API Forge
EliasOulkadi/shokunin
Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency.
当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。
Install API Protocol Security
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaji2333/CkSKILLS api-protocol-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/api-protocol-security .claude/skills/api-protocol-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .claude/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaji2333/CkSKILLS api-protocol-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/api-protocol-security .agents/skills/api-protocol-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .agents/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaji2333/CkSKILLS api-protocol-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/api-protocol-security .cursor/skills/api-protocol-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .cursor/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/api-protocol-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaji2333/CkSKILLS api-protocol-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/api-protocol-security .gemini/skills/api-protocol-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .gemini/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaji2333/CkSKILLS api-protocol-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/api-protocol-security .github/skills/api-protocol-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .github/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaji2333/CkSKILLS api-protocol-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/api-protocol-security .opencode/skills/api-protocol-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "api-protocol-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/api-protocol-security into .opencode/skills/api-protocol-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "api-protocol-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
api-protocol-security- GitHub stars
- 112
- Token cost
- ~520 tokens
- SKILL.md length
- 137 words
- Files
- 1
- Skills in repo
- 15
- Repo updated
- First seen
- Licence
- MIT
At a glance
当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。
- Tasks that involve OpenAPI specifications
- SKILL.md covers 何时调用（触发条件）, 一、API/接口类场景表（全景）, 二、REST API 测试要点 and 三、GraphQL 专项, plus 5 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve GraphQL
What it does
API Protocol Security is an agent skill from zhaji2333/CkSKILLS. 当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。
Its SKILL.md is about 520 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering OpenAPI specifications, GraphQL and Realtime and WebSockets. It works with OpenAPI, GraphQL and gRPC. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.
When your agent uses it
- Tasks that involve OpenAPI specifications
- Tasks that involve GraphQL
- Tasks that involve Realtime and WebSockets
Example prompts
- “/api-protocol-security”
What it can do on your machine
Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
API Protocol Security loads about 520 tokens when it runs. Until then it costs about 45 tokens; SKILL.md has 137 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 137 words, ~520 tokens.
Download SKILL.mdSave it as
.claude/skills/api-protocol-security/SKILL.md (or your agent's skills folder).- name
- api-protocol-security
- description
- 当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。
api-protocol-security — API 与协议层安全专项深度挖掘
何时调用（触发条件）
- REST/GraphQL/gRPC/WebSocket 接口
- 接口文档暴露（Swagger/OpenAPI/api-docs）
- 调试端点（/actuator /debug /console /metrics）
- 旧版本接口（/api/v1 未下线）、内部接口外泄
- 路径已知的未授权 API / 网关（路径未知、无账号、独立 H5/迁域残留 → 先
unauth-path-key-hunt） - 微服务网关、反向代理
- HTTP 解析差异（走私）、缓存投毒
- 资源消耗类攻击（深层查询、巨型请求）
一、API/接口类场景表（全景）
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| REST API | 越权/注入/信息泄露 | 全方法测试(GET/POST/PUT/DELETE/PATCH) |
| GraphQL | 内省泄露/深度攻击/批量查询 | __schema查询、嵌套查询DoS、别名批量 |
| gRPC | 反序列化/未授权 | protobuf解析、接口鉴权 |
| WebSocket | 鉴权缺失/注入/越权 | 连接无token验证、消息可伪造 |
| 接口文档(Swagger/OpenAPI) | 敏感接口泄露 | /swagger-ui /api-docs暴露 |
| 调试接口 | 未授权访问/RCE | /actuator /debug /console |
| 旧版本接口 | 鉴权缺失/逻辑差异 | /api/v1旧版本未下线 |
| 内部接口外泄 | 未授权/敏感操作 | 内部RPC接口可公网访问 |
二、REST API 测试要点
- 每个接口测试全部 HTTP 方法（GET/POST/PUT/DELETE/PATCH/OPTIONS）
- 每个参数测试：正常值、空值、边界值、类型混淆、数组化、超长、特殊字符
- 鉴权测试：有 token/无 token/过期 token/其他用户 token
- 隐藏参数/调试参数全部尝试（debug=1、test=1、_method=PUT）
- BOLA（对象级授权）：遍历资源 ID、批量参数
- 速率限制：登录、验证码、短信、转账接口是否可绕过（IP/Header 伪造）
三、GraphQL 专项
- 内省查询：
{__schema{types{name}}}是否开放 - 深度攻击：嵌套查询（friends 循环）造成 DoS
- 别名批量：同一查询别名多次执行绕过速率限制
- 批量枚举：
user(id:1)遍历获取数据 - 越权：字段级权限缺失（隐藏字段可查）
四、WebSocket 专项
- 连接时是否验证 token（无鉴权直连）
- 消息伪造：他人会话/敏感操作
- 注入：SQL/命令注入点进入消息处理
- 越权：通过消息 ID 操作他人资源
五、HTTP 走私 / 协议层（O类）
- 反向代理解析差异（Content-Length vs Transfer-Encoding）
- 请求边界混淆 → 前置代理放行、后端走私
- 测试工具：
smuggler/ Burp 扩展 - 影响：缓存投毒、绕过鉴权、越权访问其他用户请求
六、资源消耗 DoS（P类）
- 正则灾难回溯（ReDoS）
- 巨型 JSON/XML 解析
- 图像炸弹（解压炸弹）
- 深度递归（GraphQL 嵌套）
- 无速率限制的批量接口
七、验证要点
- 全方法测试结果记录：每个方法的状态码/响应差异
- 未授权访问：直接调用管理接口/调试端点是否 200
- BOLA：A 用户 token 读取 B 用户数据即确认
- 走私：请求包能否污染下一个请求的响应
- 报告标注：接口文档暴露范围、可枚举数据量、速率限制缺失的影响
八、修复建议
- 统一网关鉴权，接口文档/调试端点仅内网开放
- 旧版本接口下线或同步鉴权
- GraphQL：关闭内省、深度/复杂度限制、别名限制
- WebSocket：连接鉴权 + 消息级权限校验
- 代理统一解析（规范 CL/TE）、禁止走私
- 速率限制：服务端按用户/IP，防 Header 伪造
© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/api-protocol-security of zhaji2333/CkSKILLS.
Open the folder on GitHubat commit 482fe78
Compare with similar skills
API Protocol Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| API Protocol Security this skillzhaji2333/CkSKILLS | 112 | — | ~520 | Automated safety check: Pass | MIT | |
| API ForgeEliasOulkadi/shokunin | 114 | — | ~2.9k | Automated safety check: Pass | MIT | |
| System Design CommunicationHoangNguyen0403/agent-skills-standard | 570 | — | ~894 | Automated safety check: Pass | MIT | |
| Use Yaakmountain-loop/yaak | 19k | — | ~1.9k | Automated safety check: Pass | MIT | |
| SpikardGoldziher/spikard | 123 | — | ~799 | Automated safety check: Pass | MIT | |
| Uxcholon-run/uxc | 115 | — | ~1.8k | Automated safety check: Pass | MIT |
Similar skills
System Design Communication
HoangNguyen0403/agent-skills-standard
Select how services talk: REST, gRPC, GraphQL, WebSocket, SSE, or webhook per hop, sync versus async per flow, service discovery mode, and DNS/edge routing.
Use Yaak
mountain-loop/yaak
A skill your agent uses when the user mentions Yaak, a Yaak workspace, or the yaak command, or asks to call, hit, or smoke test HTTP/REST endpoints, save or organize API requests for reuse or manual…
Spikard
Goldziher/spikard
Scaffold Spikard projects and generate code from OpenAPI, AsyncAPI, OpenRPC, GraphQL, and Protobuf schemas using the Spikard CLI or its MCP server.
Uxc
holon-run/uxc
Discover and call remote schema-exposed interfaces with UXC.
API Contract Detection
prime-radiant-inc/greenfield
Finds OpenAPI, GraphQL, Protobuf and JSON Schema files in a codebase and extracts behavioral claims from them as part of a reverse-engineering workflow.
More from zhaji2333/CkSKILLS
All 15 skills in this repoApk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
Business Logic Race
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
Related
Categories
Questions about API Protocol Security
What does API Protocol Security do?
当目标存在REST/GraphQL/gRPC/WebSocket接口、Swagger/OpenAPI文档、调试端点（actuator/console）、旧版本API、内部接口、微服务网关，或需要测试HTTP走私、DoS、速率限制时调用。负责API全方法测试、BOLA越权、GraphQL深度攻击、协议层漏洞挖掘。. API Protocol Security is an agent skill from zhaji2333/CkSKILLS.
When should I use API Protocol Security?
API Protocol Security fits situations like: tasks that involve OpenAPI specifications; tasks that involve GraphQL; tasks that involve Realtime and WebSockets.
How do I install API Protocol Security in Claude Code?
Run `npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a claude-code`. Or copy the skill folder (.agents/skills/api-protocol-security in zhaji2333/CkSKILLS) into .claude/skills/api-protocol-security in your project. Claude Code loads it when a task matches its description.
How do I install API Protocol Security in Codex?
Run `npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a codex`. Or copy the skill folder (.agents/skills/api-protocol-security in zhaji2333/CkSKILLS) into .agents/skills/api-protocol-security in your project. Codex loads it when a task matches its description.
Can I use API Protocol Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill api-protocol-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/api-protocol-security, .gemini/skills/api-protocol-security, .github/skills/api-protocol-security and .opencode/skills/api-protocol-security in your project.
What does API Protocol Security need to run?
SKILL.md names no scripts, command-line tools or credentials: API Protocol Security is instructions for the agent only.
Does API Protocol Security access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is API Protocol Security safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does API Protocol Security use?
API Protocol Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does API Protocol Security use?
About 520 tokens (SKILL.md is roughly 2.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to API Protocol Security?
Skills that share tags, products or a category with API Protocol Security: API Forge (EliasOulkadi/shokunin, 114 stars), System Design Communication (HoangNguyen0403/agent-skills-standard, 570 stars), Use Yaak (mountain-loop/yaak, 19k stars) and Spikard (Goldziher/spikard, 123 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains API Protocol Security?
zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 112 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.
Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.