API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
981 tokens
context cost
the whole folder, loaded on every use
1
files
instructions only
1
copies elsewhere
how many repositories repackaged it
223
stars on the repo
on the repository, not the skill itself
Install
one command, takes just this skill from the repository
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
When to Use This Workflow
Use this workflow when:
Testing REST API security
Assessing GraphQL endpoints
Validating API authentication
Testing API rate limiting
Bug bounty API testing
Workflow Phases
Phase 1: API Discovery
Skills to Invoke
api-fuzzing-bug-bounty - API fuzzing
scanning-tools - API scanning
Actions
Enumerate endpoints
Document API methods
Identify parameters
Map data flows
Review documentation
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to discover API endpoints
Phase 2: Authentication Testing
Skills to Invoke
broken-authentication - Auth testing
api-security-best-practices - API auth
Actions
Test API key validation
Test JWT tokens
Test OAuth2 flows
Test token expiration
Test refresh tokens
Copy-Paste Prompts
Use @broken-authentication to test API authentication
Phase 3: Authorization Testing
Skills to Invoke
idor-testing - IDOR testing
Actions
Test object-level authorization
Test function-level authorization
Test role-based access
Test privilege escalation
Test multi-tenant isolation
Copy-Paste Prompts
Use @idor-testing to test API authorization
Phase 4: Input Validation
Skills to Invoke
api-fuzzing-bug-bounty - API fuzzing
sql-injection-testing - Injection testing
Actions
Test parameter validation
Test SQL injection
Test NoSQL injection
Test command injection
Test XXE injection
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API parameters
Phase 5: Rate Limiting
Skills to Invoke
api-security-best-practices - Rate limiting
Actions
Test rate limit headers
Test brute force protection
Test resource exhaustion
Test bypass techniques
Document limitations
Copy-Paste Prompts
Use @api-security-best-practices to test rate limiting
Phase 6: GraphQL Testing
Skills to Invoke
api-fuzzing-bug-bounty - GraphQL fuzzing
Actions
Test introspection
Test query depth
Test query complexity
Test batch queries
Test field suggestions
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to test GraphQL security
Phase 7: Error Handling
Skills to Invoke
api-security-best-practices - Error handling
Actions
Test error messages
Check information disclosure
Test stack traces
Verify logging
Document findings
Copy-Paste Prompts
Use @api-security-best-practices to audit API error handling
API Security Checklist
[ ] Authentication working
[ ] Authorization enforced
[ ] Input validated
[ ] Rate limiting active
[ ] Errors sanitized
[ ] Logging enabled
[ ] CORS configured
[ ] HTTPS enforced
Quality Gates
[ ] All endpoints tested
[ ] Vulnerabilities documented
[ ] Remediation provided
[ ] Report generated
Related Workflow Bundles
security-audit - Security auditing
web-security-testing - Web security
api-development - API development
Limitations
Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.