Agent skill · data analytics · yaklang
api-recon-and-docs
API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.
Why this skill is useful
Provides specific commands and patterns for discovering API endpoints and schemas that the AI wouldn't reliably generate on its own.
What it needs
About 1k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation. 1. PRIMARY GOALS 1. Discover all reachable API entrypoints. 2. Extract schemas, optional fields, and role differences. 3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters. 2. RECON CHECKLIST JavaScript and client mining Common documentation and schema paths Version and product drift 3. WHAT TO EXTRACT FROM DOCS optional and undocumented fields admin-only request examples deprecated endpoints that may still be active schema hints like additionalProperties: true parameter names tied to filtering, sorting, IDs, roles, or tenancy 4. NEXT ROUTING Finding Next Skill --- --- object IDs everywhere api authorization and bola JWT, OAuth, role claims api auth and jwt abuse GraphQL or hidden fields graphql and hidden parameters strong auth boundary but suspicious business flow business logic vulnerabilities
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/api-recon-and-docs