Agent skill · security · aiskillstore
api-spectral
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications for security issues and design flaws, (2) Enforcing API design standards and governance policies across API portfolios, (3) Creating custom security rules for API specifications in CI/CD pipelines, (4) Detecting authentication, authorization, and data exposure issues in API definitions, (5) Ensuring API specifications comply with organizational security standards and regulatory requirements.
Why this skill is useful
Adds domain-specific knowledge for API security validation and custom rulesets that the AI wouldn't reliably generate on its own.
What it needs
Requires node, npm installed locally. About 9k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
API Security with Spectral Overview Spectral is a flexible JSON/YAML linter from Stoplight that validates API specifications against security best practices and organizational standards. With built-in rulesets for OpenAPI v2/v3.x, AsyncAPI v2.x, and Arazzo v1.0, Spectral helps identify security vulnerabilities, design flaws, and compliance issues during the API design phase—before code is written. Custom rulesets enable enforcement of OWASP API Security Top 10 patterns, authentication standards, and data protection requirements across your entire API portfolio. Quick Start Installation Basic API Specification Linting Quick Security Scan Core Workflow Workflow Checklist Progress: [ ] 1. Install Spectral and select appropriate base rulesets [ ] 2. Create or configure ruleset with security rules [ ] 3. Identify API specifications to validate (OpenAPI, AsyncAPI, Arazzo) [ ] 4. Run linting with appropriate severity thresholds [ ] 5. Review findings and categorize by security impact [ ] 6. Map findings to OWASP API Security Top 10 [ ] 7. Create custom rules for organization-specific security patterns [ ] 8. Integrate into CI/CD pipeline with failure thresholds [ ] 9. Generate reports with remediation guidance [ ] 10. Establish continuous validation process Work through each step systematically. Check off completed items. Step 1: Ruleset Configuration Create a .spectral.yaml ruleset extending built-in security rules: Built-in Rulesets: spectral:oas - OpenAPI v2/v3.x security and best practices spectral:asyncapi - AsyncAPI v2.x validation rules spectral:arazzo - Arazzo v1.0 workflow specifications Ruleset Selection Best Practices: Start with built-in rulesets and progressively add custom rules Use error severity for critical security issues (authentication, HTTPS) Use warn for recommended practices and information disclosure risks Use info for style guide compliance and documentation completeness For advanced ruleset patterns, see references/rulesetpatterns.md. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/api-spectral