing input validation | High | Add type, format, pattern, maxLength constraints |\n| Server URL uses HTTP | High | Change server URLs to HTTPS |\n| No error responses defined | Medium | Add 4xx and 5xx response definitions |\n| additionalProperties not restricted | Medium | Set additionalProperties: false on object schemas |\n| Missing rate limiting | Medium | Add x-rateLimit extension or use API Protect |\n\n## Key Security Checks\n\n42Crunch evaluates APIs against these critical security areas:\n\n- **BOLA Prevention**: Validates that object-level authorization patterns are defined\n- **BFLA Prevention**: Checks for function-level access control definitions\n- **Injection Prevention**: Ensures input parameters have proper type\u002Fformat\u002Fpattern constraints\n- **Data Exposure**: Verifies response schemas limit returned properties\n- **Security Misconfiguration**: Checks authentication schemes, transport security, CORS settings\n- **Mass Assignment**: Validates that request bodies use explicit property allowlists\n\n## References\n\n- 42Crunch API Security Platform: https:\u002F\u002F42crunch.com\u002Fapi-security-platform\u002F\n- 42Crunch Documentation: https:\u002F\u002Fdocs.42crunch.com\u002F\n- Microsoft Defender for Cloud 42Crunch Integration: https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fdefender-for-cloud\u002Fonboarding-guide-42crunch\n- OWASP API Security Top 10 2023: https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0x00-header\u002F\n- Jenkins Plugin for 42Crunch: https:\u002F\u002Fplugins.jenkins.io\u002F42crunch-security-audit\u002F\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Implementing API Security Testing with 42Crunch\n\n## Overview\n\n42Crunch is an API security platform that combines Shift-Left security testing with Shield-Right runtime protection. It provides API Audit for static security analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability detection, and API Protect for real-time threat prevention. The platform integrates into CI\u002FCD pipelines and IDEs to identify OWASP API Security Top 10 vulnerabilities before and after deployment.\n\n\n## When to Use\n\n- When deploying or configuring implementing api security testing with 42crunch capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- 42Crunch platform account (free tier available for evaluation)\n- OpenAPI Specification (OAS) v2.0, v3.0, or v3.1 definitions for target APIs\n- IDE with 42Crunch extension (VS Code, IntelliJ, or Eclipse)\n- CI\u002FCD pipeline (Jenkins, GitHub Actions, Azure DevOps, or GitLab CI)\n- Running API instance for dynamic scanning (conformance scan)\n- Node.js or Python environment for CLI tooling\n\n## Core Concepts\n\n### API Audit (Static Analysis)\n\nAPI Audit performs static security analysis of OpenAPI definitions without requiring a running API. It evaluates the specification against 300+ security checks organized into categories:\n\n**Security Score Categories:**\n- **Data Validation**: Schema definitions, parameter constraints, response validation\n- **Authentication**: Security scheme definitions, scope requirements\n- **Transport Security**: Server URL schemes, TLS requirements\n- **Error Handling**: Error response definitions, information leakage prevention\n\n**Running API Audit via VS Code Extension:**\n\n1. Install the 42Crunch extension from the VS Code marketplace\n2. Open an OpenAPI specification file (YAML or JSON)\n3. Click the security audit icon in the editor toolbar\n4. Review the security score (0-100) and individual findings\n5. Address issues using the inline remediation guidance\n\n**Example OpenAPI Definition with Security Controls:**\n\n```yaml\nopenapi: 3.0.3\ninfo:\n  title: Secure User API\n  version: 1.0.0\nservers:\n  - url: https:\u002F\u002Fapi.example.com\u002Fv1\n    description: Production server (HTTPS only)\nsecurity:\n  - BearerAuth: []\npaths:\n  \u002Fusers\u002F{userId}:\n    get:\n      operationId: getUserById\n      summary: Retrieve user by ID\n      parameters:\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n            format: uuid\n            pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'\n            maxLength: 36\n      responses:\n        '200':\n          description: User details\n          content:\n            application\u002Fjson:\n              schema:\n                $ref: '#\u002Fcomponents\u002Fschemas\u002FUser'\n        '400':\n          description: Invalid request\n          content:\n            application\u002Fjson:\n              schema:\n                $ref: '#\u002Fcomponents\u002Fschemas\u002FError'\n        '401':\n          description: Unauthorized\n        '404':\n          description: User not found\ncomponents:\n  securitySchemes:\n    BearerAuth:\n      type: http\n      scheme: bearer\n      bearerFormat: JWT\n  schemas:\n    User:\n      type: object\n      required:\n        - id\n        - email\n      properties:\n        id:\n          type: string\n          format: uuid\n          readOnly: true\n        email:\n          type: string\n          format: email\n          maxLength: 254\n        name:\n          type: string\n          maxLength: 100\n          pattern: '^[a-zA-Z\\s\\-]+$'\n      additionalProperties: false\n    Error:\n      type: object\n      required:\n        - code\n        - message\n      properties:\n        code:\n          type: integer\n          format: int32\n        message:\n          type: string\n          maxLength: 256\n      additionalProperties: false\n```\n\n### API Conformance Scan (Dynamic Testing)\n\nThe conformance scan dynamically tests a running API against its OpenAPI contract to detect runtime vulnerabilities including OWASP API Security Top 10 issues:\n\n**Scan v2 Configuration:**\n\n```yaml\n# 42c-conf.yaml\nversion: \"2.0\"\nscan:\n  target:\n    url: https:\u002F\u002Fapi.example.com\u002Fv1\n  authentication:\n    - type: bearer\n      token: \"${API_TOKEN}\"\n      in: header\n      name: Authorization\n  settings:\n    maxScanTime: 3600\n    requestsPerSecond: 10\n    followRedirects: false\n  tests:\n    owasp:\n      - bola\n      - bfla\n      - injection\n      - ssrf\n      - massAssignment\n      - excessiveDataExposure\n```\n\n**Running Conformance Scan via CLI:**\n\n```bash\n# Install the 42Crunch CLI\nnpm install -g @42crunch\u002Fcicd-cli\n\n# Run conformance scan\n42crunch-cli scan \\\n  --api-definition .\u002Fopenapi.yaml \\\n  --target-url https:\u002F\u002Fapi.example.com\u002Fv1 \\\n  --token $CRUNCH_TOKEN \\\n  --min-score 70 \\\n  --report-format sarif \\\n  --output scan-report.sarif\n```\n\n### CI\u002FCD Pipeline Integration\n\n**GitHub Actions Integration:**\n\n```yaml\nname: API Security Testing\non:\n  push:\n    paths:\n      - 'api\u002F**'\n      - 'openapi\u002F**'\njobs:\n  api-security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: 42Crunch API Audit\n        uses: 42Crunch\u002Fapi-security-audit-action@v3\n        with:\n          api-token: ${{ secrets.CRUNCH_API_TOKEN }}\n          collection-name: \"my-api-collection\"\n          min-score: 75\n          upload-to-code-scanning: true\n\n      - name: 42Crunch Conformance Scan\n        if: github.ref == 'refs\u002Fheads\u002Fmain'\n        uses: 42Crunch\u002Fapi-conformance-scan@v1\n        with:\n          api-token: ${{ secrets.CRUNCH_API_TOKEN }}\n          target-url: ${{ secrets.STAGING_API_URL }}\n          scan-config: .\u002F42c-conf.yaml\n```\n\n**Jenkins Pipeline Integration:**\n\n```groovy\npipeline {\n    agent any\n    stages {\n        stage('API Security Audit') {\n            steps {\n                script {\n                    def auditResult = sh(\n                        script: '''\n                            42crunch-cli audit \\\n                              --api-definition openapi.yaml \\\n                              --token ${CRUNCH_TOKEN} \\\n                              --min-score 75 \\\n                              --report-format json \\\n                              --output audit-report.json\n                        ''',\n                        returnStatus: true\n                    )\n                    if (auditResult != 0) {\n                        error(\"API Security Audit failed - score below threshold\")\n                    }\n                }\n            }\n        }\n        stage('Conformance Scan') {\n            when { branch 'main' }\n            steps {\n                sh '''\n                    42crunch-cli scan \\\n                      --api-definition openapi.yaml \\\n                      --target-url ${STAGING_URL} \\\n                      --token ${CRUNCH_TOKEN} \\\n                      --scan-config 42c-conf.yaml\n                '''\n            }\n        }\n    }\n    post {\n        always {\n            archiveArtifacts artifacts: '*-report.*'\n            publishHTML([\n                reportDir: '.',\n                reportFiles: 'audit-report.html',\n                reportName: 'API Security Report'\n            ])\n        }\n    }\n}\n```\n\n### API Protect (Runtime Protection)\n\nAPI Protect deploys as a micro-gateway in front of API endpoints to enforce the OpenAPI contract at runtime:\n\n```yaml\n# api-protect-config.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: api-protect-config\ndata:\n  protection-config.json: |\n    {\n      \"apiDefinition\": \"\u002Fconfig\u002Fopenapi.yaml\",\n      \"enforcement\": {\n        \"validateRequests\": true,\n        \"validateResponses\": true,\n        \"blockOnFailure\": true,\n        \"logLevel\": \"warn\"\n      },\n      \"rateLimit\": {\n        \"enabled\": true,\n        \"requestsPerMinute\": 100,\n        \"burstSize\": 20\n      },\n      \"allowlist\": {\n        \"contentTypes\": [\"application\u002Fjson\"],\n        \"methods\": [\"GET\", \"POST\", \"PUT\", \"DELETE\"]\n      }\n    }\n```\n\n## Remediation Workflow\n\nWhen 42Crunch identifies issues, follow this remediation process:\n\n1. **Triage**: Review findings sorted by severity (Critical, High, Medium, Low)\n2. **Analyze**: Understand the specific security control missing from the OpenAPI definition\n3. **Fix**: Apply the recommended changes to the specification\n4. **Validate**: Re-run audit to confirm the score improvement\n5. **Deploy**: Push the updated specification through the CI\u002FCD pipeline\n\n**Common Audit Findings and Fixes:**\n\n| Finding | Severity | Fix |\n|---------|----------|-----|\n| No authentication defined | Critical | Add securitySchemes and security requirements |\n| Missing input validation | High | Add type, format, pattern, maxLength constraints |\n| Server URL uses HTTP | High | Change server URLs to HTTPS |\n| No error responses defined | Medium | Add 4xx and 5xx response definitions |\n| additionalProperties not restricted | Medium | Set additionalProperties: false on object schemas |\n| Missing rate limiting | Medium | Add x-rateLimit extension or use API Protect |\n\n## Key Security Checks\n\n42Crunch evaluates APIs against these critical security areas:\n\n- **BOLA Prevention**: Validates that object-level authorization patterns are defined\n- **BFLA Prevention**: Checks for function-level access control definitions\n- **Injection Prevention**: Ensures input parameters have proper type\u002Fformat\u002Fpattern constraints\n- **Data Exposure**: Verifies response schemas limit returned properties\n- **Security Misconfiguration**: Checks authentication schemes, transport security, CORS settings\n- **Mass Assignment**: Validates that request bodies use explicit property allowlists\n\n## References\n\n- 42Crunch API Security Platform: https:\u002F\u002F42crunch.com\u002Fapi-security-platform\u002F\n- 42Crunch Documentation: https:\u002F\u002Fdocs.42crunch.com\u002F\n- Microsoft Defender for Cloud 42Crunch Integration: https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fdefender-for-cloud\u002Fonboarding-guide-42crunch\n- OWASP API Security Top 10 2023: https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0x00-header\u002F\n- Jenkins Plugin for 42Crunch: https:\u002F\u002Fplugins.jenkins.io\u002F42crunch-security-audit\u002F\n",{"hide":57,"name":5,"source":58,"license":15,"description":7,"authorized_lab":53,"origin_frontmatter":59},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: implementing-api-security-testing-with-42crunch | description: Implement comprehensive API security testing using the 42Crunch platform |   to perform static audit and dynamic conformance scanning of OpenAPI specifications. | domain: cybersecurity | subdomain: api-security | tags: | - api-security | - 42crunch | - openapi | - api-audit | - api-scan | - conformance-testing | - shift-left | - ci-cd-security | - owasp-api-top-10 | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-implementing-api-security-testing-with-42crunch",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":57},[70,73,76],{"tool":71,"command":72},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-security-testing-with-42crunch",{"tool":74,"command":75},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-security-testing-with-42crunch",{"tool":77,"command":78},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-security-testing-with-42crunch","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-implementing-api-security-testing-with-42crunch\u002FSKILL.md",[],[82,105,129,157,182,201],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":52},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[90,91,33,92,93,94,95,96,97,98,99,100,101,102,103,104],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":52},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[112,113,92,114,115,116,117,118,119,120,121,98,122,100,123,124,125,126,127,128],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":138,"publishedAt":52},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[139,140,141,142,143,144,145,146,147,100,148,149,150,151,152,153,154,116,155,156],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":52},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[168,102,169,139,92,170,171,172,116,173,174,175,176,177,178,179,180,181,98,100],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":52},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,100,198,123,199,200],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":217,"publishedAt":52},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[207,208,211,214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":212,"categoryName":213,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":215,"categoryName":216,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[218,219,220,100,123,221,92,222,117,98,223],"writing","writing skills","new","work","editing","Existing"]