Skip to main content
affpapa.org
RU EN
subagent

api-security-audit — Claude Code subagent: REST API security review

A subagent that hunts for holes in REST API authentication, authorization and data handling. Handy before a release or after an incident.

Install into Claude Code · claude-code-templates All methods and platforms ↓ 
npx claude-code-templates@latest --agent security/api-security-audit
Open on GitHub

What api-security-audit does

The subagent walks through a REST API on several fronts: token and session handling, role checks and access control bypasses, injection flaws, exposure of sensitive data. It also looks at GDPR, HIPAA and PCI DSS requirements, plus OWASP API Top 10 items, security headers and rate limiting.

It runs with Read, Write, Edit and Bash, so it can read project files, change them and execute commands. Findings come back as concrete fixes with code samples rather than vague advice. Typical jobs: a pre-release audit, incident triage, or a review of the security architecture.

Everything rests on the code sitting in your project, so without source access there is little to work with. The author suggests reaching for the agent early instead of waiting for a problem to surface in production.

What it helps with

  • check JWT and session handling for weak spots
  • trace privilege escalation and access control bypasses
  • assess SQL and NoSQL injection risk in request handlers
  • map an API against GDPR, HIPAA or PCI DSS rules
  • work through an incident and get remediation steps

Example prompts for the agent

  • Review the authentication in this REST API and list the weak points
  • Find authorization bypasses in the role-protected endpoints
  • Audit this API against the OWASP API Top 10

How to install api-security-audit

1claude-code-templates

npx claude-code-templates@latest --agent security/api-security-audit

2Manually: put the files in place

.claude/agents/api-security-audit.md

For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean

Questions about api-security-audit

How do I install api-security-audit in Claude Code?

Run npx claude-code-templates@latest --agent security/api-security-audit, then confirm the agent file landed at .claude/agents/api-security-audit.md.

What does api-security-audit do?

It looks for REST API vulnerabilities: token and session problems, authorization gaps, injection attacks, data exposure. It also checks the API against security standards.

Which tools can the subagent use?

Read, Write, Edit and Bash. That means it can inspect project code, edit files and run terminal commands.

Similar subagents

All subagents for Security →
mcp-security-audit official github Audits MCP server configurations for exposed secrets, shell injection, mutable package references, and unapproved servers. Use it before changing .mcp.json. 1,100installs code-reviewer official Anthropic This subagent checks code changes for bugs, security issues, and project-rule violations. Use it when a review should focus on findings that matter. 31,050installs security-auditor official Anthropic This subagent searches code for security flaws and gives engineers concrete fixes. Use it to review a project before hardening or modernization work. 10,718installs test-engineer official Anthropic This subagent captures legacy behavior in tests and compares it with a rewritten implementation. Use it before changing existing modules. 9,715installs code-reviewer VoltAgent Community Reviews code changes for bugs, security flaws and maintenance issues. Use it before merging complex work or auditing a project. 31,050installs security-auditor VoltAgent Community Audits security controls, vulnerabilities, risks, and compliance gaps across systems, infrastructure, and processes. Use it when you need documented findings. 10,718installs devops-engineer VoltAgent Community This subagent reviews infrastructure and helps with CI/CD, containers, and deployment workflows. Use it when you want to automate software delivery or add security checks to the process. 7,392installs

From the same set495

The whole set →
architecture-review A Claude slash command that maps your project structure, patterns and dependencies, then hands back an improvement plan. Useful before a big refactor. 3,419installs update-search-year This hook appends the current year to WebSearch queries that lack one. Useful when you want fresh results instead of last year's pages. 3,412installs technical-researcher A subagent that digs through repositories and technical docs, then hands back a JSON report with metrics and implementation advice. 3,344installs lint-on-save The hook fires a linter right after the agent changes a file. ESLint, Pylint or RuboCop runs on its own, no manual call needed. 3,235installs git-flow-manager A Claude subagent that creates Git Flow branches, merges them, tags releases and opens pull requests. Useful when the branching scheme is strict but nobody follows it by hand. 3,127installs todo Keeps a project task list in todos.md without leaving the chat: add, complete, remove, list. Handy when a full tracker is overkill. 2,723installs explain-code A slash command that walks an agent through unfamiliar code: what it does, how it is built, where it breaks. Useful for inherited files and old projects. 2,492installs research-orchestrator Coordinates multi-phase deep research projects in Claude Code. The subagent plans the workflow and assigns tasks to specialized investigation agents. 2,448installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor