Api Sec

This is a triage router that helps you figure out which API security testing path to take before diving deep. It splits API work into four lanes: recon and docs (Swagger, OpenAPI), authorization bugs (BOLA, BFLA), token abuse (JWT manipulation, header trust), and GraphQL plus hidden parameters. The quick triage table is genuinely useful if you're staring at API traffic and need to decide where to start. It won't do the testing for you, but it keeps you from wandering into JWT attacks when the real issue is a missing object-level check. Think of it as a decision tree that saves you from testing everything at once.

skills.sh installs: 4.1K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill api-sec --agent claude-code

Installs into .claude/skills of the current project.

Files

API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

When to Use

The target exposes REST APIs, mobile backends, or GraphQL endpoints
You need to define API testing order before going into specific topics
You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

Skill Map

API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters