Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add frank-luongt/faos-skills-marketplace --skill api-security-patternsgit clone --depth 1 https://github.com/frank-luongt/faos-skills-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/frank-luongt/faos-skills-marketplace/api-security-patterns)<a href="https://agentmods.dev/skills/frank-luongt/faos-skills-marketplace/api-security-patterns"><img src="https://agentmods.dev/badge/skills/frank-luongt/faos-skills-marketplace/api-security-patterns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/frank-luongt/faos-skills-marketplace/api-security-patterns"><img src="https://agentmods.dev/badge/skills/frank-luongt/faos-skills-marketplace/api-security-patterns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.05219 |
| Opus 5.5 | $0.00000 | $0.02088 |
| Sonnet 5.5 | $0.00000 | $0.01044 |
| Haiku 4.5 | $0.00000 | $0.00522 |
Grade A, and why
api-security-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 650 lines — stays where its author put it; the contents beside it link to each section on GitHub.
name: api-security-patterns description: Advanced API security patterns covering OWASP API Top 10, authentication, authorization, rate limiting, and gateway hardening tags: [api, security]
Advanced API Security Patterns
Overview
APIs are the primary attack surface for modern applications. Over 90% of web-enabled applications expose more attack surface through APIs than through traditional UI. This skill provides defense-in-depth patterns for API security, mapping OWASP API Security Top 10 risks to concrete prevention code.
Core principle: Every API endpoint is an entry point for attackers. Authenticate, authorize, validate, and rate-limit every request -- no exceptions.
This skill enhances the existing @owasp-api-top10 skill with implementation-level patterns for Python/FastAPI, OPA policy-as-code, Redis-based rate limiting, and GraphQL-specific defenses.
When to Use This Skill
- Designing a new API or microservice
- Conducting a security review of existing API endpoints
- Implementing authentication or authorization middleware
- Setting up rate limiting or abuse prevention
- Hardening a GraphQL or WebSocket API
- Responding to an API-related security finding or penetration test result
- Preparing for SOC 2, PCI DSS, or HIPAA compliance audits that cover API security
How It Works
Step 1: Threat Model the API Surface
Before writing security code, enumerate your attack surface:
API Threat Model Checklist:
============================
[ ] List all endpoints (including undocumented/debug endpoints)
[ ] Classify data sensitivity per endpoint (public, internal, confidential, restricted)
[ ] Identify authentication requirements per endpoint
[ ] Map authorization rules (who can access what)
[ ] Document rate limiting requirements per endpoint/consumer
[ ] Identify external dependencies and trust boundaries
[ ] Review OWASP API Top 10 against each endpoint:
API1 - Broken Object Level Authorization (BOLA)
API2 - Broken Authentication
API3 - Broken Object Property Level Authorization
API4 - Unrestricted Resource Consumption
API5 - Broken Function Level Authorization
API6 - Unrestricted Access to Sensitive Business Flows
API7 - Server-Side Request Forgery (SSRF)
API8 - Security Misconfiguration
API9 - Improper Inventory Management
API10 - Unsafe Consumption of APIs
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 650 lines · 0 tokens per session scan A 28ad760f8f6d
api-security-patterns is a skill published in the GitHub repository frank-luongt/faos-skills-marketplace (37 stars, last pushed 3mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 5,219 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scalability-architecture
Full-stack scalability, architecture, and high-scale engineering audit engine for web applications. Use this skill when the user wants to audit a codebase for scalability bottlenecks, architecture quality, production readiness, infrastructure maturity, performance issues, database design, caching strategy, deployment…
durable-objects
Build, debug, or review Cloudflare Durable Objects code for persistent state and coordination.
workflow-ai-coding
Edit, validate, debug, publish, and inspect ReachAI Workflow drafts through the Workflow AI Coding REST API. Use when asked to create or modify a workflow graph, add/update/delete nodes or edges, validate GraphSpec, dry-run or debug-run a workflow, inspect trace/run output, check release readiness, publish a validated…
web-services
Use when calling web APIs or backends from Godot — HTTPRequest, REST/JSON clients, auth headers, downloads, TLS, WebSocketPeer clients, retries, and keeping secrets out of the build.
fronius
Read Fronius photovoltaic inverter data through the local Fronius Solar API V1 or Solar.web Query API cloud, without exposing access-key material.
agent-communication-protocol-enuno-claude-command-and-c-2
This page used to hold an archived copy of this skill. The archive now lives in the registry's data repository.