api-security-review

Q: How do I install api-security-review?

Run npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-review in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/api-security-review/ (personal) or .claude/skills/api-security-review/ (project).

by owaspBackend & APIs

Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.

Installs: 515
Last 24h: +13
Trending rank: #7342
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-review

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads api-security-review automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

API Security Review

Perform comprehensive API security assessment following plays/api-security-review.md.

Steps

Discovery & Reconnaissance
- Parse OpenAPI/Swagger specs or scan code for endpoints
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
- Map API gateway and middleware configurations
- Enumerate all API versions and deprecated endpoints
Authentication Deep Dive
- JWT security (algorithm confusion, weak signing, token expiration)
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
- API key exposure and rotation policies
- Session management and token storage
Assess All 10 OWASP API Risks with attack scenarios:
- API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
- API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
- API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
- API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
- API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
- API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
- API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
- API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
- API9 Inventory — Shadow APIs, zombie endpoints, version confusion
- API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
Automated Testing
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
- Test for common vulnerabilities with specific payloads
- Validate rate limiting and throttling mechanisms
API Gateway & Infrastructure Review
- Kong, nginx, Envoy, AWS API Gateway configurations
- WAF rules and bypass opportunities
- TLS configuration and certificate validation

Output

Comprehensive API security report including:

API surface inventory with authentication mechanisms
Risk matrix with severity ratings for all 10 categories
Detailed findings with proof-of-concept examples
Exploit scenarios and business impact analysis
Prioritized remediation roadmap with code examples
Testing artifacts and vulnerability evidence

OWASP References

OWASP API Security Top 10 (2023)
OWASP ASVS v5.0 — V13: API and Web Service
OWASP Testing Guide: WSTG-APIT
OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0

FAQ

What does the api-security-review skill do?

How do I install api-security-review?

Run npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-review in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/api-security-review/ (personal) or .claude/skills/api-security-review/ (project).

Which AI agents can use api-security-review?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is api-security-review safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains api-security-review?

It is published by owasp in owasp/secure-agent-playbook. It has 515 recorded installs.

More from owasp/secure-agent-playbook

View all →

web-security-review

owasp/secure-agent-playbook

Review web applications against the OWASP Top 10 for Web Applications (2021). Use when auditing web apps, reviewing server-side code, or assessing web frameworks for the classic OWASP Top 10 risks including injection, broken auth, and XSS.

Security624 installs