Validate API Specifications with Spectral
Inconsistent API definitions can hide security and governance defects. This skill guides Spectral configuration, OWASP-focused linting, custom rules, reporting, and CI integration.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "api-spectral" from https://skillstore.io/skills/agentsecops-api-spectral.md and its manifest at https://skillstore.io/api/skills/agentsecops-api-spectral/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "api-spectral". Review an OpenAPI specification for missing authentication and insecure servers.
Expected outcome:
Using "api-spectral". Summarize a Spectral report for an application security review.
Expected outcome:
The report contains two errors and five warnings. Authentication and transport findings should block release; documentation warnings can enter the backlog.
Using "api-spectral". Plan CI enforcement for a large API portfolio.
Expected outcome:
Most alerts are false positives caused by Markdown, defensive examples, fixed local file reads, or reference URLs. Confirmed risks include unverified remote downloads, mutable CI dependencies, token exposure, and fail-open scanner steps. These supply-chain and enforcement weaknesses require remediation before publication.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-api-spectral/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-api-spectral?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-api-spectral?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-api-spectral/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-api-spectral.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). api-spectral security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-api-spectral/audits/9@techreport{agentsecops-agentsecops-api-spectral-2026,
author = {AgentSecOps},
title = {api-spectral security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-api-spectral/audits/9},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-spectral security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-api-spectral/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-api-spectral:audit:9"
description: "Skillstore immutable audit report identifier"
Find missing security schemes, insecure servers, exposed data patterns, and incomplete responses before implementation.
Define organization-specific Spectral checks and map findings to OWASP API Security categories.
Integrate specification linting, reports, artifacts, and severity thresholds into pull-request workflows.
Review [SPEC_PATH] with Spectral. Identify the correct base ruleset, run linting, and summarize security findings with locations and fixes.
Create a Spectral ruleset for [API_TYPE]. Enforce HTTPS, authentication, safe parameters, standard errors, and [ORGANIZATION_REQUIREMENT]. Explain each rule.
Analyze the Spectral report at [REPORT_PATH]. Group findings by OWASP API category, remove false positives, prioritize fixes, and define verification steps.
Design a CI policy for specifications under [SPEC_DIRECTORY]. Include pinned dependencies, immutable rules, failure handling, reports, exceptions, and phased severity enforcement.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
4 downloads · 463 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Validate Inputs Across Entry Points
by EIS-ITS
Input validation often becomes inconsistent across forms, APIs, and business rules. This skill guides Claude, Codex, and Claude Code toward secure validation patterns.
Protect Next.js Auth Routes
by AayushBaniya2006
Authentication changes often fail when teams mix session APIs and route guards. This skill guides Claude, Codex, and Claude Code toward the project helpers for secure access control.
Build Secure Backend Services
by sickn33
Backend flaws can expose data, accounts, and infrastructure. This skill guides secure implementation and review using established defensive patterns.
Review Web App Security Before Release
by sickn33
Security issues often appear when teams add authentication, APIs, payments, uploads, or sensitive data flows. This skill provides a focused checklist and review prompts for finding common web application risks before deployment.
Plan API Security Testing
by sickn33
API reviews can miss authorization flaws, unsafe inputs, weak rate limits, and exposed errors. This skill organizes authorized REST and GraphQL testing into seven focused phases.
Design Production-Ready APIs
by AutumnsGrove
Inconsistent API contracts create integration errors and costly migrations. This skill guides REST, GraphQL, OpenAPI, authentication, versioning, validation, and documentation decisions.