Agent skill · security · jeremylongshore
scanning-api-security
Detect API security vulnerabilities including injection, broken auth,
Why this skill is useful
Adds executable scripts for comprehensive API security scanning that are not commonly found in public documentation.
What it needs
Requires burp-suite, govulncheck, npm, nuclei, owasp-zap, safety installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Scanning API Security Overview Detect API security vulnerabilities by scanning endpoint implementations, authentication flows, and data handling against the OWASP API Security Top 10. Identify injection vectors, broken authentication, excessive data exposure, mass assignment, and missing rate limiting through static analysis of route handlers, middleware chains, and request validation logic. Prerequisites API source code with route definitions and controller/handler implementations accessible OpenAPI specification for cross-referencing documented vs. implemented security controls OWASP API Security Top 10 (2023) checklist familiarity Security scanning tools: OWASP ZAP, Burp Suite, or nuclei for dynamic testing Dependency vulnerability scanner: npm audit, safety (Python), or govulncheck Instructions 1. Scan all route definitions using Grep to build a complete inventory of endpoints, HTTP methods, and middleware chains applied to each route. 2. Audit authentication middleware to verify every mutation endpoint (POST, PUT, PATCH, DELETE) has auth enforcement and that no endpoints accidentally bypass auth through route ordering. 3. Check for Broken Object Level Authorization (BOLA) by verifying that resource access checks compare the authenticated user's ID/role against the requested resource ownership, not just valid authentication. 4. Identify excessive data exposure by comparing response serialization against API contracts -- flag endpoints returning full database records instead of explicit field whitelists. 5. Detect mass assignment vulnerabilities by checking whether request bodies are passed directly to ORM create/update calls without field-level allowlisting. 6. Verify input validation exists on all request parameters, query strings, headers, and body fields, checking for SQL injection, NoSQL injection, and command injection patterns. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/scanning-api-security