This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/10/2026
What it changes
Passed 17 of 22 test cases with the skill, and 18 of 22 without it.
Without skill82%
With skill77%
Checks it passed that the model alone missed
Identifies `API Guesser` as the tool for analyzing and identifying API key types.
1 fixed16 passed either way3 still failing2 broke
Pass-rate lift
-5 pp
Tokens
+144%
Agent turns
0%
Response time
-12%
Model gemini-3.6-flashMeasured 8/10/2026v117 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
During static analysis of client-side JavaScript bundles, an analyst extracts several potential API tokens and hashes. Which tool helps identify token types and check API key validity?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies `API Guesser` as the tool for analyzing and identifying API key types.
Missed
Passed
case-18 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md425 linessingle file
API Fuzzing for Bug Bounty
Purpose
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
Inputs/Prerequisites
Burp Suite or similar proxy tool
API wordlists (SecLists, api_wordlist)
Understanding of REST/GraphQL/SOAP protocols
Python for scripting
Target API endpoints and documentation (if available)