Skills api-security-testing

📦

api-security-testing

Name: api-security-testing
Author: sickn33

Content revision r2 Safe ⚙️ External commands

Plan API Security Testing

API reviews can miss authorization flaws, unsafe inputs, weak rate limits, and exposed errors. This skill organizes authorized REST and GraphQL testing into seven focused phases.

Supports: Claude Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "api-security-testing" from https://skillstore.io/skills/sickn33-api-security-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-api-security-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-api-security-testing.md Signed manifest GET /api/skills/sickn33-api-security-testing/manifest Signed lockfile GET /api/skills/sickn33-api-security-testing/lockfile

Test it

Using "api-security-testing". Create an authorization test plan for a multi-tenant REST API.

Expected outcome:

Scope: Verify object, function, role, and tenant boundaries across documented endpoints.
Method: Compare permitted and denied requests for each role using approved test accounts.
Evidence: Record request context, expected policy, actual result, impact, and remediation.

Using "api-security-testing". Review the test coverage for a GraphQL endpoint.

Expected outcome:

Discovery: Inventory queries, mutations, types, and enabled introspection within the approved schema.
Controls: Check depth, complexity, batching, field suggestions, authentication, authorization, and sanitized errors.
Quality gate: Document confirmed issues, supporting evidence, severity, and practical remediation.

Security Audit

Safe

v5 • 7/23/2026 Open versioned report

All 26 static alerts are false positives caused by inline and fenced Markdown backticks in SKILL.md. The skill contains no executable commands, scripts, prompt injection, or malicious intent.

Files scanned

177

Lines analyzed

Review items

False positives ignored

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-api-security-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-api-security-testing/security.svg)](https://skillstore.io/skills/sickn33-api-security-testing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-api-security-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-api-security-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-api-security-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). api-security-testing security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-api-security-testing/audits/5

BibTeX citation

@techreport{sickn33-sickn33-api-security-testing-2026,
  author = {sickn33},
  title = {api-security-testing security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-api-security-testing/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-security-testing security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-api-security-testing/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-api-security-testing:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a New API

Build a pre-release checklist for authentication, authorization, validation, rate limiting, and error handling.

Plan a Security Assessment

Create a phased REST or GraphQL assessment with evidence requirements and quality gates.

Structure Authorized Research

Map approved endpoints and test categories before conducting controlled vulnerability research.

Try These Prompts

Create a Basic Checklist

Create a security checklist for my [REST or GraphQL] API. Cover authentication, authorization, input validation, rate limiting, errors, HTTPS, CORS, and logging.

Plan Identity Controls

Plan authentication and authorization tests for [API]. Include [roles], token lifecycle, object access, function access, privilege changes, and tenant isolation.

Build a Controlled Test Matrix

Design a test matrix for [endpoints] within [scope]. Include expected results, safe inputs, rate limits, stop conditions, evidence, and remediation fields.

Design a Comprehensive Assessment

Produce a seven-phase REST and GraphQL security plan for [system]. Prioritize risks, map roles and data flows, define controls, and specify quality gates.

Best Practices

Confirm written authorization, scope, test accounts, rate limits, and stop conditions before sending requests.
Start with documented endpoints and low-impact checks, then increase test depth only within approved boundaries.
Record reproducible evidence and separate confirmed vulnerabilities from observations that require validation.

Avoid

Do not test production systems without explicit authorization and an approved impact plan.
Do not treat generic checklists as proof that an API is secure.
Do not run brute force, resource exhaustion, or injection tests without controlled limits and monitoring.

Frequently Asked Questions

Does this skill run security tools?

No. It provides a structured workflow, checklists, prompts, and references to companion skills.

Does it support both REST and GraphQL?

Yes. Shared phases cover REST and GraphQL, with a dedicated phase for GraphQL-specific controls.

What access information should I provide?

Provide approved endpoints, roles, test accounts, token flows, tenant boundaries, rate limits, and prohibited actions.

Can I use it against a production API?

Only with explicit authorization, controlled limits, monitoring, stop conditions, and an approved impact plan.

Does the workflow prove an API is secure?

No. It improves coverage, but qualified reviewers must validate results and assess environment-specific risks.

Which companion skills are referenced?

It references API fuzzing, scanning, authentication, authorization, injection testing, security auditing, and web security workflows.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/api-security-testing

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/26/2026

Usage

4 downloads · 106 views

File structure

📄 SKILL.md