# api-security-audit

A subagent that hunts for holes in REST API authentication, authorization and data handling. Handy before a release or after an incident.

- subagent · `type=agent` · Claude Code · 3202 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/api-security-audit.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/api-security-audit

## What it does

The subagent walks through a REST API on several fronts: token and session handling, role checks and access control bypasses, injection flaws, exposure of sensitive data. It also looks at GDPR, HIPAA and PCI DSS requirements, plus OWASP API Top 10 items, security headers and rate limiting.

It runs with `Read`, `Write`, `Edit` and `Bash`, so it can read project files, change them and execute commands. Findings come back as concrete fixes with code samples rather than vague advice. Typical jobs: a pre-release audit, incident triage, or a review of the security architecture.

Everything rests on the code sitting in your project, so without source access there is little to work with. The author suggests reaching for the agent early instead of waiting for a problem to surface in production.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --agent security/api-security-audit
```

2. **Manually: put the files in place**
- File: `.claude/agents/api-security-audit.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/api-security-audit.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/api-security-audit.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/api-security-audit.md

## When to use it
- check JWT and session handling for weak spots
- trace privilege escalation and access control bypasses
- assess SQL and NoSQL injection risk in request handlers
- map an API against GDPR, HIPAA or PCI DSS rules
- work through an incident and get remediation steps

## Example prompts
- Review the authentication in this REST API and list the weak points
- Find authorization bypasses in the role-protected endpoints
- Audit this API against the OWASP API Top 10

## Similar
- [mcp-security-audit](https://affpapa.org/en/nevibecode/skills/mcp-security-audit.md) — skill · 1100 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/security-auditor.md) — subagent · 10718 installs
- [test-engineer](https://affpapa.org/en/nevibecode/agents/test-engineer.md) — subagent · 9715 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md