# api-fuzzing-bug-bounty

This skill guides security checks for REST, SOAP, and GraphQL APIs. Use it to structure authorized bug bounty work or an API security assessment.

- skill · `type=skill` · Claude Code · 139 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-fuzzing-bug-bounty
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/api-fuzzing-bug-bounty

## What it does

The skill lays out an API assessment, starting with documentation and endpoint discovery, then moving through authentication, access control, and HTTP method checks. It covers IDOR, authentication bypasses, injection flaws, and rate limits. GraphQL has its own schema and query testing guidance.

You’ll need Burp Suite or a comparable proxy, wordlists, Python for scripts, and familiarity with REST, GraphQL, or SOAP. That setup matters: some of the described tests depend on those tools and protocol knowledge. Run checks only against APIs you’re authorized to assess.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/api-fuzzing-bug-bounty
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill api-fuzzing-bug-bounty -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/api-fuzzing-bug-bounty/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/api-fuzzing-bug-bounty/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/api-fuzzing-bug-bounty/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/api-fuzzing-bug-bounty/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates api-fuzzing-bug-bounty
```

2. **Manually: put the files in place**
- File: `.github/skills/api-fuzzing-bug-bounty/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/api-fuzzing-bug-bounty
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/api-fuzzing-bug-bounty/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-fuzzing-bug-bounty

## When to use it
- discover API endpoints from available documentation
- check whether one user can access another user’s data
- test authentication and rate-limit controls
- probe REST and GraphQL requests for injection flaws
- compare responses across HTTP methods

## Example prompts
- Assess this REST API: find endpoints and test whether access controls are enforced.
- Check this GraphQL API for authorization flaws and injection points.
- Draft an API bug bounty test plan covering IDOR and rate limits.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md