[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B7PZZVPSFSX9SSRH1PKKK":3,"skill-same:01M71B7PZZVPSFSX9SSRH1PKKK":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":63,"updatedAt":64,"install":65,"resources":77},"01M71B7PZZVPSFSX9SSRH1PKKK","cyber-implementing-api-threat-protection-with-apigee",null,"Implement API threat protection using Google Apigee policies including JSON\u002FXML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-implementing-api-threat-protection-with-apigee\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"api","cyber implementing api threat protection with apigee","threat","apigee","with","implementing api threat protection with apigee","protection","implementing","owasp","defense","google","owasp top 10","top","subdomain","false","cybersecurity","api-security","auth","advanced","owasp-api","2026-11-10 10:12:30",false,"---\nname: cyber-implementing-api-threat-protection-with-apigee\ndescription: \"Implement API threat protection using Google Apigee policies including JSON\u002FXML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: implementing-api-threat-protection-with-apigee | description: Implement API threat protection using Google Apigee policies including |   JSON\u002FXML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for |   OWASP Top 10 defense. | domain: cybersecurity | subdomain: api-security | tags: | - apigee | - api-gateway | - threat-protection | - json-threat-protection | - xml-threat-protection | - spike-arrest | - oauth2 | - google-cloud | - owasp-api-top-10 | version: '1.0' | auth\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Implementing API Threat Protection with Apigee\n\n## Overview\n\nGoogle Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.\n\n\n## When to Use\n\n- When deploying or configuring implementing api threat protection with apigee capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Google Cloud Platform account with Apigee organization provisioned\n- Apigee X or Apigee hybrid environment configured\n- Backend API services deployed and accessible from Apigee\n- Google Cloud CLI (gcloud) installed and authenticated\n- OpenAPI specification for target APIs\n- Understanding of Apigee proxy bundle structure\n\n## Core Security Policies\n\n### 1. JSON Threat Protection\n\nProtects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CJSONThreatProtection name=\"JSON-Threat-Protection-1\">\n    \u003CDisplayName>JSON Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003C!-- Maximum nesting depth of JSON structure -->\n    \u003CObjectEntryNameLength>50\u003C\u002FObjectEntryNameLength>\n    \u003CObjectEntryCount>25\u003C\u002FObjectEntryCount>\n    \u003CArrayElementCount>100\u003C\u002FArrayElementCount>\n    \u003CContainerDepth>5\u003C\u002FContainerDepth>\n    \u003CStringValueLength>500\u003C\u002FStringValueLength>\n\u003C\u002FJSONThreatProtection>\n```\n\n### 2. XML Threat Protection\n\nShields against XML bombs, XXE attacks, and oversized XML payloads:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CXMLThreatProtection name=\"XML-Threat-Protection-1\">\n    \u003CDisplayName>XML Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CNameLimits>\n        \u003CElement>50\u003C\u002FElement>\n        \u003CAttribute>50\u003C\u002FAttribute>\n        \u003CNamespacePrefix>20\u003C\u002FNamespacePrefix>\n        \u003CProcessingInstructionTarget>50\u003C\u002FProcessingInstructionTarget>\n    \u003C\u002FNameLimits>\n    \u003CValueLimits>\n        \u003CText>1000\u003C\u002FText>\n        \u003CAttribute>500\u003C\u002FAttribute>\n        \u003CNamespaceURI>256\u003C\u002FNamespaceURI>\n        \u003CComment>256\u003C\u002FComment>\n        \u003CProcessingInstructionData>256\u003C\u002FProcessingInstructionData>\n    \u003C\u002FValueLimits>\n    \u003CStructureLimits>\n        \u003CNodeDepth>5\u003C\u002FNodeDepth>\n        \u003CAttributeCountPerElement>5\u003C\u002FAttributeCountPerElement>\n        \u003CNamespaceCountPerElement>3\u003C\u002FNamespaceCountPerElement>\n        \u003CChildCount>25\u003C\u002FChildCount>\n    \u003C\u002FStructureLimits>\n\u003C\u002FXMLThreatProtection>\n```\n\n### 3. Regular Expression Threat Protection\n\nDetects SQL injection, XSS, and other injection patterns in request parameters:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CRegularExpressionProtection name=\"RegEx-Threat-Protection-1\">\n    \u003CDisplayName>Regex Injection Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n\n    \u003C!-- SQL Injection patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b))\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- XSS patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*<\\s*script\\b[^>]*>[^<]+<\\s*\u002F\\s*script\\s*>\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- Header injection -->\n    \u003CHeader name=\"*\">\n        \u003CPattern>[\\r\\n]\u003C\u002FPattern>\n    \u003C\u002FHeader>\n\n    \u003C!-- URI path traversal -->\n    \u003CURIPath>\n        \u003CPattern>(\u002F\\.\\.)|(\\.\\.\u002F)\u003C\u002FPattern>\n    \u003C\u002FURIPath>\n\n    \u003C!-- JSON body injection -->\n    \u003CJSONPayload>\n        \u003CJSONPath>$.*\u003C\u002FJSONPath>\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update))\u003C\u002FPattern>\n    \u003C\u002FJSONPayload>\n\u003C\u002FRegularExpressionProtection>\n```\n\n### 4. SpikeArrest Policy\n\nPrevents traffic spikes from overwhelming backend services:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CSpikeArrest name=\"Spike-Arrest-1\">\n    \u003CDisplayName>API Spike Arrest\u003C\u002FDisplayName>\n    \u003CRate>30ps\u003C\u002FRate> \u003C!-- 30 per second smoothed -->\n    \u003CIdentifier ref=\"request.header.x-api-key\"\u002F>\n    \u003CMessageWeight ref=\"request.header.x-request-weight\"\u002F>\n    \u003CUseEffectiveCount>true\u003C\u002FUseEffectiveCount>\n\u003C\u002FSpikeArrest>\n```\n\n### 5. OAuth 2.0 Token Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003COAuthV2 name=\"Verify-OAuth-Token\">\n    \u003CDisplayName>Verify OAuth 2.0 Access Token\u003C\u002FDisplayName>\n    \u003COperation>VerifyAccessToken\u003C\u002FOperation>\n    \u003CExternalAuthorization>false\u003C\u002FExternalAuthorization>\n    \u003CExternalAccessToken>request.header.Authorization\u003C\u002FExternalAccessToken>\n    \u003CSupportedGrantTypes>\n        \u003CGrantType>authorization_code\u003C\u002FGrantType>\n        \u003CGrantType>client_credentials\u003C\u002FGrantType>\n    \u003C\u002FSupportedGrantTypes>\n    \u003CScope>read write\u003C\u002FScope>\n    \u003CGenerateResponse enabled=\"true\"\u002F>\n\u003C\u002FOAuthV2>\n```\n\n### 6. API Key Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CVerifyAPIKey name=\"Verify-API-Key-1\">\n    \u003CDisplayName>Verify API Key\u003C\u002FDisplayName>\n    \u003CAPIKey ref=\"request.header.x-api-key\"\u002F>\n\u003C\u002FVerifyAPIKey>\n```\n\n## Proxy Bundle Configuration\n\n### Complete Secure Proxy Flow\n\n```xml\n\u003C!-- apiproxy\u002Fproxies\u002Fdefault.xml -->\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CProxyEndpoint name=\"default\">\n    \u003CPreFlow name=\"PreFlow\">\n        \u003CRequest>\n            \u003C!-- Step 1: Verify API Key or OAuth token -->\n            \u003CStep>\n                \u003CName>Verify-OAuth-Token\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 2: Rate limiting -->\n            \u003CStep>\n                \u003CName>Spike-Arrest-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 3: Threat protection -->\n            \u003CStep>\n                \u003CName>JSON-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"application\u002Fjson\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003CStep>\n                \u003CName>XML-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"text\u002Fxml\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003C!-- Step 4: Injection prevention -->\n            \u003CStep>\n                \u003CName>RegEx-Threat-Protection-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 5: CORS enforcement -->\n            \u003CStep>\n                \u003CName>CORS-Policy\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FRequest>\n        \u003CResponse>\n            \u003C!-- Remove internal headers from response -->\n            \u003CStep>\n                \u003CName>Remove-Internal-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Add security headers -->\n            \u003CStep>\n                \u003CName>Add-Security-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FResponse>\n    \u003C\u002FPreFlow>\n\n    \u003CFlows>\n        \u003CFlow name=\"sensitive-operations\">\n            \u003CDescription>Additional protection for sensitive endpoints\u003C\u002FDescription>\n            \u003CRequest>\n                \u003CStep>\n                    \u003CName>Quota-Strict\u003C\u002FName>\n                \u003C\u002FStep>\n            \u003C\u002FRequest>\n            \u003CCondition>(proxy.pathsuffix MatchesPath \"\u002Fadmin\u002F**\") or\n                       (proxy.pathsuffix MatchesPath \"\u002Fusers\u002F*\u002Fsensitive\")\u003C\u002FCondition>\n        \u003C\u002FFlow>\n    \u003C\u002FFlows>\n\n    \u003CHTTPProxyConnection>\n        \u003CBasePath>\u002Fv1\u003C\u002FBasePath>\n        \u003CVirtualHost>secure\u003C\u002FVirtualHost>\n    \u003C\u002FHTTPProxyConnection>\n\n    \u003CRouteRule name=\"default\">\n        \u003CTargetEndpoint>default\u003C\u002FTargetEndpoint>\n    \u003C\u002FRouteRule>\n\u003C\u002FProxyEndpoint>\n```\n\n### Security Headers Policy\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CAssignMessage name=\"Add-Security-Headers\">\n    \u003CDisplayName>Add Security Response Headers\u003C\u002FDisplayName>\n    \u003CSet>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Content-Type-Options\">nosniff\u003C\u002FHeader>\n            \u003CHeader name=\"X-Frame-Options\">DENY\u003C\u002FHeader>\n            \u003CHeader name=\"Strict-Transport-Security\">max-age=31536000; includeSubDomains\u003C\u002FHeader>\n            \u003CHeader name=\"Cache-Control\">no-store, no-cache, must-revalidate\u003C\u002FHeader>\n            \u003CHeader name=\"Content-Security-Policy\">default-src 'none'\u003C\u002FHeader>\n            \u003CHeader name=\"X-Request-ID\">{messageid}\u003C\u002FHeader>\n        \u003C\u002FHeaders>\n    \u003C\u002FSet>\n    \u003CRemove>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Powered-By\"\u002F>\n            \u003CHeader name=\"Server\"\u002F>\n        \u003C\u002FHeaders>\n    \u003C\u002FRemove>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n    \u003CAssignTo createNew=\"false\" transport=\"http\" type=\"response\"\u002F>\n\u003C\u002FAssignMessage>\n```\n\n## Advanced API Security\n\nEnable Apigee's Advanced API Security add-on for machine-learning-based threat detection:\n\n```bash\n# Enable Advanced API Security on Apigee X instance\ngcloud apigee organizations update $ORG_NAME \\\n  --advanced-api-security-config=enabled\n\n# View detected abuse alerts\ngcloud apigee apis security-reports list \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME\n\n# Create security action to block suspicious traffic\ngcloud apigee security-actions create \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME \\\n  --action-type=DENY \\\n  --condition-type=IP_ADDRESS \\\n  --condition-values=\"192.168.1.100,10.0.0.50\" \\\n  --description=\"Block identified malicious IPs\"\n```\n\n## Deployment\n\n```bash\n# Deploy proxy bundle with security policies\ngcloud apigee apis deploy \\\n  --api=$API_NAME \\\n  --environment=$ENV_NAME \\\n  --revision=$REVISION \\\n  --organization=$ORG_NAME\n\n# Validate deployment\ngcloud apigee apis list-deployments \\\n  --api=$API_NAME \\\n  --organization=$ORG_NAME\n```\n\n## References\n\n- Apigee JSON Threat Protection: https:\u002F\u002Fcloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-platform\u002Freference\u002Fpolicies\u002Fjson-threat-protection-policy\n- Google Cloud Apigee Security Best Practices: https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fbest-practices-securing-applications-and-apis-using-apigee\n- Apigee Advanced API Security: https:\u002F\u002Fdocs.cloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-security\n- Apigee OWASP API Top 10: https:\u002F\u002Fdocs.apigee.com\u002Fapi-platform\u002Ffaq\u002Fowasp-top-api-threats\n- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.wallarm.com\u002Fwhat\u002Fapigee-api-security-policies-howto\u002F\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Implementing API Threat Protection with Apigee\n\n## Overview\n\nGoogle Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.\n\n\n## When to Use\n\n- When deploying or configuring implementing api threat protection with apigee capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Google Cloud Platform account with Apigee organization provisioned\n- Apigee X or Apigee hybrid environment configured\n- Backend API services deployed and accessible from Apigee\n- Google Cloud CLI (gcloud) installed and authenticated\n- OpenAPI specification for target APIs\n- Understanding of Apigee proxy bundle structure\n\n## Core Security Policies\n\n### 1. JSON Threat Protection\n\nProtects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CJSONThreatProtection name=\"JSON-Threat-Protection-1\">\n    \u003CDisplayName>JSON Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003C!-- Maximum nesting depth of JSON structure -->\n    \u003CObjectEntryNameLength>50\u003C\u002FObjectEntryNameLength>\n    \u003CObjectEntryCount>25\u003C\u002FObjectEntryCount>\n    \u003CArrayElementCount>100\u003C\u002FArrayElementCount>\n    \u003CContainerDepth>5\u003C\u002FContainerDepth>\n    \u003CStringValueLength>500\u003C\u002FStringValueLength>\n\u003C\u002FJSONThreatProtection>\n```\n\n### 2. XML Threat Protection\n\nShields against XML bombs, XXE attacks, and oversized XML payloads:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CXMLThreatProtection name=\"XML-Threat-Protection-1\">\n    \u003CDisplayName>XML Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CNameLimits>\n        \u003CElement>50\u003C\u002FElement>\n        \u003CAttribute>50\u003C\u002FAttribute>\n        \u003CNamespacePrefix>20\u003C\u002FNamespacePrefix>\n        \u003CProcessingInstructionTarget>50\u003C\u002FProcessingInstructionTarget>\n    \u003C\u002FNameLimits>\n    \u003CValueLimits>\n        \u003CText>1000\u003C\u002FText>\n        \u003CAttribute>500\u003C\u002FAttribute>\n        \u003CNamespaceURI>256\u003C\u002FNamespaceURI>\n        \u003CComment>256\u003C\u002FComment>\n        \u003CProcessingInstructionData>256\u003C\u002FProcessingInstructionData>\n    \u003C\u002FValueLimits>\n    \u003CStructureLimits>\n        \u003CNodeDepth>5\u003C\u002FNodeDepth>\n        \u003CAttributeCountPerElement>5\u003C\u002FAttributeCountPerElement>\n        \u003CNamespaceCountPerElement>3\u003C\u002FNamespaceCountPerElement>\n        \u003CChildCount>25\u003C\u002FChildCount>\n    \u003C\u002FStructureLimits>\n\u003C\u002FXMLThreatProtection>\n```\n\n### 3. Regular Expression Threat Protection\n\nDetects SQL injection, XSS, and other injection patterns in request parameters:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CRegularExpressionProtection name=\"RegEx-Threat-Protection-1\">\n    \u003CDisplayName>Regex Injection Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n\n    \u003C!-- SQL Injection patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b))\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- XSS patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*<\\s*script\\b[^>]*>[^<]+<\\s*\u002F\\s*script\\s*>\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- Header injection -->\n    \u003CHeader name=\"*\">\n        \u003CPattern>[\\r\\n]\u003C\u002FPattern>\n    \u003C\u002FHeader>\n\n    \u003C!-- URI path traversal -->\n    \u003CURIPath>\n        \u003CPattern>(\u002F\\.\\.)|(\\.\\.\u002F)\u003C\u002FPattern>\n    \u003C\u002FURIPath>\n\n    \u003C!-- JSON body injection -->\n    \u003CJSONPayload>\n        \u003CJSONPath>$.*\u003C\u002FJSONPath>\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update))\u003C\u002FPattern>\n    \u003C\u002FJSONPayload>\n\u003C\u002FRegularExpressionProtection>\n```\n\n### 4. SpikeArrest Policy\n\nPrevents traffic spikes from overwhelming backend services:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CSpikeArrest name=\"Spike-Arrest-1\">\n    \u003CDisplayName>API Spike Arrest\u003C\u002FDisplayName>\n    \u003CRate>30ps\u003C\u002FRate> \u003C!-- 30 per second smoothed -->\n    \u003CIdentifier ref=\"request.header.x-api-key\"\u002F>\n    \u003CMessageWeight ref=\"request.header.x-request-weight\"\u002F>\n    \u003CUseEffectiveCount>true\u003C\u002FUseEffectiveCount>\n\u003C\u002FSpikeArrest>\n```\n\n### 5. OAuth 2.0 Token Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003COAuthV2 name=\"Verify-OAuth-Token\">\n    \u003CDisplayName>Verify OAuth 2.0 Access Token\u003C\u002FDisplayName>\n    \u003COperation>VerifyAccessToken\u003C\u002FOperation>\n    \u003CExternalAuthorization>false\u003C\u002FExternalAuthorization>\n    \u003CExternalAccessToken>request.header.Authorization\u003C\u002FExternalAccessToken>\n    \u003CSupportedGrantTypes>\n        \u003CGrantType>authorization_code\u003C\u002FGrantType>\n        \u003CGrantType>client_credentials\u003C\u002FGrantType>\n    \u003C\u002FSupportedGrantTypes>\n    \u003CScope>read write\u003C\u002FScope>\n    \u003CGenerateResponse enabled=\"true\"\u002F>\n\u003C\u002FOAuthV2>\n```\n\n### 6. API Key Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CVerifyAPIKey name=\"Verify-API-Key-1\">\n    \u003CDisplayName>Verify API Key\u003C\u002FDisplayName>\n    \u003CAPIKey ref=\"request.header.x-api-key\"\u002F>\n\u003C\u002FVerifyAPIKey>\n```\n\n## Proxy Bundle Configuration\n\n### Complete Secure Proxy Flow\n\n```xml\n\u003C!-- apiproxy\u002Fproxies\u002Fdefault.xml -->\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CProxyEndpoint name=\"default\">\n    \u003CPreFlow name=\"PreFlow\">\n        \u003CRequest>\n            \u003C!-- Step 1: Verify API Key or OAuth token -->\n            \u003CStep>\n                \u003CName>Verify-OAuth-Token\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 2: Rate limiting -->\n            \u003CStep>\n                \u003CName>Spike-Arrest-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 3: Threat protection -->\n            \u003CStep>\n                \u003CName>JSON-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"application\u002Fjson\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003CStep>\n                \u003CName>XML-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"text\u002Fxml\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003C!-- Step 4: Injection prevention -->\n            \u003CStep>\n                \u003CName>RegEx-Threat-Protection-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 5: CORS enforcement -->\n            \u003CStep>\n                \u003CName>CORS-Policy\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FRequest>\n        \u003CResponse>\n            \u003C!-- Remove internal headers from response -->\n            \u003CStep>\n                \u003CName>Remove-Internal-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Add security headers -->\n            \u003CStep>\n                \u003CName>Add-Security-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FResponse>\n    \u003C\u002FPreFlow>\n\n    \u003CFlows>\n        \u003CFlow name=\"sensitive-operations\">\n            \u003CDescription>Additional protection for sensitive endpoints\u003C\u002FDescription>\n            \u003CRequest>\n                \u003CStep>\n                    \u003CName>Quota-Strict\u003C\u002FName>\n                \u003C\u002FStep>\n            \u003C\u002FRequest>\n            \u003CCondition>(proxy.pathsuffix MatchesPath \"\u002Fadmin\u002F**\") or\n                       (proxy.pathsuffix MatchesPath \"\u002Fusers\u002F*\u002Fsensitive\")\u003C\u002FCondition>\n        \u003C\u002FFlow>\n    \u003C\u002FFlows>\n\n    \u003CHTTPProxyConnection>\n        \u003CBasePath>\u002Fv1\u003C\u002FBasePath>\n        \u003CVirtualHost>secure\u003C\u002FVirtualHost>\n    \u003C\u002FHTTPProxyConnection>\n\n    \u003CRouteRule name=\"default\">\n        \u003CTargetEndpoint>default\u003C\u002FTargetEndpoint>\n    \u003C\u002FRouteRule>\n\u003C\u002FProxyEndpoint>\n```\n\n### Security Headers Policy\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CAssignMessage name=\"Add-Security-Headers\">\n    \u003CDisplayName>Add Security Response Headers\u003C\u002FDisplayName>\n    \u003CSet>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Content-Type-Options\">nosniff\u003C\u002FHeader>\n            \u003CHeader name=\"X-Frame-Options\">DENY\u003C\u002FHeader>\n            \u003CHeader name=\"Strict-Transport-Security\">max-age=31536000; includeSubDomains\u003C\u002FHeader>\n            \u003CHeader name=\"Cache-Control\">no-store, no-cache, must-revalidate\u003C\u002FHeader>\n            \u003CHeader name=\"Content-Security-Policy\">default-src 'none'\u003C\u002FHeader>\n            \u003CHeader name=\"X-Request-ID\">{messageid}\u003C\u002FHeader>\n        \u003C\u002FHeaders>\n    \u003C\u002FSet>\n    \u003CRemove>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Powered-By\"\u002F>\n            \u003CHeader name=\"Server\"\u002F>\n        \u003C\u002FHeaders>\n    \u003C\u002FRemove>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n    \u003CAssignTo createNew=\"false\" transport=\"http\" type=\"response\"\u002F>\n\u003C\u002FAssignMessage>\n```\n\n## Advanced API Security\n\nEnable Apigee's Advanced API Security add-on for machine-learning-based threat detection:\n\n```bash\n# Enable Advanced API Security on Apigee X instance\ngcloud apigee organizations update $ORG_NAME \\\n  --advanced-api-security-config=enabled\n\n# View detected abuse alerts\ngcloud apigee apis security-reports list \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME\n\n# Create security action to block suspicious traffic\ngcloud apigee security-actions create \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME \\\n  --action-type=DENY \\\n  --condition-type=IP_ADDRESS \\\n  --condition-values=\"192.168.1.100,10.0.0.50\" \\\n  --description=\"Block identified malicious IPs\"\n```\n\n## Deployment\n\n```bash\n# Deploy proxy bundle with security policies\ngcloud apigee apis deploy \\\n  --api=$API_NAME \\\n  --environment=$ENV_NAME \\\n  --revision=$REVISION \\\n  --organization=$ORG_NAME\n\n# Validate deployment\ngcloud apigee apis list-deployments \\\n  --api=$API_NAME \\\n  --organization=$ORG_NAME\n```\n\n## References\n\n- Apigee JSON Threat Protection: https:\u002F\u002Fcloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-platform\u002Freference\u002Fpolicies\u002Fjson-threat-protection-policy\n- Google Cloud Apigee Security Best Practices: https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fbest-practices-securing-applications-and-apis-using-apigee\n- Apigee Advanced API Security: https:\u002F\u002Fdocs.cloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-security\n- Apigee OWASP API Top 10: https:\u002F\u002Fdocs.apigee.com\u002Fapi-platform\u002Ffaq\u002Fowasp-top-api-threats\n- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.wallarm.com\u002Fwhat\u002Fapigee-api-security-policies-howto\u002F\n",{"hide":54,"name":5,"source":55,"license":15,"description":7,"authorized_lab":50,"origin_frontmatter":56},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: implementing-api-threat-protection-with-apigee | description: Implement API threat protection using Google Apigee policies including |   JSON\u002FXML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for |   OWASP Top 10 defense. | domain: cybersecurity | subdomain: api-security | tags: | - apigee | - api-gateway | - threat-protection | - json-threat-protection | - xml-threat-protection | - spike-arrest | - oauth2 | - google-cloud | - owasp-api-top-10 | version: '1.0' | auth","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-implementing-api-threat-protection-with-apigee",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":54},[67,70,73],{"tool":68,"command":69},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-threat-protection-with-apigee",{"tool":71,"command":72},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-threat-protection-with-apigee",{"tool":74,"command":75},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-implementing-api-threat-protection-with-apigee","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-implementing-api-threat-protection-with-apigee\u002FSKILL.md",[],[79,102,126,154,179,198],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":49},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[87,88,33,89,90,91,92,93,94,95,96,97,98,99,100,101],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":49},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[109,110,89,111,112,113,114,115,116,117,118,95,119,97,120,121,122,123,124,125],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":135,"publishedAt":49},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[136,137,138,139,140,141,142,143,144,97,145,146,147,148,149,150,151,113,152,153],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":49},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[165,99,166,136,89,167,168,169,113,170,171,172,173,174,175,176,177,178,95,97],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":49},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[186,187,188,189,190,191,192,193,194,97,195,120,196,197],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":216,"publishedAt":49},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[204,207,210,213],{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":214,"categoryName":215,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[217,218,219,97,120,220,89,221,114,95,222],"writing","writing skills","new","work","editing","Existing"]