# api-security-testing

A skill that walks the agent through seven phases of API security work, from endpoint discovery to error handling. Useful when you need to probe an API for holes.

- skill · `type=skill` · Claude Code · 121 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-security-testing
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/api-security-testing

## What it does

The skill lays out an order of work for REST and GraphQL: enumerate endpoints and methods first, then move through authentication, authorization, input validation, rate limiting, a GraphQL phase, and error handling. Each phase names the companion skills to pull in — `api-fuzzing-bug-bounty`, `broken-authentication`, `idor-testing`, `sql-injection-testing`, `scanning-tools`, `api-security-best-practices`.

There is an eight-item checklist covering authentication, authorization, validation, rate limiting, sanitized errors, logging, CORS and HTTPS, plus quality gates: every endpoint exercised, findings written down, remediation attached, report produced. Think of it as a route for the agent rather than a scanner. It finds nothing on its own; it keeps the phases in the right order.

Testing an API you do not own or have permission to test is not something this skill makes acceptable — it only structures work you were already cleared to do. Several phases lean on other skills from the same repository, so without those installed the steps have nobody to run them.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/api-security-testing
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill api-security-testing -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/api-security-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/api-security-testing/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/api-security-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/api-security-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates api-security-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/api-security-testing/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/api-security-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/api-security-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-security-testing

## When to use it
- break API testing into stages and miss nothing
- check JWT, OAuth2 and token expiry behaviour
- catch IDOR at object and function level
- fuzz parameters for SQL, NoSQL and command injection
- test GraphQL introspection and query depth

## Example prompts
- Use @api-fuzzing-bug-bounty to discover our API endpoints
- Use @broken-authentication to test API authentication

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

## Other versions with the same name
- [api-security-testing · usestrix](https://affpapa.org/en/nevibecode/skills/usestrix-api-security-testing.md) — 12600 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 361 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md