mcpbeat Sign in

API Security Best Practices Agent Skill

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

6k tokens
context cost
the whole folder, loaded on every use
31
files
instructions only
0
copies elsewhere
how many repositories repackaged it
505
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository
npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill api-security-best-practices

What comes with it

22 361 bytes besides the instruction
sub-skills/advanced-per-user-rate-limiting.md
sub-skills/authentication-authorization.md
sub-skills/authentication-flow.md
sub-skills/data-protection.md
sub-skills/ddos-protection-with-helmet.md
sub-skills/do-this.md
sub-skills/dont-do-this.md
sub-skills/example-1-implementing-jwt-authentication.md
sub-skills/example-2-input-validation-and-sql-injection-prevention.md
sub-skills/example-3-rate-limiting-and-ddos-protection.md
sub-skills/implementation-with-express-rate-limit.md
sub-skills/implementation.md
sub-skills/input-validation.md
sub-skills/monitoring-logging.md
sub-skills/problem-jwt-secret-exposed-in-code.md
sub-skills/problem-missing-authorization-checks.md
sub-skills/problem-verbose-error-messages.md
sub-skills/problem-weak-password-requirements.md
sub-skills/rate-limit-response-headers.md
sub-skills/rate-limiting-ddos-protection.md
sub-skills/security-best-practices.md
sub-skills/step-1-authentication-authorization.md
sub-skills/step-2-input-validation-sanitization.md
sub-skills/step-3-rate-limiting-throttling.md
sub-skills/step-4-data-protection.md
sub-skills/step-5-api-security-testing.md
sub-skills/the-problem.md
sub-skills/the-solution.md
sub-skills/validation-checklist.md
sub-skills/why-rate-limiting.md

The instruction itself

35 sections, as written by the author

API Security Best Practices

Overview

Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.

When to Use This Skill

  • Use when designing new API endpoints
  • Use when securing existing APIs
  • Use when implementing authentication and authorization
  • Use when protecting against API attacks (injection, DDoS, etc.)
  • Use when conducting API security reviews
  • Use when preparing for security audits
  • Use when implementing rate limiting and throttling
  • Use when handling sensitive data in APIs

How It Works

🧠 Knowledge Modules (Fractal Skills)

1. Step 1: Authentication & Authorization

2. Step 2: Input Validation & Sanitization

3. Step 3: Rate Limiting & Throttling

4. Step 4: Data Protection

5. Step 5: API Security Testing

6. Example 1: Implementing JWT Authentication

7. Authentication Flow

8. Implementation

9. Security Best Practices

10. Example 2: Input Validation and SQL Injection Prevention

11. The Problem

12. The Solution

13. Validation Checklist

14. Example 3: Rate Limiting and DDoS Protection

15. Why Rate Limiting?

16. Implementation with Express Rate Limit

17. Advanced: Per-User Rate Limiting

18. DDoS Protection with Helmet

19. Rate Limit Response Headers

20. ✅ Do This

21. ❌ Don't Do This

22. Problem: JWT Secret Exposed in Code

23. Problem: Weak Password Requirements

24. Problem: Missing Authorization Checks

25. Problem: Verbose Error Messages

26. Authentication & Authorization

27. Input Validation

28. Rate Limiting & DDoS Protection

29. Data Protection

30. Monitoring & Logging

Other skills for the same job

different authors, same section of the catalogue
Backend Security Coder
by ComeOnOliver
×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens
Cloud Penetration Testing
by ComeOnOliver
×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens
Codebase Cleanup Deps Audit
by ComeOnOliver
×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

10k tokens
Flow Nexus Platform
by ComeOnOliver
×2

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens
Linux Privilege Escalation
by ComeOnOliver
×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

8k tokens
Malware Analyst
by ComeOnOliver
×2

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

4k tokens
Metasploit Framework
by ComeOnOliver
×2

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens
Mobile Security Coder
by ComeOnOliver
×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take dokhacgiakhoa/api-security-best-practices from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.