api-security-testing · davila7 — Claude Code skill: REST and GraphQL API checks

What api-security-testing does

The skill lays out an order of work for REST and GraphQL: enumerate endpoints and methods first, then move through authentication, authorization, input validation, rate limiting, a GraphQL phase, and error handling. Each phase names the companion skills to pull in — api-fuzzing-bug-bounty, broken-authentication, idor-testing, sql-injection-testing, scanning-tools, api-security-best-practices.

There is an eight-item checklist covering authentication, authorization, validation, rate limiting, sanitized errors, logging, CORS and HTTPS, plus quality gates: every endpoint exercised, findings written down, remediation attached, report produced. Think of it as a route for the agent rather than a scanner. It finds nothing on its own; it keeps the phases in the right order.

Testing an API you do not own or have permission to test is not something this skill makes acceptable — it only structures work you were already cleared to do. Several phases lean on other skills from the same repository, so without those installed the steps have nobody to run them.