api-sec

SKILL.md

API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

When to Use

The target exposes REST APIs, mobile backends, or GraphQL endpoints

You need to define API testing order before going into specific topics

You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

Skill Map

API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation

API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields

API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass

GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters