api-sec
yaklang/hack-skills
Entry point router for API security testing—choose between recon, authorization, token abuse, and GraphQL workflows.
What is api-sec?
This is a routing skill that helps you triage API security issues and decide which deeper API topic skill to use next. Start here when testing REST APIs, mobile backends, or GraphQL endpoints to determine whether the issue involves documentation, object authorization, token trust, or hidden parameters.
- Routes API security findings to specialized skills (recon, authorization, JWT abuse, GraphQL)
- Provides quick triage table to match observations to the right workflow
- Recommends testing order: documentation → authorization → tokens → GraphQL/hidden fields
- Covers REST APIs, mobile backends, and GraphQL endpoints
How to install api-sec
npx skills add https://github.com/yaklang/hack-skills --skill api-secHow to use api-sec
- 1.Identify the API type (REST, mobile backend, or GraphQL)
- 2.Use the Quick Triage table to match your observation to a route
- 3.Follow the Recommended Flow order: documentation → authorization → tokens → GraphQL
- 4.Install and run the routed skill (api-recon-and-docs, api-authorization-and-bola, api-auth-and-jwt-abuse, or graphql-and-hidden-parameters)
Use cases
- You find Swagger or OpenAPI documentation and need to know what to test next
- IDs appear in URLs or JSON and you need to check object authorization
- JWT tokens are visible in traffic and you want to evaluate token abuse vectors
- GraphQL endpoints or batched JSON arrays are present and you need to check for hidden fields
- Registration or login endpoints accept extra fields and you need to route to both authorization and JWT skills
- API security testers
- Penetration testers evaluating REST or GraphQL backends
- Security researchers triaging API vulnerabilities
- Developers building API security test plans
api-sec FAQ
Use this skill first to understand which API security category your finding belongs to. Once you know the category, install and use the deeper skill for that topic.
The Recommended Flow handles this: test documentation first, then authorization, then tokens. You may need to run multiple routed skills in sequence.
No, this is a routing and triage skill. It helps you decide which specialized skill to use. The actual testing happens in the routed skills.
REST APIs, mobile backends, and GraphQL endpoints. It also references auth-sec and business-logic-vuln for related categories.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: api-sec description: >- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
API Security Router
This is the routing entry point for API security testing.
Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.
When to Use
- The target exposes REST APIs, mobile backends, or GraphQL endpoints
- You need to define API testing order before going into specific topics
- You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks
Skill Map
- API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
- API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
- API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
- GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters
Quick Triage
| Observation | Route |
|---|---|
| Swagger or OpenAPI is present | api-recon-and-docs |
| IDs appear in URL, JSON, headers, or GraphQL args | api-authorization-and-bola |
| JWT token visible in traffic | api-auth-and-jwt-abuse |
/graphql or batched JSON arrays are present | graphql-and-hidden-parameters |
| Registration, login, or profile updates accept extra fields | api-authorization-and-bola then api-auth-and-jwt-abuse |
Recommended Flow
- Start with exposed endpoints and documentation assets
- Then evaluate object-level and function-level authorization
- Then evaluate token, header, signature, and rate-limit boundaries
- If GraphQL or complex JSON is present, continue with hidden fields and schema abuse
Related Categories
- auth-sec
- business-logic-vuln
- recon-for-sec
Related skills
More from yaklang/hack-skills and the wider catalog.
arbitrary-write-to-rce
Convert arbitrary write primitives into code execution by targeting GOT, hooks, _IO_FILE, exit_funcs, TLS_dtor_list, and other glibc structures.
auth-sec
Entry point router for authentication, authorization, sessions, and identity protocol testing.
authbypass-authentication-flaws
Authentication bypass testing playbook for login flows, password reset, MFA, and token flaws.
binary-protection-bypass
Identify and bypass ASLR, PIE, NX, canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries.
browser-exploitation-v8
V8 and Chrome browser exploitation: JIT type confusion, sandbox bypass, and renderer RCE techniques.
business-logic-vuln
Router for business logic vulnerabilities including race conditions, workflow abuse, and state-machine flaws.