api-sec — Skills — getagentictools

What it does

The target exposes REST APIs, mobile backends, or GraphQL endpoints

You need to define API testing order before going into specific topics

You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation

API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields

API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass

GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters

Requirements & configuration

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

You need to define API testing order before going into specific topics

API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass

| JWT token visible in traffic | api-auth-and-jwt-abuse |

3. Then evaluate token, header, signature, and rate-limit boundaries

api sec

Source

Repository: https://github.com/yaklang/hack-skills

api-sec FAQ

What does the api-sec skill do?

>- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill. The target exposes REST APIs, mobile backends, or GraphQL endpoints You need to define API testing order before going into specific topics

What does api-sec require?

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill. You need to define API testing order before going into specific topics API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass | JWT token visible in traffic | api-auth-and-jwt-abuse | 3. Then evaluate token, header, signature, and rate-limit boundaries

How do I install api-sec?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill api-sec --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain api-sec?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[api-sec on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-api-sec?ref=badge)

npx agentictools info skills/yaklang-hack-skills-api-sec

The second line is the CLI lookup for this page — handy in READMEs and docs.