Skip to content
Get packs

API Fuzzing for Bug Bounty

Guides an agent through security testing of REST, SOAP and GraphQL APIs, with authorization gates.

Source Download skill
Repository
sickn33/agentic-awesome-skills
Stars
49,023
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a playbook of techniques for finding security weaknesses in web APIs, the interfaces that apps use to talk to servers. It covers finding hidden endpoints, testing logins, checking whether one user can access another user's data (IDOR), injection attacks, and GraphQL-specific probes. It also instructs the agent to stop and ask for the exact target, written authorization and scope before running any probing or exploit command, and otherwise stay read-only and give defensive advice.

Great for

  • Security professionals running authorized penetration tests or bug bounty programs on targets they have permission to test
  • Developers or QA engineers validating their own APIs in a sandbox or lab before release
  • Students learning API security in a controlled, deliberately vulnerable environment

Skip it if

  • Testing any system without explicit written permission, since the techniques are attack methods and unauthorized use is illegal
  • Production systems with real user data, because payloads such as SQL injection, DoS-style nested GraphQL queries and login brute force can cause damage or expose personal information
  • Anyone expecting a fully automated scanner; the payloads are hypotheses that need human judgment to confirm

Try asking

  • “Map the endpoints of our staging API at the URL I'll give you and list likely IDOR candidates, after confirming scope and authorization”
  • “Explain how GraphQL introspection works and how to check whether ours is exposed in a lab environment”
  • “Review our REST login endpoints for missing rate limiting and describe defensive fixes”
  • “Walk me through the authorization checks an API should enforce to prevent one user reading another's orders”
Step-by-step guide: how to use API Fuzzing for Bug BountyInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    api-fuzzing-bug-bounty.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip api-fuzzing-bug-bounty.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip api-fuzzing-bug-bounty.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always provide the exact target, written authorization and scope up front so the agent can pass its confirmation gate.
  • Use a controlled lab or disposable test accounts and canary records rather than real customer data.
  • Ask for defensive remediation advice alongside findings, and keep rate and concurrency limits within the rules of engagement.

What's inside

  • SKILL.md

Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.