Use Yaak
mountain-loop/yaak
A skill your agent uses when the user mentions Yaak, a Yaak workspace, or the yaak command, or asks to call, hit, or smoke test HTTP/REST endpoints, save or organize API requests for reuse or manual…
API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.
Install API Recon And Docs
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install yaklang/hack-skills api-recon-and-docs --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/api-recon-and-docs .claude/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .claude/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install yaklang/hack-skills api-recon-and-docs --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/api-recon-and-docs .agents/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .agents/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install yaklang/hack-skills api-recon-and-docs --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/api-recon-and-docs .cursor/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .cursor/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/yaklang/hack-skills.git --path skills/api-recon-and-docs--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install yaklang/hack-skills api-recon-and-docs --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/api-recon-and-docs .gemini/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .gemini/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install yaklang/hack-skills api-recon-and-docsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/api-recon-and-docs .github/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .github/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaklang/hack-skills --skill api-recon-and-docs -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install yaklang/hack-skills api-recon-and-docs --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/api-recon-and-docs .opencode/skills/api-recon-and-docs && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "api-recon-and-docs" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs into .opencode/skills/api-recon-and-docs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-recon-and-docs", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
api-recon-and-docs- GitHub stars
- 2.4k
- Token cost
- ~456 tokens
- SKILL.md length
- 160 words
- Files
- 1
- Skills in repo
- 26
- Repo updated
- First seen
- Licence
- MIT
At a glance
API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.
- Works in 4 steps: PRIMARY GOALS → RECON CHECKLIST → WHAT TO EXTRACT FROM DOCS → …
- Discovering endpoints
- SKILL.md covers 1. PRIMARY GOALS, 2. RECON CHECKLIST, 3. WHAT TO EXTRACT FROM DOCS and 4. NEXT ROUTING
- Calls curl
What it does
API Recon And Docs is an agent skill from yaklang/hack-skills. API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.
Its SKILL.md is about 460 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering OpenAPI specifications and API testing. It works with GraphQL. The repository describes itself as: Helping AI Agent become an awesome practical hacker! The licence is MIT.
When your agent uses it
- Discovering endpoints
- Surface area for API testing
Example prompts
- “/api-recon-and-docs”
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 6fbf0bc. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
curl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
API Recon And Docs loads about 456 tokens when it runs. Until then it costs about 46 tokens; SKILL.md has 160 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from yaklang/hack-skills at commit 6fbf0bc, republished under its MIT licence (© yaklang). 160 words, ~456 tokens.
Download SKILL.mdSave it as
.claude/skills/api-recon-and-docs/SKILL.md (or your agent's skills folder).- name
- api-recon-and-docs
- description
- API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.
SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface
AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.
1. PRIMARY GOALS
- Discover all reachable API entrypoints.
- Extract schemas, optional fields, and role differences.
- Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.
2. RECON CHECKLIST
JavaScript and client mining
curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -uCommon documentation and schema paths
/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gqlVersion and product drift
/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/3. WHAT TO EXTRACT FROM DOCS
- optional and undocumented fields
- admin-only request examples
- deprecated endpoints that may still be active
- schema hints like
additionalProperties: true - parameter names tied to filtering, sorting, IDs, roles, or tenancy
4. NEXT ROUTING
| Finding | Next Skill |
|---|---|
| object IDs everywhere | api authorization and bola |
| JWT, OAuth, role claims | api auth and jwt abuse |
| GraphQL or hidden fields | graphql and hidden parameters |
| strong auth boundary but suspicious business flow | business logic vulnerabilities |
© yaklang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/api-recon-and-docs of yaklang/hack-skills.
Open the folder on GitHubat commit 6fbf0bc
Compare with similar skills
API Recon And Docs next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| API Recon And Docs this skillyaklang/hack-skills | 2.4k | — | ~456 | Automated safety check: Pass | MIT | |
| Use Yaakmountain-loop/yaak | 19k | — | ~1.9k | Automated safety check: Pass | MIT | |
| API TesterRightNow-AI/openfang | 18k | — | ~807 | Automated safety check: Pass | Apache-2.0 | |
| API Test Planmohitagw15856/pm-claude-skills | 1.4k | — | ~1.1k | Automated safety check: Pass | MIT | |
| API DesignerJeffallan/claude-skills | 12k | 2 repos | ~2k | Automated safety check: Pass | MIT | |
| VibexRaja0sama/vibex | 388 | — | ~7.8k | Automated safety check: Pass | MIT |
Similar skills
API Tester
RightNow-AI/openfang
API testing expert for curl, REST, GraphQL, authentication, and debugging
API Test Plan
mohitagw15856/pm-claude-skills
Plan tests for an API endpoint or service — functional, negative, and contract.
API Designer
Jeffallan/claude-skills
Designs REST and GraphQL APIs from resource modeling to an OpenAPI 3.1 contract, with versioning, pagination and RFC 7807 error handling.
Vibex
Raja0sama/vibex
Diagrams and checkable docs from a codebase. An agent skill from Raja0sama/vibex.
Spikard
Goldziher/spikard
Scaffold Spikard projects and generate code from OpenAPI, AsyncAPI, OpenRPC, GraphQL, and Protobuf schemas using the Spikard CLI or its MCP server.
More from yaklang/hack-skills
All 26 skills in this repoAnti Debugging Techniques
yaklang/hack-skills
Anti-debugging detection and bypass playbook. An agent skill from yaklang/hack-skills.
API Auth And JWT Abuse
yaklang/hack-skills
API authentication and JWT abuse playbook. An agent skill from yaklang/hack-skills.
API Authorization And Bola
yaklang/hack-skills
API authorization and BOLA testing playbook. An agent skill from yaklang/hack-skills.
Attack Surface Mapping
yaklang/hack-skills
Draw a testable attack surface from one authorized target URL or one application.
Classical Cipher Analysis
yaklang/hack-skills
Classical cipher analysis playbook. An agent skill from yaklang/hack-skills.
Code Obfuscation Deobfuscation
yaklang/hack-skills
Code obfuscation analysis and deobfuscation playbook. An agent skill from yaklang/hack-skills.
Related
Works with
Categories
Questions about API Recon And Docs
What does API Recon And Docs do?
API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills. API Recon And Docs is an agent skill from yaklang/hack-skills. API reconnaissance and documentation review playbook.
When should I use API Recon And Docs?
API Recon And Docs fits situations like: discovering endpoints; surface area for API testing.
How do I install API Recon And Docs in Claude Code?
Run `npx skills add yaklang/hack-skills --skill api-recon-and-docs -a claude-code`. Or copy the skill folder (skills/api-recon-and-docs in yaklang/hack-skills) into .claude/skills/api-recon-and-docs in your project. Claude Code loads it when a task matches its description.
How do I install API Recon And Docs in Codex?
Run `npx skills add yaklang/hack-skills --skill api-recon-and-docs -a codex`. Or copy the skill folder (skills/api-recon-and-docs in yaklang/hack-skills) into .agents/skills/api-recon-and-docs in your project. Codex loads it when a task matches its description.
Can I use API Recon And Docs in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaklang/hack-skills --skill api-recon-and-docs -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/api-recon-and-docs, .gemini/skills/api-recon-and-docs, .github/skills/api-recon-and-docs and .opencode/skills/api-recon-and-docs in your project.
What does API Recon And Docs need to run?
Going by SKILL.md and its folder, API Recon And Docs needs the command-line tools its instructions call (curl).
Does API Recon And Docs access the network?
SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is API Recon And Docs safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does API Recon And Docs use?
API Recon And Docs is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does API Recon And Docs use?
About 456 tokens (SKILL.md is roughly 1.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to API Recon And Docs?
Skills that share tags, products or a category with API Recon And Docs: Use Yaak (mountain-loop/yaak, 19k stars), API Tester (RightNow-AI/openfang, 18k stars), API Test Plan (mohitagw15856/pm-claude-skills, 1.4k stars) and API Designer (Jeffallan/claude-skills, 12k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains API Recon And Docs?
yaklang (a GitHub organization) maintains it in yaklang/hack-skills, which has 2,394 GitHub stars. The repository holds 26 skills in this directory. The repository was last updated on September 13, 2026.
Source: yaklang/hack-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.