Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/28/2026
What it changes
Passed 9 of 23 test cases with the skill, and 14 of 23 without it.
Without skill60%
With skill40%
Checks it passed that the model alone missed
The response demonstrates Express cors middleware configured with origin set to a specific domain string.
1 fixed16 passed either way4 still failing2 broke
Pass-rate lift
-20 pp
Tokens
+83%
Agent turns
0%
Response time
-8%
Model gemini-3.6-flashMeasured 8/28/2026v117 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
Developers often misconfigure Express CORS using cors({origin: '*'}) which breaks when credentials: true is needed. How do you programmatically configure Express cors middleware to safely support credentials for a specific trusted origin?
What was checked, without and with the skill
Checked
Without skill
With skill
The response demonstrates Express cors middleware configured with origin set to a specific domain string.
Missed
Passed
The response demonstrates Express cors middleware configured with credentials set to true.
Passed
Passed
case-22 · gemini-3.6-flash · 8/28/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md430 linessingle file
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
API Fuzzing for Bug Bounty
Purpose
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
Inputs/Prerequisites
Burp Suite or similar proxy tool
API wordlists (SecLists, api_wordlist)
Understanding of REST/GraphQL/SOAP protocols
Python for scripting
Target API endpoints and documentation (if available)