API security skills and rules for Cursor, Claude Code, Copilot, and all major AI coding agents. OWASP API Top 10 coverage — zero configuration.
Skill Claude CodeCodex
Use when developer explicitly asks to review an endpoint, controller, service, or API for security issues. Also triggers on: "review this for security", "is this secure", "check this endpoint", "security audit", "what are the vulnerabilities here", or when asked to review a full route file or controller file. This is…
Skill Claude CodeCodex
Use when developer is implementing authentication, building login/logout flows, writing JWT validation, adding middleware, creating role-based access control, building permission systems, or asking how to protect routes. Also triggers on keywords: auth, bearer token, JWT, session, middleware, permissions, roles…
Skill Claude CodeCodex
Use when writing or reviewing any API endpoint that retrieves, updates, or deletes a record by user-supplied ID. Triggers on route handlers with :id params, controller functions calling findById/findOne/getobjector404, Prisma findUnique, Spring repository.findById, or any ORM lookup by identifier. Does NOT trigger on…
Skill Claude CodeCodex
Use when writing database queries, file system operations, shell commands, XML/HTML processing, template rendering, or any operation that incorporates user-supplied input into a command or query. Triggers on: SQL queries, MongoDB queries, Mongoose queries, file path construction, exec/spawn/system calls, template…
Skill Claude CodeCodex
Use when developer is writing, reviewing, or editing an OpenAPI spec (swagger.yaml, openapi.yaml, openapi.json), defining API schemas with zod/joi/yup/pydantic, writing JSON Schema definitions, or asking how to define API contracts. Also triggers on: "define this schema", "add validation", "write the OpenAPI spec"…
Skill Claude CodeCodex
Use when developer is writing tests, asked to add test coverage, writing Jest/Mocha/pytest/JUnit test files, or when reviewing an endpoint that has only happy-path tests. Also triggers when developer says "write tests for this", "add test coverage", or "what should I test here". Generates security-focused test cases…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: