yaklang/hack-skills

api-sec

>- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

All-time #4080 Trending #6989 First seen Apr 8, 2026
8-week activity · all time api

Installation

$ npx skills add yaklang/hack-skills --skill api-sec

Also in this package

Other skills from yaklang/hack-skills · top by installs.

npx skills add yaklang/hack-skills

Browse all from yaklang/hack-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 2.1K
License LICENSE
Default branch main
Open issues 0
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 2,390 B
  • docs SUMMARY.md 188 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 3,217 installs

SKILL.md

API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

When to Use

  • The target exposes REST APIs, mobile backends, or GraphQL endpoints
  • You need to define API testing order before going into specific topics
  • You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

Skill Map

  • [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation
  • [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields
  • [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass
  • [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters

Quick Triage

Observation Route
Swagger or OpenAPI is present [api-recon-and-docs](../api-recon-and-docs/SKILL.md)
IDs appear in URL, JSON, headers, or GraphQL args [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md)
JWT token visible in traffic [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md)
/graphql or batched JSON arrays are present [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/SKILL.md)
Registration, login, or profile updates accept extra fields [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) then [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md)

Recommended Flow

  1. Start with exposed endpoints and documentation assets
  2. Then evaluate object-level and function-level authorization
  3. Then evaluate token, header, signature, and rate-limit boundaries
  4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse

Related Categories

  • [auth-sec](../auth-sec/SKILL.md)
  • [business-logic-vuln](../business-logic-vuln/SKILL.md)
  • [recon-for-sec](../recon-for-sec/SKILL.md)