api security skills

xalgorix/xalgorix

Skill Claude CodeCodex

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

xalgorix/xalgorix

Skill Claude CodeCodex

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating…

xalgorix/xalgorix

Skill Claude CodeCodex

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not…

AgentSecOps/SecOpsAgentKit

Skill Claude CodeCodex

API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications…

yoanbernabeu/supabase-pentest-skills

Skill Claude CodeCodex

Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.

yoanbernabeu/supabase-pentest-skills

Skill Claude CodeCodex

Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.

yoanbernabeu/supabase-pentest-skills

Skill Claude CodeCodex

Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.

ax128/AegisGate

Skill Claude CodeCodex

An open-source security gateway that sits between an AI application and an LLM service. It can remove or clean sensitive information from requests and responses before they are passed through.

Orizon-eu/claude-code-pentest

Skill Claude CodeCodex

Automated API security testing starting from domains. Discovers REST, GraphQL, and SOAP APIs, reconstructs schemas, and tests for BOLA/IDOR, BFLA, mass assignment, JWT attacks, rate limiting bypass, and business logic flaws. Use when user asks to "test API security", "break API", "find API vulnerabilities", "test…

Orizon-eu/claude-code-pentest

Skill Claude CodeCodex

Maps cloud infrastructure from domains and identifies pivot paths from external to cloud internals. Detects cloud providers, enumerates S3/GCS/Azure storage, finds subdomain takeover opportunities, discovers serverless functions, CI/CD exposure, and IaC leaks. Use when user asks for "cloud security", "S3 enumeration"…

Orizon-eu/claude-code-pentest

Skill Claude CodeCodex

Automated full-scope reconnaissance starting from a domain or domain list. Performs subdomain enumeration, port scanning, technology fingerprinting, OSINT correlation, Google dorking, and Wayback analysis. Use when user provides a domain or list of domains and asks for "recon", "reconnaissance", "attack surface…

greekr4/rever-browser

Skill Claude CodeCodex

Reverse-engineer web APIs by driving a running Rever Browser instance — connect to its published MCP endpoint and use its browser-automation, network-capture, and JS-bundle-analysis tools. Use when the user types /rever, asks to reverse or analyze a website's API, capture or inspect its network traffic, deobfuscate…

humaidhahm/opencode-pentester

Skill Claude CodeCodex

Coordinate penetration testing and AI self-code audits via schema-enforced, event-driven engine. All attack categories, domains, tools, and checklists are stored in SQLite (findings.db) and loaded JIT by engine/router.py.

humaidhahm/opencode-pentester

Skill Claude CodeCodex

Coordinate penetration testing. Deploy executors, aggregate results, generate reports.

Njones17/AI-agent-master-cyber-skills-list

Skill Claude CodeCodex

Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API…

Njones17/AI-agent-master-cyber-skills-list

Skill Claude CodeCodex

Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, determines enforcement mechanisms, and attempts bypasses including…

Njones17/AI-agent-master-cyber-skills-list

Skill Claude CodeCodex

Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review…

MuhammedZohaib/patchman

Skill Claude CodeCodex

Perform a defensive review of authentication and authorization flows in an authorized codebase. Use for login, session, MFA, OAuth, password reset, cookie security, JWT validation, impersonation, privilege checks, and object-level access control.

MuhammedZohaib/patchman

Skill Claude CodeCodex

Review an authorized application for business-logic vulnerabilities, workflow abuse, approval bypasses, replay conditions, quota circumvention, plan enforcement bugs, and state-transition errors. Use for billing, invites, approvals, refunds, admin actions, and multi-step workflows.

MuhammedZohaib/patchman

Skill Claude CodeCodex

Conduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation…

akashrpatil/awesome-offensive-security-skills

Skill Claude CodeCodex

Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging…

xAmirHamza77/PenKit51

Skill Claude CodeCodex

Fast browser automation CLI for AI agents. Chrome/Chromium via CDP, no Playwright or Puppeteer dependency. Accessibility-tree snapshots with compact @eN refs let agents interact with pages in 200-400 tokens instead of parsing raw HTML.

xAmirHamza77/PenKit51

Skill Claude CodeCodex

HTTP header injection testing covering CRLF / response splitting, cache poisoning, Host-header confusion, cookie fixation, and proxy / forwarding header smuggling.

xAmirHamza77/PenKit51

Skill Claude CodeCodex

NoSQL injection testing covering MongoDB operator injection, authentication bypass, blind extraction, GraphQL variable injection, and Redis/DynamoDB/Elasticsearch/Neo4j-specific attack surfaces.