Skip to content
Get packs

API Security Testing Workflow

Guides an agent through authorized security testing of REST and GraphQL APIs, phase by phase.

Source Download skill
Repository
sickn33/agentic-awesome-skills
Stars
49,023
Licence
MIT
Files
1 file

What it does

This is a structured checklist-style playbook for checking how secure a web API is. Once installed, the agent walks through seven phases: discovering endpoints, testing login and token handling, checking whether users can access only their own data, probing inputs for injection flaws, testing rate limits, reviewing GraphQL-specific settings, and auditing error messages. It routes each phase to other specialised skills and insists on a confirmation step before any command that touches a live target. Without that confirmation it stays read-only and gives defensive advice.

Great for

  • Developers or security engineers preparing an authorised assessment of their own API
  • Bug bounty hunters who already have written scope and test accounts for a programme
  • Students learning a systematic API security methodology in a lab environment

Skip it if

  • Testing any API you do not own or lack written permission to test, since probing systems without authorisation is illegal
  • Production systems with real customer data, because the skill's own guidance says to keep real data out of tests and to use sandboxes or owned fixtures
  • Users wanting a finished vulnerability scan; the file itself says it is not a substitute for expert review and mostly points to other skills for the actual technical work

Try asking

  • “Use the API security testing workflow to plan an authorised assessment of our staging REST API's authentication”
  • “Walk me through the GraphQL security phase for our test endpoint, starting read-only”
  • “Create a checklist and stop conditions for testing rate limiting on our sandbox API”
  • “Audit how our API error handling leaks stack traces, defensive view only”
Step-by-step guide: how to use API Security Testing WorkflowInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    api-security-testing.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip api-security-testing.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip api-security-testing.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State the exact target, your written authorisation and the permitted scope at the start so the confirmation gate passes cleanly.
  • Ask for read-only or defensive guidance first, then approve specific commands one at a time.
  • Define request limits, stop conditions and cleanup before any test, and ask the agent to log untested endpoints so coverage gaps are visible.

What's inside

  • SKILL.md

Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.