Agent Skills
› yaklang/hack-skills
› api-sec
api-sec
GitHubAPI安全测试的路由入口，用于根据API特征（如REST、GraphQL、JWT等）快速分类并引导至具体的安全测试子技能。
触发场景
需要进行API安全测试前确定优先级
面对REST、移动端后端或GraphQL端点需要分流
安装
npx skills add yaklang/hack-skills --skill api-sec -g -y
SKILL.md
Frontmatter
{
"name": "api-sec",
"description": "Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill."
}
API Security Router
This is the routing entry point for API security testing.
Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.
When to Use
- The target exposes REST APIs, mobile backends, or GraphQL endpoints
- You need to define API testing order before going into specific topics
- You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks
Skill Map
- API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
- API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
- API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
- GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters
Quick Triage
| Observation | Route |
|---|---|
| Swagger or OpenAPI is present | api-recon-and-docs |
| IDs appear in URL, JSON, headers, or GraphQL args | api-authorization-and-bola |
| JWT token visible in traffic | api-auth-and-jwt-abuse |
/graphql or batched JSON arrays are present |
graphql-and-hidden-parameters |
| Registration, login, or profile updates accept extra fields | api-authorization-and-bola then api-auth-and-jwt-abuse |
Recommended Flow
- Start with exposed endpoints and documentation assets
- Then evaluate object-level and function-level authorization
- Then evaluate token, header, signature, and rate-limit boundaries
- If GraphQL or complex JSON is present, continue with hidden fields and schema abuse
Related Categories
版本历史
- c9a4b9e 当前 2026-07-06 00:21
