Hunt API
Encod3d-Sec/TORCH
API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse.
Comprehensive API security review against OWASP API Security Top 10 (2023).
Install API Security Review
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install OWASP/secure-agent-playbook api-security-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .claude/skills/api-security-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .claude/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install OWASP/secure-agent-playbook api-security-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .agents/skills/api-security-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .agents/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install OWASP/secure-agent-playbook api-security-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .cursor/skills/api-security-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .cursor/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/OWASP/secure-agent-playbook.git --path plugins/code-security-skills/skills/api-security-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install OWASP/secure-agent-playbook api-security-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .gemini/skills/api-security-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .gemini/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install OWASP/secure-agent-playbook api-security-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .github/skills/api-security-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .github/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add OWASP/secure-agent-playbook --skill api-security-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install OWASP/secure-agent-playbook api-security-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/code-security-skills/skills/api-security-review .opencode/skills/api-security-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "api-security-review" agent skill from https://github.com/OWASP/secure-agent-playbook/tree/main/plugins/code-security-skills/skills/api-security-review into .opencode/skills/api-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-security-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
api-security-review- GitHub stars
- 186
- Token cost
- ~744 tokens
- SKILL.md length
- 300 words
- Files
- 1
- Skills in repo
- 14
- Repo updated
- First seen
- Licence
- CC-BY-4.0
At a glance
Comprehensive API security review against OWASP API Security Top 10 (2023).
- Works in 5 steps: Discovery & Reconnaissance → Authentication Deep Dive → Assess All 10 OWASP API Risks with… → …
- Reviewing OpenAPI/Swagger specs
- SKILL.md covers Steps, Output and OWASP References
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
API Security Review is an agent skill from OWASP/secure-agent-playbook. Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.
Its SKILL.md is about 740 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Web application vulnerabilities, Security review and OpenAPI specifications. It works with OpenAPI, GraphQL and gRPC. The repository describes itself as: OWASP Secure Agent Playbook Project. The licence is CC-BY-4.0.
When your agent uses it
- Reviewing OpenAPI/Swagger specs
- Auditing REST/GraphQL/gRPC implementations
- Testing authentication mechanisms
- Checking API gateway configurations
Example prompts
- “/api-security-review”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Discovery & Reconnaissance
- Authentication Deep Dive
- Assess All 10 OWASP API Risks with attack scenarios
- Automated Testing
- API Gateway & Infrastructure Review
What it can do on your machine
Read from SKILL.md and the folder at commit 1b5fd4c. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
API Security Review loads about 744 tokens when it runs. Until then it costs about 92 tokens; SKILL.md has 300 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from OWASP/secure-agent-playbook at commit 1b5fd4c, republished under its CC-BY-4.0 licence (© OWASP). 300 words, ~744 tokens.
Download SKILL.mdSave it as
.claude/skills/api-security-review/SKILL.md (or your agent's skills folder).- name
- api-security-review
- description
- Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.
- license
- CC-BY-4.0
API Security Review
Perform comprehensive API security assessment following plays/api-security-review.md.
Steps
Discovery & Reconnaissance
- Parse OpenAPI/Swagger specs or scan code for endpoints
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
- Map API gateway and middleware configurations
- Enumerate all API versions and deprecated endpoints
Authentication Deep Dive
- JWT security (algorithm confusion, weak signing, token expiration)
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
- API key exposure and rotation policies
- Session management and token storage
Assess All 10 OWASP API Risks with attack scenarios:
- API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
- API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
- API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
- API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
- API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
- API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
- API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
- API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
- API9 Inventory — Shadow APIs, zombie endpoints, version confusion
- API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
Automated Testing
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
- Test for common vulnerabilities with specific payloads
- Validate rate limiting and throttling mechanisms
API Gateway & Infrastructure Review
- Kong, nginx, Envoy, AWS API Gateway configurations
- WAF rules and bypass opportunities
- TLS configuration and certificate validation
Output
Comprehensive API security report including:
- API surface inventory with authentication mechanisms
- Risk matrix with severity ratings for all 10 categories
- Detailed findings with proof-of-concept examples
- Exploit scenarios and business impact analysis
- Prioritized remediation roadmap with code examples
- Testing artifacts and vulnerability evidence
OWASP References
- OWASP API Security Top 10 (2023)
- OWASP ASVS v5.0 — V13: API and Web Service
- OWASP Testing Guide: WSTG-APIT
- OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0
© OWASP, CC-BY-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in plugins/code-security-skills/skills/api-security-review of OWASP/secure-agent-playbook.
Open the folder on GitHubat commit 1b5fd4c
Compare with similar skills
API Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| API Security Review this skillOWASP/secure-agent-playbook | 186 | — | ~744 | Automated safety check: Pass | CC-BY-4.0 | |
| Hunt APIEncod3d-Sec/TORCH | 329 | — | ~1.9k | Automated safety check: Pass | MIT | |
| API Architectcuriositech/some_claude_skills | 243 | 1 repos | ~1.4k | Automated safety check: Pass | MIT | |
| API ForgeEliasOulkadi/shokunin | 114 | — | ~2.9k | Automated safety check: Pass | MIT | |
| Use Yaakmountain-loop/yaak | 19k | — | ~1.9k | Automated safety check: Pass | MIT | |
| SpikardGoldziher/spikard | 123 | — | ~799 | Automated safety check: Pass | MIT |
Similar skills
API Architect
curiositech/some_claude_skills
Expert API designer for REST, GraphQL, gRPC architectures. An agent skill from curiositech/some_claude_skills.
API Forge
EliasOulkadi/shokunin
Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency.
Use Yaak
mountain-loop/yaak
A skill your agent uses when the user mentions Yaak, a Yaak workspace, or the yaak command, or asks to call, hit, or smoke test HTTP/REST endpoints, save or organize API requests for reuse or manual…
Spikard
Goldziher/spikard
Scaffold Spikard projects and generate code from OpenAPI, AsyncAPI, OpenRPC, GraphQL, and Protobuf schemas using the Spikard CLI or its MCP server.
API Design
yonatangross/orchestkit
API contract design for REST and GraphQL, covering resource shape, URL and header versioning with deprecation windows, RFC 9457 Problem Details error handling, and OpenAPI specs.
More from OWASP/secure-agent-playbook
All 14 skills in this repoPrd Securability Enhancement
OWASP/secure-agent-playbook
Enhance PRDs, feature specs, user stories, or product briefs with explicit OWASP ASVS coverage and FIASSE v1.0.4 SSEM implementation guidance — before code is written.
Securability Engineering Review
OWASP/secure-agent-playbook
Score a codebase, file, or merge request against the FIASSE v1.0.4 SSEM model — 0-10 per attribute, equal-weighted pillars, evidence-backed strengths and weaknesses, prioritized recommendations…
Securability Engineering
OWASP/secure-agent-playbook
Generate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10 attributes, Transparency and Least-Astonishment principles, ASVS-aligned controls, defensive boundary…
Agent Security Audit
OWASP/secure-agent-playbook
Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails.
AI Security Verification
OWASP/secure-agent-playbook
Comprehensive AI security verification using OWASP AI Security Verification Standard (AISVS) framework.
Code Review Security
OWASP/secure-agent-playbook
Security-focused code review mapped to OWASP Top 10 and ASVS.
Related
Categories
Questions about API Security Review
What does API Security Review do?
Comprehensive API security review against OWASP API Security Top 10 (2023). API Security Review is an agent skill from OWASP/secure-agent-playbook. Comprehensive API security review against OWASP API Security Top 10 (2023).
When should I use API Security Review?
API Security Review fits situations like: reviewing OpenAPI/Swagger specs; auditing REST/GraphQL/gRPC implementations; testing authentication mechanisms; checking API gateway configurations.
How do I install API Security Review in Claude Code?
Run `npx skills add OWASP/secure-agent-playbook --skill api-security-review -a claude-code`. Or copy the skill folder (plugins/code-security-skills/skills/api-security-review in OWASP/secure-agent-playbook) into .claude/skills/api-security-review in your project. Claude Code loads it when a task matches its description.
How do I install API Security Review in Codex?
Run `npx skills add OWASP/secure-agent-playbook --skill api-security-review -a codex`. Or copy the skill folder (plugins/code-security-skills/skills/api-security-review in OWASP/secure-agent-playbook) into .agents/skills/api-security-review in your project. Codex loads it when a task matches its description.
Can I use API Security Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add OWASP/secure-agent-playbook --skill api-security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/api-security-review, .gemini/skills/api-security-review, .github/skills/api-security-review and .opencode/skills/api-security-review in your project.
What does API Security Review need to run?
SKILL.md names no scripts, command-line tools or credentials: API Security Review is instructions for the agent only.
Does API Security Review access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is API Security Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does API Security Review use?
API Security Review is published under the CC-BY-4.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does API Security Review use?
About 744 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to API Security Review?
Skills that share tags, products or a category with API Security Review: Hunt API (Encod3d-Sec/TORCH, 329 stars), API Architect (curiositech/some_claude_skills, 243 stars), API Forge (EliasOulkadi/shokunin, 114 stars) and Use Yaak (mountain-loop/yaak, 19k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains API Security Review?
OWASP (a GitHub organization) maintains it in OWASP/secure-agent-playbook, which has 186 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on September 25, 2026.
Source: OWASP/secure-agent-playbook on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.