Is api-security-testing safe to install?

SaferSkills independently audited api-security-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/api-security-testing/SKILL.md · 1 file

skills/api-security-testing/SKILL.md3.9 KB · Markdown

name: api-security-testing

description: API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

category: Security & Systems

source: antigravity

tags: [api, workflow, document, security]

url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/api-security-testing

API Security Testing Workflow

Overview

Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.

When to Use This Workflow

Use this workflow when:

Testing REST API security
Assessing GraphQL endpoints
Validating API authentication
Testing API rate limiting
Bug bounty API testing

Workflow Phases

Phase 1: API Discovery

#### Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
scanning-tools - API scanning

#### Actions

Enumerate endpoints
Document API methods
Identify parameters
Map data flows
Review documentation

#### Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to discover API endpoints

Phase 2: Authentication Testing

#### Skills to Invoke

broken-authentication - Auth testing
api-security-best-practices - API auth

#### Actions

Test API key validation
Test JWT tokens
Test OAuth2 flows
Test token expiration
Test refresh tokens

#### Copy-Paste Prompts

Use @broken-authentication to test API authentication

Phase 3: Authorization Testing

#### Skills to Invoke

idor-testing - IDOR testing

#### Actions

Test object-level authorization
Test function-level authorization
Test role-based access
Test privilege escalation
Test multi-tenant isolation

#### Copy-Paste Prompts

Use @idor-testing to test API authorization

Phase 4: Input Validation

#### Skills to Invoke

api-fuzzing-bug-bounty - API fuzzing
sql-injection-testing - Injection testing

#### Actions

Test parameter validation
Test SQL injection
Test NoSQL injection
Test command injection
Test XXE injection

#### Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to fuzz API parameters

Phase 5: Rate Limiting

#### Skills to Invoke

api-security-best-practices - Rate limiting

#### Actions

Test rate limit headers
Test brute force protection
Test resource exhaustion
Test bypass techniques
Document limitations

#### Copy-Paste Prompts

Use @api-security-best-practices to test rate limiting

Phase 6: GraphQL Testing

#### Skills to Invoke

api-fuzzing-bug-bounty - GraphQL fuzzing

#### Actions

Test introspection
Test query depth
Test query complexity
Test batch queries
Test field suggestions

#### Copy-Paste Prompts

Use @api-fuzzing-bug-bounty to test GraphQL security

Phase 7: Error Handling

#### Skills to Invoke

api-security-best-practices - Error handling

#### Actions

Test error messages
Check information disclosure
Test stack traces
Verify logging
Document findings

#### Copy-Paste Prompts

Use @api-security-best-practices to audit API error handling

API Security Checklist

[ ] Authentication working
[ ] Authorization enforced
[ ] Input validated
[ ] Rate limiting active
[ ] Errors sanitized
[ ] Logging enabled
[ ] CORS configured
[ ] HTTPS enforced

Quality Gates

[ ] All endpoints tested
[ ] Vulnerabilities documented
[ ] Remediation provided
[ ] Report generated

security-audit - Security auditing
web-security-testing - Web security
api-development - API development

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

api-security-testing— agent skill

Is api-security-testing safe to install?

API Security Testing Workflow

Overview

When to Use This Workflow

Workflow Phases

Phase 1: API Discovery

Phase 2: Authentication Testing

Phase 3: Authorization Testing

Phase 4: Input Validation

Phase 5: Rate Limiting

Phase 6: GraphQL Testing

Phase 7: Error Handling

API Security Checklist

Quality Gates

Limitations

Audit the pieces. Scan the whole. Decide.

Is api-security-testing safe to install?

API Security Testing Workflow

Overview

When to Use This Workflow

Workflow Phases

Phase 1: API Discovery

Phase 2: Authentication Testing

Phase 3: Authorization Testing

Phase 4: Input Validation

Phase 5: Rate Limiting

Phase 6: GraphQL Testing

Phase 7: Error Handling

API Security Checklist

Quality Gates

Related Workflow Bundles

Limitations

Audit the pieces. Scan the whole. Decide.