Agent skill · security · aradotso
api-security-checklist
Comprehensive API security checklist and best practices for designing, testing, and securing REST, GraphQL, and OAuth APIs
Why this skill is useful
Provides specific security measures and code examples for securing REST, GraphQL, and OAuth APIs that the AI wouldn't reliably generate on its own.
What it needs
About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
API Security Checklist Skill Skill by ara.so — Security Skills collection. This skill provides comprehensive guidance on API security best practices based on the widely-adopted API Security Checklist. Use this to design, audit, and secure REST, GraphQL, and OAuth APIs against common vulnerabilities and attack vectors. Overview The API Security Checklist covers critical security countermeasures across: Authentication - Secure user identity verification Authorization - Access control and OAuth flows Input Validation - Preventing injection attacks Output Security - Secure response handling Processing - Backend security measures Monitoring - Detection and alerting CI/CD - Secure development lifecycle Installation This is a knowledge resource, not a software package. To use: 1. Bookmark for reference: Keep the checklist accessible during API development 2. Integrate into code reviews: Use as a PR checklist template 3. Add to CI/CD: Implement automated checks based on these guidelines 4. Security audits: Use as an audit framework Authentication Security ❌ Avoid Basic Auth ✅ Use Standard Authentication Rate Limiting and Max Retry Password Storage Access Control HTTPS and Security Headers IP Whitelisting for Private APIs DDoS Protection OAuth Security Validate Redirect URI Use State Parameter for CSRF Protection Scope Validation Input Validation HTTP Method Validation Content-Type Validation Input Sanitization Prevent XXE (XML External Entity) Processing Security Avoid Auto-Increment IDs (Use UUIDs) Use /me for User Resources Background Processing with Workers Disable Debug Mode in Production Output Security Security Headers Force Content-Type Generic Error Messages Proper Status Codes GraphQL-Specific Security Disable Introspection in Production Query Depth Limiting Query Cost Analysis Monitoring and Logging Centralized Logging Alert on Suspicious Activity CI/CD Security Dependency Scanning Static Code Analysis Secret Scanning Common Patterns and Best Practices API Key Man …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/api-security-checklist