MCP App StoreMCP App Store
from anthropic-cybersecurity-skills15,369
Structured workflow to test REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR), with techniques for discovery, exploitation checks, and rem
This skill provides a thorough, repeatable methodology to test APIs for Broken Object Level Authorization (BOLA / IDOR). It guides assessors through endpoint discovery, object ID mapping, authenticated baseline captures, horizontal and vertical privilege escalation checks, advanced techniques (parameter pollution, batch ID abuse, GraphQL relay IDs), and automation with Burp's Autorize. The outputs include test cases and a PoC report template.
Activate this skill during security assessments of multi-tenant SaaS APIs, mobile/backend APIs, or any service that exposes object identifiers (numeric IDs, UUIDs, slugs). Required when validating OWASP API1:2023 controls or implementing authorization testing in CI/CD. Important: use only with explicit written authorization.
Designed for security automation and testing agents (tools that can run scripts and interact with HTTP APIs), and pairs well with Burp-assisted manual testing and CI-based security checks.
BOLA/IDOR API security testing skill covering OWASP API1:2023. Provides a thorough SKILL.md with step-by-step workflow for testing REST and GraphQL APIs, including Burp Suite Autorize setup and advanced techniques like parameter pollution and method bypass. The bundled agent.py script is well-structured but requires a target URL argument and didn't run in dry mode since it needs a live API endpoint. No security concerns — the skill explicitly requires written authorization and the script makes no outbound calls without user-specified targets.
Legitimate security testing skill for OWASP API1:2023 (BOLA/IDOR). Well-documented with clear authorization requirements. The script exit code 1 is expected since no base_url was provided in DRY_RUN. No hardcoded creds, no destructive commands, no exfiltration. Niche but practical for its target audience of pentesters.
Anthropic Security Basics
Practical security practices for Anthropic Claude integrations: API key management, input validation, prompt-injection defenses, and output scanning.
IGF (Grapefruit) CLI
CLI skill to control the IGF (Grapefruit) dynamic instrumentation server for mobile security testing: enumerate Frida devices, inspect apps, run hooks, access f
Security Research Meta-Methodology
A structured vulnerability research framework distilled from 5600+ security docs, covering web injection, deserialization, binary exploitation, domain pentest,
Input Validation Checker
Automated guidance and code patterns for implementing robust input validation and secure-coding practices (OWASP-aligned).
Performing Threat Modeling with OWASP Threat Dragon
Use OWASP Threat Dragon to create data-flow diagrams, apply STRIDE/LINDDUN threat classifications, and generate threat-model reports to guide secure design revi
Nuxt Users
Add and configure user authentication, authorization, database and CLI tools for Nuxt 3/4 apps using the nuxt-users module.
Security Headers Generator
Auto-activating skill that generates and validates security HTTP headers and provides guidance for implementing secure header configurations.
Upstash Rate Limit TypeScript SDK
Guidance and practical examples for using Upstash's TypeScript rate-limit SDK (setup, common algorithms, and traffic-protection patterns).