Guide · Agent skill
How to use the API Security Testing Workflow agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The API Security Testing Workflow is an agent skill, a folder of instructions that an AI coding agent such as Claude loads when a task matches its description. This one gives the agent a structured checklist for assessing how secure a REST or GraphQL API is, covering authentication, authorisation, rate limiting, input validation, GraphQL settings and error handling. This guide shows you how to install it, how to ask for it in plain language, and what it will and will not do, so you can use it for an authorised assessment of an API you own or are permitted to test.
API Security Testing Workflowsickn33/agentic-awesome-skills · MIT Download the skill Quick start
- 1Download the ZIP. Get the skill ZIP from the directory page.
- 2Unzip into a skills folder. Extract it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project.
- 3Or upload in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the ZIP.
- 4Install the dependent skills. Add api-fuzzing-bug-bounty, broken-authentication, idor-testing, sql-injection-testing, api-security-best-practices and scanning-tools so each phase can run.
- 5State your target and authorisation. Give the exact API, the scope you are permitted to test and your test accounts.
- 6Confirm commands before they run. Review each command the agent proposes, check its expected effect and reply with explicit confirmation.
What the skill makes the agent do
The skill is a playbook with seven phases: API discovery, authentication testing, authorisation testing, input validation, rate limiting, GraphQL testing and error handling. Each phase lists actions to take and names other specialised skills to hand the technical work to, such as api-fuzzing-bug-bounty, broken-authentication, idor-testing and sql-injection-testing.
The skill also includes a checklist (authentication, authorisation, input validation, rate limiting, error sanitisation, logging, CORS and HTTPS enforcement) and quality gates such as documenting vulnerabilities, providing remediation and generating a report. It is not an automatic scanner; the file itself says it is not a substitute for expert review.
Install the skill
Option 1: download the ZIP from the directory page, then unzip it into your personal skills folder at ~/.claude/skills/ or into a project's .claude/skills/ folder. The skill's files, including SKILL.md, should end up inside a folder named for the skill.
Option 2: in the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Install the other skills it depends on
The workflow routes each phase to other skills. For those phases to work, the following must also be installed: api-fuzzing-bug-bounty, broken-authentication, idor-testing, sql-injection-testing, api-security-best-practices and scanning-tools. Without them, the referenced phases have nothing to call.
Trigger the skill with a natural request
Describe the task in plain words and name the API and your authorisation. The skill matches requests about REST API security, GraphQL endpoints, API authentication, rate limiting and bug bounty API testing. You can also call a phase directly with the prompts the skill provides, such as asking the agent to use the api-security-best-practices skill to test rate limiting.
- Review the security of the REST API at my staging environment, which I own. Start with discovery and tell me what to confirm first.
- Use the API security testing workflow to check authorisation on our orders endpoints. I have written permission and two test accounts.
- Audit the error handling of our GraphQL API without sending any intrusive requests.
Use @api-fuzzing-bug-bounty to discover API endpointsUnderstand the confirmation gate
Before any command that probes, exploits, changes, persists on, extracts data from or attempts credential access against a target, the skill requires a confirmation step. The agent asks you for the exact target URL, IP, account or resource, asks you to confirm written authorisation and permitted scope, shows the exact commands and their expected effect, then waits for explicit confirmation in the conversation.
Without that confirmation the agent stays read-only and gives defensive guidance only. The skill also asks you to define request, concurrency, byte and duration limits, stop conditions and cleanup before testing, and to use owned fixtures for destructive methods, injections, brute-force and resource exhaustion tests.
- Keep third-party systems and real customer data out of tests.
- Record untested endpoints rather than assuming all were tested.
- A public schema, a missing header or an HTTP 200 response alone does not prove an authorisation flaw or exploitable limit bypass.
Safety notes on scripts and network access
This skill does not run scripts and does not use the network itself. Any probing happens through the other skills it calls, and only after the confirmation gate is passed. Use a sandbox, disposable VM or controlled lab where possible.
You must have explicit written permission from the system owner. Probing systems without authorisation is illegal, and the skill's own warning says so.
Tips for a useful assessment
Prepare inputs before you start: the API's documentation or schema, the authentication method in use, and at least two test accounts with different roles so authorisation checks mean something.
Run one phase at a time and select only the phases you need. The skill itself advises against dispatching every listed skill automatically.
- Write down your stop conditions before testing begins.
- Keep a record of endpoints you did not test and why.
- Ask for remediation advice alongside each finding.
What people use it for
- Preparing an authorised pre-release security review of your own REST API.
- Mapping endpoints and documenting methods and parameters during discovery.
- Checking whether one user can reach another user's objects in a multi-tenant API.
- Reviewing a GraphQL endpoint's introspection, query depth and error settings in a lab.
- Auditing whether error responses leak stack traces or internal details.
Frequently asked questions
Is the API Security Testing Workflow skill free?
The skill is published under the MIT licence, as stated on the directory page. Check the licence file in the repository for the full terms before reuse.
How do I install an agent skill?
Download the ZIP from the directory page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps you can instead upload the ZIP under Settings, Capabilities, Skills.
What do I need before using this skill?
You need explicit written authorisation from the system owner, test accounts supplied by that owner, and the other skills it references installed. The skill does not provide authorisation itself.
Does the skill scan APIs automatically?
No. It is a structured checklist that routes each phase to other skills and waits for confirmation before any command that touches a live target. It is not a finished vulnerability scanner.
Can I use it on any API I want to test?
No. The skill is for educational use or authorised assessments only. Testing systems you do not own or lack written permission to test is illegal.
What is the alternative if I just want a vulnerability scan?
This skill is not designed for that. The file points to other skills and suggests expert review for the technical work, so a dedicated scanning tool or a professional assessment may suit you better.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits developers, security engineers and students who want a systematic, phase-by-phase methodology for an authorised API assessment, and it enforces a sensible confirmation step before anything touches a live target. It is a poor fit for anyone wanting an automated scan, testing without written permission, or testing production systems with real customer data.
Download the skill