Api Security Testing
- 30 installs
- 30.1k repo stars
- Updated August 4, 2026
- davila7/claude-code-templates
A workflow for testing REST and GraphQL API security covering endpoint discovery, authentication, authorization, rate limiting, and input validation.
About
A phased security-testing workflow for APIs that enumerates endpoints and tests auth, JWT/OAuth flows, rate limiting, and input validation. A developer or bug-bounty tester uses it to assess REST and GraphQL endpoint security.
- Phased flow from API discovery through authentication testing
- Routes to companion skills like api-fuzzing and broken-authentication
Api Security Testing by the numbers
- 30 all-time installs (skills.sh)
- Ranked #1,493 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/davila7/claude-code-templates --skill api-security-testingAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 30 |
|---|---|
| repo stars | ★ 30.1k |
| Last updated | August 4, 2026 |
| Repository | davila7/claude-code-templates ↗ |
What it does
A workflow for testing REST and GraphQL API security covering endpoint discovery, authentication, authorization, rate limiting, and input validation.
Files
API Security Testing Workflow
Overview
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
When to Use This Workflow
Use this workflow when:
- Testing REST API security
- Assessing GraphQL endpoints
- Validating API authentication
- Testing API rate limiting
- Bug bounty API testing
Workflow Phases
Phase 1: API Discovery
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingscanning-tools- API scanning
Actions
1. Enumerate endpoints 2. Document API methods 3. Identify parameters 4. Map data flows 5. Review documentation
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to discover API endpointsPhase 2: Authentication Testing
Skills to Invoke
broken-authentication- Auth testingapi-security-best-practices- API auth
Actions
1. Test API key validation 2. Test JWT tokens 3. Test OAuth2 flows 4. Test token expiration 5. Test refresh tokens
Copy-Paste Prompts
Use @broken-authentication to test API authenticationPhase 3: Authorization Testing
Skills to Invoke
idor-testing- IDOR testing
Actions
1. Test object-level authorization 2. Test function-level authorization 3. Test role-based access 4. Test privilege escalation 5. Test multi-tenant isolation
Copy-Paste Prompts
Use @idor-testing to test API authorizationPhase 4: Input Validation
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingsql-injection-testing- Injection testing
Actions
1. Test parameter validation 2. Test SQL injection 3. Test NoSQL injection 4. Test command injection 5. Test XXE injection
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API parametersPhase 5: Rate Limiting
Skills to Invoke
api-security-best-practices- Rate limiting
Actions
1. Test rate limit headers 2. Test brute force protection 3. Test resource exhaustion 4. Test bypass techniques 5. Document limitations
Copy-Paste Prompts
Use @api-security-best-practices to test rate limitingPhase 6: GraphQL Testing
Skills to Invoke
api-fuzzing-bug-bounty- GraphQL fuzzing
Actions
1. Test introspection 2. Test query depth 3. Test query complexity 4. Test batch queries 5. Test field suggestions
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to test GraphQL securityPhase 7: Error Handling
Skills to Invoke
api-security-best-practices- Error handling
Actions
1. Test error messages 2. Check information disclosure 3. Test stack traces 4. Verify logging 5. Document findings
Copy-Paste Prompts
Use @api-security-best-practices to audit API error handlingAPI Security Checklist
- [ ] Authentication working
- [ ] Authorization enforced
- [ ] Input validated
- [ ] Rate limiting active
- [ ] Errors sanitized
- [ ] Logging enabled
- [ ] CORS configured
- [ ] HTTPS enforced
Quality Gates
- [ ] All endpoints tested
- [ ] Vulnerabilities documented
- [ ] Remediation provided
- [ ] Report generated
Related Workflow Bundles
security-audit- Security auditingweb-security-testing- Web securityapi-development- API development
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85