name: API安全 slug: api-sec version: 1.0.0 displayName: API安全 description: > API安全技能，帮助AI Agent进行安全测试和漏洞检测。 summary: "API安全技能，帮助AI Agent进行安全测试和漏洞检测。 " license: MIT category: 安全与渗透测试 framework: - Claude Code - Codex - Hermes Agent - OpenClaw - QClaw - WorkBuddy platform: multi-platform homepage: https://github.com/1991513ccie-png repository: https://github.com/1991513ccie-png

API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

When to Use

• The target exposes REST APIs, mobile backends, or GraphQL endpoints
• You need to define API testing order before going into specific topics
• You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

Skill Map

• API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
• API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
• API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
• GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters

Quick Triage

Recommended Flow

1. Start with exposed endpoints and documentation assets
2. Then evaluate object-level and function-level authorization
3. Then evaluate token, header, signature, and rate-limit boundaries
4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse

Related Categories

• auth-sec

  来源于7w4.net。

• business-logic-vuln
• recon-for-sec

这是一个偏向框架性质的API安全测试入口技能，优点是分类清晰、流程明确，能帮助理清API安全测试的思路。但实际内容较为单薄，主要是路由指引而缺乏具体的测试方法和技术细节，且依赖的子模块并未包含在包中。作为独立Skill使用价值有限，适合作为学习参考但难以直接用于真实安全测试场景。