Api Sec
- 2.5k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
api-sec is an agent skill that >-.
About
This is the routing entry point for API security testing Use this skill first to decide whether the API issue is mostly recon docs object authorization token trust or GraphQL hidden parameters then route to a deeper topic skill The target exposes REST APIs mobile backends or GraphQL endpoints You need to define API testing order before going into specific topics You want to handle object authorization JWT GraphQL and hidden fields as separate tracks API Recon and Docs api recon and docs SKILL md OpenAPI Swagger version drift hidden documentation API Authorization and BOLA api authorization and bola SKILL md BOLA BFLA method abuse hidden writable fields API Auth and JWT Abuse api auth and jwt abuse SKILL md bearer token header trust claim abuse rate limit bypass GraphQL and Hidden Parameters graphql and hidden parameters SKILL md introspection batching undocumented fields hidden parameters Observation Route Swagger or OpenAPI is present api recon and docs api recon and docs SKILL md IDs appear in URL JSON headers or GraphQL
- Entry P1 category router for API security. Use when choosing between API
- recon, authorization, token abuse, and hidden-parameter workflows before any
- This is the routing entry point for API security testing.
- Follow api-sec SKILL.md steps and documented constraints.
- Follow api-sec SKILL.md steps and documented constraints.
Api Sec by the numbers
- 2,496 all-time installs (skills.sh)
- +170 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #350 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
api-sec capabilities & compatibility
- Capabilities
- entry p1 category router for api security. use w · recon, authorization, token abuse, and hidden pa · this is the routing entry point for api security · follow api sec skill.md steps and documented con
- Use cases
- orchestration
What api-sec says it does
Entry P1 category router for API security. Use when choosing between API
recon, authorization, token abuse, and hidden-parameter workflows before any
This is the routing entry point for API security testing.
npx skills add https://github.com/yaklang/hack-skills --skill api-secAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.5k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 3 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
When should an agent use api-sec and what problem does it solve?
>-
Who is it for?
Developers invoking api-sec as documented in the skill source.
Skip if: Skip when requirements fall outside api-sec documented scope.
When should I use this skill?
>-
What you get
Outputs aligned with the api-sec SKILL.md workflow and stated deliverables.
- Selected API testing track
- Routed follow-on skill path
Files
API Security Router
This is the routing entry point for API security testing.
Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.
When to Use
- The target exposes REST APIs, mobile backends, or GraphQL endpoints
- You need to define API testing order before going into specific topics
- You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks
Skill Map
- API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
- API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
- API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
- GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters
Quick Triage
| Observation | Route |
|---|---|
| Swagger or OpenAPI is present | api-recon-and-docs |
| IDs appear in URL, JSON, headers, or GraphQL args | api-authorization-and-bola |
| JWT token visible in traffic | api-auth-and-jwt-abuse |
/graphql or batched JSON arrays are present | graphql-and-hidden-parameters |
| Registration, login, or profile updates accept extra fields | api-authorization-and-bola then api-auth-and-jwt-abuse |
Recommended Flow
1. Start with exposed endpoints and documentation assets 2. Then evaluate object-level and function-level authorization 3. Then evaluate token, header, signature, and rate-limit boundaries 4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse
Related Categories
- auth-sec
- business-logic-vuln
- recon-for-sec
Related skills
Setup Matt Pocock SkillsScaffold the per-repo configuration that Matt Pocock’s engineering agent skills rely on so they understand the issue tracker, triage labels, and domain documentation la495k196k
Lark AppsConnect Claude, Cursor or custom agents directly to Lark (Feishu) for messaging, document automation, approval workflows and enterprise data access.402k
CavemanSlash token usage by roughly 75% while keeping every technical detail intact when working with Claude Code, Cursor or similar agents.391k94.7k
Lark Skill MakerQuickly turn any Lark/Feishu OpenAPI call or multi-step workflow into a reusable agent skill with its own SKILL.md.386k16k
Running Claude Code Via Litellm CopilotRun Claude Code at a fraction of the cost by routing requests through LiteLLM to the GitHub Copilot Chat API.270k72
Codex PetGenerate a complete Codex Pet spritesheet and metadata from one reference image without needing an OpenAI key or Codex Pro.246k10How it compares
Pick api-sec to classify API attack surface and testing order before loading specialized Frida or deep GraphQL skills.
FAQ
What is api-sec?
>-
When should I use api-sec?
>-
Is api-sec safe to install?
Review the Security Audits panel on this page before production use.