Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill api-security-designgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/api-security-design)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/api-security-design"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/api-security-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/api-security-design"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/api-security-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.02048 |
| Opus 5 | $0.00066 | $0.01024 |
| Sonnet 5 | $0.00026 | $0.00410 |
| Haiku 4.5 | $0.00013 | $0.00205 |
Grade A, and why
api-security-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Security Design
Secure API design protects backend services and data from abuse and the OWASP API Security Top 10 risks - broken object-level authorization (BOLA), broken authentication, broken function-level authorization (BFLA), unrestricted resource consumption, server-side request forgery, and more. On Azure, Azure API Management (APIM) is the primary policy enforcement point, paired with WAF, Entra ID, Key Vault, and Defender for APIs.
When to use
Designing or reviewing the security of APIs - especially external-facing, partner-facing, or sensitive-data APIs - before they go live or as part of a recurring design review.
Do not use this skill for:
- General application or web app security (use
security-architecture,threat-modelling) - API runtime detection and posture only (use
defender-for-apis) - Front-end / SPA design (use web app security guidance)
Pick the right control per OWASP API risk
| OWASP API Top 10 risk | Primary control | Where it lives |
|---|---|---|
| API1 - BOLA (object-level auth) | Per-object authorization check | Backend code (gateway cannot fully cover) |
| API2 - Broken authentication | OAuth 2.0 / OIDC with Entra ID, validate-jwt |
Gateway + Entra |
| API3 - Broken object property auth | Schema validation + response filtering | Backend + gateway |
| API4 - Unrestricted resource consumption | Rate limit, quota, payload size, timeout | Gateway (APIM) |
| API5 - BFLA (function-level auth) | Role/scope check on each operation | Backend code |
| API6 - Unrestricted access to sensitive flows | Step-up auth, anti-abuse rules | Entra + gateway |
| API7 - SSRF | Outbound URL allow-list + egress controls | Backend + network |
| API8 - Security misconfiguration | IaC + APIM policy templates | DevOps + gateway |
| API9 - Improper inventory management | API catalog + lifecycle in APIM | APIM + governance |
| API10 - Unsafe consumption of third-party APIs | Validate upstream responses, timeouts | Backend |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 131 lines · 131 tokens per session scan A 0e36523a7d55
api-security-design is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (171 stars, last pushed 2mo ago), licensed MIT. It adds 131 tokens to every session and 2,048 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cosmos-design-struct
Enforce consistent struct design conventions across sdk/cosmos crates. Validates visibility modifiers, field privacy, #[nonexhaustive] usage, and construction API patterns (Default/new with with setters, or optional separate builders with builder()/build()), and construction correctness on public structs. Can auto-fix…
bf-to-agents-sdk-typescript-migration
Assess and migrate JavaScript or TypeScript bots from BotBuilder/Bot Framework SDK to Microsoft 365 Agents SDK with AgentApplication. Use to produce a migration report and plan before editing code, map BotBuilder packages and APIs, identify unsupported features, and implement only the supported plan items selected by…
octopus-architecture
Review system architecture, simplify boundaries, or compare interface designs from repository evidence.
bfl-api
BFL FLUX API integration guide covering endpoints, async polling patterns, rate limiting, error handling, webhooks, and regional endpoints with Python and TypeScript code examples.
api-doc-generator
Generate API documentation from source code, supporting REST APIs, GraphQL, and various documentation formats.
aspire
Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…