# API Security

API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill api-security -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill api-security -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill api-security -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill api-security -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Security

Test API endpoints for security vulnerabilities across REST, GraphQL, WebSocket, and LLM-integrated APIs.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **GraphQL** | Introspection, batching attacks, nested query DoS, field suggestion |
| **REST API** | BOLA/IDOR, mass assignment, rate limiting, auth bypass, versioning |
| **WebSocket** | Cross-site hijacking, message manipulation, auth flaws |
| **Web-LLM** | Prompt injection via API, excessive agency, data exfiltration |

## Workflow

1. Discover API endpoints and documentation (Swagger, GraphQL schema)
2. Map authentication and authorization mechanisms
3. Test per API type using appropriate techniques
4. Validate data exposure and access control flaws
5. Capture evidence with HTTP request/response logs

## API at scale (offline corpus / fixture-driven)

For a large or offline API surface, a 2000+ path Swagger, a Postman corpus, a HAR capture, do NOT hand-build the coverage machinery per engagement. Drive it deterministically:

The rest: https://github.com/transilienceai/communitytools/blob/HEAD/skills/api-security/SKILL.md