Api Recon And Docs

This is the skill you run first when targeting an API before you start poking at auth or business logic. It walks you through mining JavaScript bundles for endpoint patterns, checking standard doc paths like /swagger.json and /openapi.json, and hunting for version drift across /api/v1/, /mobile/, and legacy routes. The checklist focuses on extracting the stuff that matters: optional fields, deprecated endpoints that still work, and schema hints that expose hidden parameters. It's lean recon with clear routing at the end, sending you to BOLA testing if you find object IDs everywhere or JWT abuse if you spot role claims. Good first step that keeps you from missing surface area.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill api-recon-and-docs --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.

1. PRIMARY GOALS

Discover all reachable API entrypoints.
Extract schemas, optional fields, and role differences.
Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

2. RECON CHECKLIST

JavaScript and client mining

curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u

Common documentation and schema paths

/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql

Version and product drift

/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/

3. WHAT TO EXTRACT FROM DOCS

optional and undocumented fields
admin-only request examples
deprecated endpoints that may still be active
schema hints like additionalProperties: true
parameter names tied to filtering, sorting, IDs, roles, or tenancy

4. NEXT ROUTING

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Categories: Backend & APIs, Testing & QA, Git & Pull Requests, Documentation, Code Review & Quality
First seen: May 16, 2026