jd-opensource/joysafeter/pentest-api-deep

Claude Code and agent skill by jd-opensource/joysafeter

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.

Install

npx vskill@latest install jd-opensource/joysafeter/pentest-api-deep

SKILL.md

Pentest API Deep

Purpose

Perform dedicated API-specific vulnerability testing beyond basic BOLA/GraphQL coverage. Addresses Broken Function Level Authorization (BFLA), mass assignment, rate limiting, excessive data exposure, and unsafe consumption per OWASP API Security Top 10 (2023).

Prerequisites

Authorization Requirements
  • Written authorization with API testing scope explicitly included
  • API documentation (OpenAPI/Swagger specs, GraphQL schema) if available
  • Test accounts at multiple privilege levels (user, admin, service account)
  • Rate limit awareness — confirm acceptable request volume with target owner
Environment Setup
  • Postman or Insomnia for manual API exploration
  • Burp Suite with API-specific extensions
  • GraphQL Voyager for schema visualization
  • grpcurl for gRPC service testing

Core Workflow

  1. API Discovery: Enumerate endpoints via OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, traffic analysis. Discover undocumented endpoints with Kiterunner.
  2. BFLA Testing: Access admin-only API functions as regular user. HTTP method switching (GET→DELETE). Test function-level authorization gaps distinct from object-level (BOLA).
  3. Mass Assignment: Send extra fields in POST/PUT (role, isAdmin, balance). Check response objects for leaked internal fields (WSTG-INPV-20).
  4. Rate Limiting & Resource: Test missing rate limits, GraphQL depth/complexity abuse, pagination abuse, regex DoS via API input.
  5. Excessive Data Exposure: Compare API responses across privilege levels. Identify fields returned but not displayed in UI. Test verbose error responses.
  6. Unsafe Consumption: SSRF through upstream API calls, injection through trusted-but-tainted API response data.
  7. API Versioning: Old API versions with weaker controls, version header manipulation, deprecated endpoint access.

OWASP API Security Top 10 (2023) Coverage

CategoryTest FocusStatus
API1 Broken Object Level AuthorizationIDOR via API params✅
API2 Broken AuthenticationToken/key weaknesses✅
API3 Broken Object Property Level AuthorizationMass assignment, excessive data✅
API4 Unrestricted Resource ConsumptionRate limits, complexity✅
API5 Broken Function Level AuthorizationBFLA, method switching✅
API6 Unrestricted Access to Sensitive Business FlowsAutomation abuse✅
API7 Server Side Request ForgeryAPI-triggered SSRF✅
API8 Security MisconfigurationCORS, headers, versioning✅
API9 Improper Inventory ManagementShadow APIs, deprecated versions✅
API10 Unsafe Consumption of Third-Party APIsUpstream injection✅

Tool Categories

CategoryToolsPurpose
API DiscoveryKiterunner, Swagger UI, GraphQL VoyagerEndpoint enumeration
Parameter DiscoveryArjun, x8, ParamSpiderHidden parameter detection
Fuzzingffuf, Burp Intruder, custom scriptsMass assignment, BFLA
GraphQLgraphql-cop, InQL, BatchQLGraphQL-specific attacks
gRPCgrpcurl, grpc-toolsgRPC reflection and testing
Rate Testingcustom aiohttp scripts, Turbo IntruderRate limit verification

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationPassed, 85 of 100Effective. 1 run. Evaluated 8 months ago.

See evaluation results

Source

Popularity

Repository stars
233
Repository forks
46
7-day trend score
27

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 1 Apr 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/jd-opensource/joysafeter/pentest-api-deep/badge)](https://verified-skill.com/skills/jd-opensource/joysafeter/pentest-api-deep)

Something wrong with this skill or its page? Tell us.