mtecoyy/ai-baike/api-sec
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Install
npx vskill@latest install mtecoyy/ai-baike/api-secSKILL.md
API Security Router
这是 API 安全测试的分类入口。
先用这个 skill 判断当前 API 更像是文档和资产发现、对象授权、令牌信任问题，还是 GraphQL 与隐藏参数问题，再进入更细的专题 skill。
When to Use
- 目标暴露 REST API、移动端后端或 GraphQL 接口
- 你需要先确定 API 测试顺序，再进入具体专题
- 你想把对象授权、JWT、GraphQL、隐藏字段这些方向分开处理
Skill Map
- API Recon and Docs: OpenAPI、Swagger、版本漂移、隐藏文档
- API Authorization and BOLA: BOLA、BFLA、方法滥用、隐藏可写字段
- API Auth and JWT Abuse: Bearer token、Header 信任、Claim 滥用、限流绕过
- GraphQL and Hidden Parameters: introspection、batching、未公开字段、隐藏参数
Quick Triage
| Observation | Route | |
|---|---|---|
| Swagger 或 OpenAPI 存在 | api-recon-and-docs | |
| IDs 出现在 URL、JSON、Header 或 GraphQL args | api-authorization-and-bola | |
| JWT token visible in traffic | api-auth-and-jwt-abuse | |
/graphql 或 batched JSON arrays 存在 | graphql-and-hidden-parameters | |
| 注册、登录、资料更新接受额外字段 | api-authorization-and-bola 然后 api-auth-and-jwt-abuse |
Recommended Flow
- 先看接口暴露面和文档资产
- 再看对象级和功能级授权
- 再看令牌、Header、签名与限流边界
- 如果有 GraphQL 或复杂 JSON，再进入隐藏字段和 schema 滥用
Related Categories
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryChecking破甲/网络安全1000+skills/网络安全1000+skills/skills/api-sec/SKILL.md
Popularity
- Repository stars
- 22
- Repository forks
- 4
- 7-day trend score
- 21
Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 10 Oct 2026, 14 days ago.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/mtecoyy/ai-baike/api-sec)