Skip to main content
affpapa.org
RU EN
skill CX Codex

api-sec — Claude Code skill: what it does, how to install

Routes API security testing across REST, GraphQL, and mobile backends. Helps an agent choose the right testing track before running deep checks.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add yaklang/hack-skills --skill api-sec -a claude-code
Open on GitHub

What api-sec does

This skill acts as an entry triage router for API security assessments. When an agent identifies Swagger files, bearer tokens, or GraphQL queries, api-sec maps those signals directly to focused assessment tracks. It establishes an explicit order. Arbitrary probing stops here.

The routing logic relies on a triage matrix and a four-step flow. Recon and documentation drift route to api-recon-and-docs. Object-level flaws and BOLA go to api-authorization-and-bola. Tokens, header trust, and rate limits route to api-auth-and-jwt-abuse, while schema introspection shifts to graphql-and-hidden-parameters.

The skill does not execute vulnerability exploits directly. It functions purely as a classification router: without the deeper topic skills from the repository, the agent cannot proceed past the triage stage.

What it helps with

  • prioritize security testing tracks across REST and GraphQL targets
  • route authorization flaws and BOLA checks when IDs are detected
  • assign token and rate-limit bypass investigations
  • isolate GraphQL schema introspection and hidden parameter testing

Example prompts for the agent

  • We found an OpenAPI spec and several JSON endpoints. Plan our test sequence with api-sec.
  • The mobile API returns JWTs and exposes GraphQL. Which track should we run first?
  • Profile updates accept undocumented fields. Route this issue according to api-sec.

How to install api-sec

1Skills CLI (Vercel)

npx skills add yaklang/hack-skills --skill api-sec -a claude-code

2Manually: put the files in place

~/.claude/skills/api-sec/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/api-sec/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about api-sec

How to install api-sec in Claude Code?

Run npx skills add yaklang/hack-skills --skill api-sec -a claude-code in your terminal. The file is installed at ~/.claude/skills/api-sec/SKILL.md.

What does the api-sec skill do?

It acts as an entry routing point for API security assessments. The skill evaluates traffic indicators like Swagger, tokens, or batching, then sends the agent to dedicated sub-skills.

Does api-sec execute vulnerability scans directly?

No, it only sets testing priorities and workflow tracks. Actual vulnerability checks for BOLA, token claims, or GraphQL batching require deeper topic skills from the repository.

Source text

SKILL.md · MIT 
---
name: api-sec
description: >-
  Entry P1 category router for API security. Use when choosing between API
  recon, authorization, token abuse, and hidden-parameter workflows before any
  deeper API topic skill.
---

# API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

## When to Use

- The target exposes REST APIs, mobile backends, or GraphQL endpoints
- You need to define API testing order before going into specific topics
- You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

## Skill Map

- [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation
- [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields
- [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass
- [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters

## Quick Triage

| Observation | Route |
|---|---|
| Swagger or OpenAPI is present | [api-recon-and-docs](../api-recon-and-docs/SKILL.md) |
| IDs appear in URL, JSON, headers, or GraphQL args | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) |
| JWT token visible in traffic | [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) |
| `/graphql` or batched JSON arrays are present | [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/SKILL.md) |
| Registration, login, or profile updates accept extra fields | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) then [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) |

## Recommended Flow

1. Start with exposed endpoints and documentation assets
2. Then evaluate object-level and function-level authorization
3. Then evaluate token, header, signature, and rate-limit boundaries
4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse

## Related Categories

- [auth-sec](../auth-sec/SKILL.md)
- [business-logic-vuln](../business-logic-vuln/SKILL.md)
- [recon-for-sec](../recon-for-sec/SKILL.md)

© yaklang · MIT · yaklang/hack-skills

Similar skills

All skills for Security →
conducting-api-security-testing mahipal This skill tests REST, GraphQL, and gRPC APIs for access-control, authentication, validation, and business-logic flaws. Use it for authorized API assessments. CX Codex +1 643installs testing-api-for-broken-object-level-authorization mahipal Tests REST and GraphQL APIs for BOLA and IDOR flaws by swapping object identifiers across requests. Helps detect broken access controls between different user accounts. CX Codex +1 541installs api-audit briiirussell Walks your REST, GraphQL and RPC endpoints against the OWASP API Security Top 10 (2023). Useful when you want a pass over the API contract, not the whole codebase. CX Codex +1 482installs nestjs giuseppe-trisciuoglio Gives your agent NestJS patterns: CRUD modules, JWT guards, Drizzle schemas and migrations. Handy when you are building an API on NestJS. CX Codex +1 4,200installs api-and-interface-design addyosmani Guides API and module-boundary design with explicit contracts, validation, and consistent errors. Use it for REST, GraphQL, or public interfaces. CX Codex +1 62,600installs flask-api-development aj-geddes Builds modular Flask REST APIs using blueprints, SQLAlchemy ORM, and JWT authentication. It helps organize microservices and validate incoming request payloads. CX Codex +1 1,400installs

From the same set93

code-obfuscation-deobfuscation Binary deobfuscation playbook covering junk code, opaque predicates, control flow flattening, self-modifying code, and virtual machine protectors. CX Codex +1 4,000installs sqli-sql-injection A playbook for SQL injection work: which payloads to try first, how to fingerprint the DBMS, and how to pull data blind. CX Codex +1 4,000installs android-pentesting-tricks An Android pentesting playbook: SSL pinning bypass, exported component abuse, WebView attacks and intent redirection. Built for authorized mobile assessments. CX Codex +1 4,100installs business-logic-vulnerabilities A playbook for business logic bugs: race conditions, price tampering, workflow bypass, coupon abuse. Useful when the scanner finds nothing. CX Codex +1 3,900installs xss-cross-site-scripting A skill that feeds your coding agent non-obvious XSS vectors: context-specific payloads, WAF and CSP bypass. CX Codex +1 3,900installs waf-bypass-techniques A skill offering WAF evasion methods for injection testing. It guides payload mutation through encoding, chunked requests, and parser discrepancies. CX Codex +1 3,800installs api-auth-and-jwt-abuse A playbook for probing bearer tokens, API keys and claim trust. Useful when an API leans on JWT or request headers for identity. CX Codex +1 3,800installs 401-403-bypass-techniques A playbook for access-denied responses: what to try when an admin panel or API endpoint answers 401 or 403. CX Codex +1 3,800installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor