API Security Testing Workflow

Trust Score 72/100

from antigravity-awesome-workspace-skill9

A comprehensive security testing framework for REST and GraphQL APIs, covering auth, rate limiting, and input validation.

triggers:api security testingaudit apigraphql securitytest rate limitingapi vulnerabilityrest api audit

GitHub SKILL.md

What it does

This skill provides a structured, multi-phase workflow for auditing the security of REST and GraphQL APIs. It transforms the agent from a general assistant into a security researcher capable of systematic vulnerability discovery.

When to use it

Activate this skill when tasked with API security audits, bug bounty hunting on API endpoints, or validating the security posture of a new API deployment.

What's included

Instructions: A 7-phase operational guide covering API Discovery, Authentication, Authorization, Input Validation, Rate Limiting, GraphQL-specific testing, and Error Handling.
Checklists: A comprehensive API Security Checklist to ensure no critical area (like CORS or HTTPS) is overlooked.
Quality Gates: Defined success criteria for documenting vulnerabilities and providing remediations.

Compatible agents

Designed for agents capable of invoking other specialized security skills (e.g., Codex, Claude Code) to perform the actual fuzzing and scanning.

Audit Summary

API security testing workflow skill that provides a phased checklist for REST/GraphQL security testing. No bundled scripts — purely instructional markdown. The skill delegates all actual work to other referenced skills (api-fuzzing-bug-bounty, broken-authentication, etc.) making it a meta-workflow rather than a standalone tool. Checklist items are generic and lack concrete methodology or tool-specific guidance.

Watch Out

Delegates all work to other skills that may not be installed
Copy-paste prompts are trivial one-liners with no real guidance
No scripts — entirely static instructional content

Notes

Safe skill — no security concerns. Main issue is it adds little standalone value beyond being a structured checklist. References to external skills (@api-fuzzing-bug-bounty, @idor-testing, etc.) have no guarantees those skills exist or are compatible.

Information

Repository: antigravity-awesome-workspace-skill
Stars: 9

Trust Score

Overall72

Security98

Code Quality50

Architecture40

Usefulness55

Related Skills

Bounty Hunter — Atlas

Persona skill: 'Atlas' — a profit-focused developer persona for discovering, evaluating and executing paid bounties or freelance tasks with ROI-aware workflows.

GraphQL Inspector — Validate

Validate GraphQL operations against a schema with configurable depth, complexity, alias and directive limits to catch errors before runtime.

arxiv2md

Convert arXiv papers into clean, LLM-ready Markdown via a REST API or CLI for fast reading, summarization, and downstream processing.

LAP CLI

CLI for compiling, searching, and managing API specifications into a compact agent-native format and generating/installing skills from specs.

Analyzing Ransomware Leak Site Intelligence

Collect and analyze ransomware data-leak site (DLS) postings to extract victim, group, sector, and timeline intelligence for threat hunting and risk assessment.

Anthropic Security Basics

Practical security practices for Anthropic Claude integrations: API key management, input validation, prompt-injection defenses, and output scanning.

Evaluating Threat Intelligence Platforms

Guides procurement, evaluation, and proof-of-concept testing for Threat Intelligence Platforms (MISP, OpenCTI, ThreatConnect, Anomali, EclecticIQ) based on inte

UXC — Unified eXecution CLI

Discover, inspect, and invoke schema-exposed remote interfaces (OpenAPI, GraphQL, gRPC, MCP, JSON-RPC) via a single CLI contract with deterministic JSON envelop

Back to Skills