Api Security Testing
- 743 installs
- 44k repo stars
- Updated July 27, 2026
- sickn33/antigravity-awesome-skills
api-security-testing is a phased agent workflow that tests REST and GraphQL API security covering authentication, authorization, rate limiting, and input validation before release or bug bounty work.
About
api-security-testing is a granular workflow skill from sickn33/antigravity-awesome-skills that guides agents through REST and GraphQL API security assessment. The workflow spans discovery, authentication checks, authorization testing, rate-limit validation, and input-validation review across multiple phases. Phase 1 invokes companion skills like api-fuzzing-bug-bounty and scanning-tools to enumerate endpoints before deeper testing. Developers and security engineers reach for api-security-testing before shipping API changes or when preparing bug bounty submissions. The skill is marked safe-risk and targets API-specific vulnerabilities rather than generic web app scanning, making it a structured alternative to ad hoc curl probes.
- Multi-phase workflow: API discovery, authentication testing, authorization testing, and follow-on API controls
- Copy-paste prompts to chain companion skills like api-fuzzing-bug-bounty and broken-authentication
- Covers REST and GraphQL endpoints, JWT, OAuth2, API keys, and token lifecycle checks
- Documented actions for enumerating methods, parameters, and data flows from API docs
Api Security Testing by the numbers
- 743 all-time installs (skills.sh)
- +18 installs in the week ending Jul 27, 2026 (Skillselion tracking)
- Ranked #440 of 2,209 Security skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Jul 28, 2026 (Skillselion catalog sync)
npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill api-security-testingAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 743 |
|---|---|
| repo stars | ★ 44k |
| Security audit | 3 / 3 scanners passed |
| Last updated | July 27, 2026 |
| Repository | sickn33/antigravity-awesome-skills ↗ |
How do you test REST API security before release?
Follow a phased REST and GraphQL API security workflow—discovery, auth, authorization, rate limits, and validation—before release or bounty work.
Who is it for?
Backend engineers and security testers who need a structured REST or GraphQL API security pass before production release or bounty submission.
Skip if: Frontend-only audits, infrastructure pentests, or teams without permission to probe live API endpoints.
When should I use this skill?
The user wants to test REST or GraphQL API security, validate authentication, check rate limiting, or prepare bug bounty API testing.
What you get
Enumerated endpoint map, auth and authorization findings, rate-limit test results, and input-validation vulnerability notes.
- Endpoint inventory
- Security findings report
Files
API Security Testing Workflow
Overview
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
When to Use This Workflow
Use this workflow when:
- Testing REST API security
- Assessing GraphQL endpoints
- Validating API authentication
- Testing API rate limiting
- Bug bounty API testing
Workflow Phases
Phase 1: API Discovery
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingscanning-tools- API scanning
Actions
1. Enumerate endpoints 2. Document API methods 3. Identify parameters 4. Map data flows 5. Review documentation
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to discover API endpointsPhase 2: Authentication Testing
Skills to Invoke
broken-authentication- Auth testingapi-security-best-practices- API auth
Actions
1. Test API key validation 2. Test JWT tokens 3. Test OAuth2 flows 4. Test token expiration 5. Test refresh tokens
Copy-Paste Prompts
Use @broken-authentication to test API authenticationPhase 3: Authorization Testing
Skills to Invoke
idor-testing- IDOR testing
Actions
1. Test object-level authorization 2. Test function-level authorization 3. Test role-based access 4. Test privilege escalation 5. Test multi-tenant isolation
Copy-Paste Prompts
Use @idor-testing to test API authorizationPhase 4: Input Validation
Skills to Invoke
api-fuzzing-bug-bounty- API fuzzingsql-injection-testing- Injection testing
Actions
1. Test parameter validation 2. Test SQL injection 3. Test NoSQL injection 4. Test command injection 5. Test XXE injection
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API parametersPhase 5: Rate Limiting
Skills to Invoke
api-security-best-practices- Rate limiting
Actions
1. Test rate limit headers 2. Test brute force protection 3. Test resource exhaustion 4. Test bypass techniques 5. Document limitations
Copy-Paste Prompts
Use @api-security-best-practices to test rate limitingPhase 6: GraphQL Testing
Skills to Invoke
api-fuzzing-bug-bounty- GraphQL fuzzing
Actions
1. Test introspection 2. Test query depth 3. Test query complexity 4. Test batch queries 5. Test field suggestions
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to test GraphQL securityPhase 7: Error Handling
Skills to Invoke
api-security-best-practices- Error handling
Actions
1. Test error messages 2. Check information disclosure 3. Test stack traces 4. Verify logging 5. Document findings
Copy-Paste Prompts
Use @api-security-best-practices to audit API error handlingAPI Security Checklist
- [ ] Authentication working
- [ ] Authorization enforced
- [ ] Input validated
- [ ] Rate limiting active
- [ ] Errors sanitized
- [ ] Logging enabled
- [ ] CORS configured
- [ ] HTTPS enforced
Quality Gates
- [ ] All endpoints tested
- [ ] Vulnerabilities documented
- [ ] Remediation provided
- [ ] Report generated
Related Workflow Bundles
security-audit- Security auditingweb-security-testing- Web securityapi-development- API development
Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets476k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.475k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.78.9k204
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.77.7k388
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.64.9k85How it compares
Use api-security-testing for structured API endpoint review; pair with dedicated fuzzing skills when the goal is deep payload mutation rather than workflow coverage.
FAQ
What API types does api-security-testing cover?
api-security-testing covers REST and GraphQL APIs across phased checks for authentication, authorization, rate limiting, and input validation. The workflow also supports bug bounty API testing scenarios.
What are the workflow phases in api-security-testing?
api-security-testing runs discovery first—enumerating endpoints with api-fuzzing-bug-bounty and scanning-tools—then authentication, authorization, rate-limit validation, and input-validation testing before release.
Is Api Security Testing safe to install?
skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.