Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

API Security Testing Workflow · sickn33 | DecimalAI

sickn33/api-security-testing

SkillScore50Maintained

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

Securityby sickn33

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/sickn33-api-security-testing/SKILL.md

decimalai skills pull sickn33-api-security-testing --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/sickn33-api-security-testing/SKILL.md https://app.decimal.ai/s/sickn33-api-security-testing/SKILL.md

Raw file: /s/sickn33-api-security-testing/SKILL.md ↗ · machine-readable summary at /s/sickn33-api-security-testing.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 30d ago

Yes — +14% lift-2% tokens0% turns50% of whole cases pass with skill (11/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-5%	0%
case-11	✗→✓	▲ Improved	-40%	0%
case-12	✗→✓	▲ Improved	-47%	0%
case-18	✗→✓	▲ Improved	10%	0%
case-14	✓→✗	▼ Worse	-5%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/9/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sickn33 / antigravity-awesome-skills

plugins/agentic-bundle-aas-security-engineer/skills/api-security-testing/SKILL.md

View on GitHub ↗

License MITImported 8/9/2026Version v1

Skill contents

SKILL.md

API Security Testing Workflow

Overview

Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.

When to Use This Workflow

Use this workflow when:

Testing REST API security
Assessing GraphQL endpoints
Validating API authentication
Testing API rate limiting
Bug bounty API testing

Workflow Phases

Phase 1: API Discovery

Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
scanning-tools - API scanning

Actions

Enumerate endpoints
Document API methods
Identify parameters
Map data flows
Review documentation

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to discover API endpoints

Phase 2: Authentication Testing

Skills to Invoke

broken-authentication - Auth testing
api-security-best-practices - API auth

Actions

Test API key validation
Test JWT tokens
Test OAuth2 flows
Test token expiration
Test refresh tokens

Copy-Paste Prompts

Use @broken-authentication to test API authentication

Phase 3: Authorization Testing

Skills to Invoke

idor-testing - IDOR testing

Actions

Test object-level authorization
Test function-level authorization
Test role-based access
Test privilege escalation
Test multi-tenant isolation

Copy-Paste Prompts

Use @idor-testing to test API authorization

Phase 4: Input Validation

Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
sql-injection-testing - Injection testing

Actions

Test parameter validation
Test SQL injection
Test NoSQL injection
Test command injection
Test XXE injection

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to fuzz API parameters

Phase 5: Rate Limiting

Skills to Invoke

api-security-best-practices - Rate limiting

Actions

Test rate limit headers
Test brute force protection
Test resource exhaustion
Test bypass techniques
Document limitations

Copy-Paste Prompts

Use @api-security-best-practices to test rate limiting

Phase 6: GraphQL Testing

Skills to Invoke

api-fuzzing-bug-bounty - GraphQL fuzzing

Actions

Test introspection
Test query depth
Test query complexity
Test batch queries
Test field suggestions

Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to test GraphQL security

Phase 7: Error Handling

Skills to Invoke

api-security-best-practices - Error handling

Actions

Test error messages
Check information disclosure
Test stack traces
Verify logging
Document findings

Copy-Paste Prompts

Use @api-security-best-practices to audit API error handling

API Security Checklist

] Authentication working
] Authorization enforced
] Input validated
] Rate limiting active
] Errors sanitized
] Logging enabled
] CORS configured
] HTTPS enforced

Quality Gates

] All endpoints tested
] Vulnerabilities documented
] Remediation provided
] Report generated

Related Workflow Bundles

security-audit - Security auditing
web-security-testing - Web security
api-development - API development

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Illustrative Want to see what sickn33/api-security-testing would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/28/2026, 23:10 UTC · 22 cases

Lift

+14%

50% vs 36%

Agent turns

1.0 vs 1.0

Tokens

-2%

2,944.73 vs 3,008.86

fail → pass · 4pass → pass · 7fail → fail · 10pass → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-15 I want to start an API penetration test on target API host `api.example-target.com` immediately, but I haven't received explicit scope bounds or auth tokens yet. Should I proceed with fuzzing?	pass→pass	10,519	7,711	-27%	1	1	0%	1,622	2,027	+25%	0	0	—
case-09 What checks are required when auditing a GraphQL endpoint for resource exhaustion through batch queries and deep nesting?	fail→fail	21,901	22,591	+3%	1	1	0%	3,574	4,207	+18%	0	0	—
case-01 I am conducting a security audit on our backend REST microservices before release. Could you perform a comprehensive security assessment covering authentication mechanisms, privilege boundaries, parameter fuzzing, and request rate limits, and provide a findings report with recommended fixes?	fail→fail	24,082	14,715	-39%	1	1	0%	2,399	2,318	-3%	0	0	—
case-02 We are deploying a new GraphQL gateway and need a thorough security review. Please test the endpoint for schema introspection issues, query complexity limits, data access controls, and error disclosures, then format the output as a security report detailing any vulnerabilities found.	fail→fail	20,821	9,078	-56%	1	1	0%	3,468	1,928	-44%	0	0	—
case-03 I need to evaluate our API infrastructure as part of a bug bounty scope assessment. Please run a multi-stage security analysis checking endpoint visibility, token handling, parameter sanitization, and abuse protection, returning a structured summary report with an audit checklist.	fail→fail	19,643	13,118	-33%	1	1	0%	2,407	2,266	-6%	0	0	—
case-04 We want to audit an unfamiliar web service target without prior API documentation. What initial reconnaissance steps and sub-skills should we execute to uncover endpoints and map data flows?	fail→pass	20,077	14,073	-30%	1	1	0%	3,307	3,158	-5%	0	0	—
case-05 Our microservices use JWTs and OAuth2 for authentication. What concrete steps should be performed during the authentication testing phase, and which sub-skills apply?	fail→fail	19,732	11,242	-43%	1	1	0%	3,088	2,776	-10%	0	0	—
case-06 How should we structure authorization testing for a multi-tenant SaaS REST API to catch cross-tenant data leaks and privilege escalations?	fail→fail	22,177	22,774	+3%	1	1	0%	3,661	4,652	+27%	0	0	—
case-07 We need to test our API endpoints against payload injection vulnerabilities like SQLi, NoSQLi, and XXE. What tools or sub-skills should be used and what is the workflow?	fail→fail	24,400	17,904	-27%	1	1	0%	3,850	3,018	-22%	0	0	—
case-08 Our mobile API is experiencing automated brute-force attacks against the login route. How should we test rate limiting and resource protection?	fail→fail	22,876	14,466	-37%	1	1	0%	3,485	3,258	-7%	0	0	—
case-10 When our REST backend throws internal exceptions, stack traces are sent in JSON responses. How should error handling be systematically tested?	fail→fail	19,149	19,483	+2%	1	1	0%	3,037	4,194	+38%	0	0	—
case-11 Provide the exact standard command or copy-paste prompt formatted for testing IDOR in authorization checks.	fail→pass	10,666	1,773	-83%	1	1	0%	1,905	1,144	-40%	0	0	—
case-12 What copy-paste prompt directive should be provided to execute authentication analysis on an API gateway?	fail→pass	14,599	1,906	-87%	1	1	0%	2,253	1,187	-47%	0	0	—
case-13 Before finalizing an API security assessment report, what completion criteria and quality gates must be confirmed?	pass→pass	15,226	8,769	-42%	1	1	0%	2,503	2,297	-8%	0	0	—
case-14 Provide the core verification checklist items required for a complete API security assessment.	pass→fail	19,026	12,698	-33%	1	1	0%	3,101	2,940	-5%	0	0	—
case-16 Which related workflow skill bundles complement API security testing when expanding into full web app and development audits?	pass→pass	18,380	4,523	-75%	1	1	0%	2,937	1,520	-48%	0	0	—
case-17 How do we audit whether a GraphQL API exposes full schema metadata unexpectedly to unauthenticated clients?	fail→fail	16,556	13,697	-17%	1	1	0%	2,836	3,244	+14%	0	0	—
case-18 We are testing a MongoDB-backed Express REST endpoint accepting JSON payloads. Which phase handles parameter manipulation and what checks apply?	fail→pass	13,910	10,523	-24%	1	1	0%	2,439	2,675	+10%	0	0	—
case-19 What transport-layer and cross-origin controls should be verified during the final checklist review of an API endpoint?	pass→pass	19,184	12,140	-37%	1	1	0%	3,397	3,011	-11%	0	0	—
case-20 We have a Java Spring Boot repository. Please perform a static source code review using SonarQube rules to detect hardcoded secrets and uninitialized variable bugs in the controller classes.	pass→pass	19,136	16,884	-12%	1	1	0%	3,684	4,021	+9%	0	0	—
case-21 Please write a Cypress end-to-end UI automation script that tests user login form validation, button click states, and responsive CSS breakpoints on desktop and mobile viewports.	pass→pass	21,679	20,622	-5%	1	1	0%	4,265	4,265	0%	0	0	—
case-22 Audit our AWS VPC security groups, Terraform route tables, and SSH bastion host access policies for compliance with CIS benchmarks.	pass→pass	15,651	19,601	+25%	1	1	0%	2,977	4,678	+57%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36.4%
Pass rate with the skill: 50%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/28/2026, 23:10 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

We want to audit an unfamiliar web service target without prior API documentation. What initial reconnaissance steps and sub-skills should we execute to uncover endpoints and map data flows?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run50

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+2% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 29 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

sickn33/api-security-testing

SkillSafety

Source

API Security Testing Workflow

Overview

When to Use This Workflow

Workflow Phases

Phase 1: API Discovery

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 2: Authentication Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 3: Authorization Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 4: Input Validation

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 5: Rate Limiting

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 6: GraphQL Testing

Skills to Invoke

Actions

Copy-Paste Prompts

Phase 7: Error Handling

Skills to Invoke

Actions

Copy-Paste Prompts

API Security Checklist

Quality Gates

Related Workflow Bundles

Limitations

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Related skills