api-security-best-practices
Secure APIs with Practical Design Patterns
API flaws can expose data, bypass authorization, and disrupt services. This skill provides implementation patterns and review checklists for common API security controls.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "api-security-best-practices" from https://skillstore.io/skills/sickn33-api-security-best-practices.md and its manifest at https://skillstore.io/api/skills/sickn33-api-security-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "api-security-best-practices". Review a profile endpoint that accepts a user ID and returns account details.
Expected outcome:
- High priority: enforce object-level authorization before loading the profile.
- Validate the identifier format and return consistent not-found responses.
- Select only approved response fields and exclude credentials or internal metadata.
Using "api-security-best-practices". Recommend controls for a public login endpoint used by web and mobile clients.
Expected outcome:
- Use uniform credential errors, secure password verification, and short-lived access tokens.
- Apply account-aware and network-aware rate limits with monitored escalation.
- Rotate refresh tokens, store token hashes, and revoke the token family after reuse.
Using "api-security-best-practices". Prepare a release checklist for a new payments API.
Expected outcome:
- Verify object and function authorization for every payment action.
- Test schema validation, idempotency, replay protection, quotas, and safe errors.
- Confirm audit logs exclude secrets while preserving actor, action, resource, and outcome.
Security Audit
Medium RiskAll 94 static findings are false positives caused by Markdown formatting, JavaScript examples, environment configuration, validation messages, and reference links. The skill contains no executable automation, prompt injection, file access, or network behavior. Its JWT example does store reusable refresh tokens in plaintext, creating replay risk after token or database disclosure.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (48)
🌐 Network access (5)
📁 Filesystem access (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-api-security-best-practices/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-api-security-best-practices?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-api-security-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-api-security-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-api-security-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). api-security-best-practices security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-api-security-best-practices/audits/5BibTeX citation
@techreport{sickn33-sickn33-api-security-best-practices-2026,
author = {sickn33},
title = {api-security-best-practices security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-api-security-best-practices/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-security-best-practices security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-api-security-best-practices/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-api-security-best-practices:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Design a New API
Select authentication, authorization, validation, rate limits, and error controls before implementation.
Review Existing Endpoints
Compare endpoint behavior against practical controls and the OWASP API Security Top 10.
Prepare Audit Evidence
Build a focused checklist for API controls, tests, logging, and unresolved risks.
Try These Prompts
Review this API endpoint: [details]. Identify authentication, authorization, validation, and error-handling gaps. Return prioritized recommendations and explain each risk.
Design authentication for [API type] serving [users]. Compare suitable methods, define token or session handling, and include revocation, rate limits, and failure responses.
Assess these endpoints and data flows: [inventory]. Map risks to OWASP API categories. Identify missing object, property, and function authorization checks.
Create a risk-based security test plan for [architecture]. Cover abuse cases, tenant isolation, token lifecycle, injection, resource consumption, logging, and release gates.
Best Practices
- Provide the framework, endpoint inventory, identity model, trust boundaries, and sensitive data types.
- Ask for findings prioritized by exploitability, impact, and implementation effort.
- Validate generated recommendations with tests, current library documentation, and environment-specific threat models.
Avoid
- Do not apply sample code unchanged without checking library versions and deployment assumptions.
- Do not treat authentication as authorization or rely only on client-supplied identifiers.
- Do not expose production secrets, tokens, personal data, or complete internal errors in prompts.
Frequently Asked Questions
Does this skill run a security scan?
Which API styles does it cover?
Can it design JWT authentication?
Does it cover authorization?
Can it prevent DDoS attacks?
Is its output sufficient for compliance?
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/api-security-best-practicesRef
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Maintenance freshness
7/26/2026
Usage
7 downloads · 113 views
File structure
📄 SKILL.md