# API Unsafe Third Party Consumption

Testing whether the target trusts data from third-party APIs, webhooks, or callbacks...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-unsafe-third-party-consumption -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-unsafe-third-party-consumption -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-unsafe-third-party-consumption -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-unsafe-third-party-consumption -g -a gemini-cli -y`

## Description

Testing whether the target trusts data from third-party APIs, webhooks, or callbacks without sufficient validation, enabling injection, logic bypass, or data poisoning

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Unsafe Third-Party Consumption (OWASP API10)

## Purpose
Test whether the target API consumes data from external services (webhooks, payment callbacks, identity providers, enrichment APIs) without properly validating the input, enabling data poisoning, injection, or trust-boundary failures.

## Preconditions
- The target accepts data from a third-party source (webhook, callback, API response, OAuth provider)
- You can influence the data the third party sends (or simulate it)

## Distinction from SSRF
- **SSRF** (API7): The TARGET sends a request to an unintended destination
- **Unsafe consumption** (API10): The TARGET trusts and mishandles data returned/provided by another API

## Attack Surface Signals
- Webhook endpoints (Stripe, PayPal, GitHub, Slack, etc.)
- Payment processor callbacks
- Identity provider (IdP) data ingestion (OAuth userinfo, SAML assertions, SSO)
- Third-party enrichment APIs (email verification, credit checks, address validation)
- External feed/RSS import
- Remote image/document/file ingestion
- Shipping/tracking API responses
- Third-party authentication flows (sign in with Google/GitHub)
- External data imports (CSV, JSON, XML from a URL)

## Methodology

### Step 1: Identify Third-Party Data Ingestion Points
Map where the target accepts external data:
- What fields from the third-party response are consumed?
- Are they stored, displayed, or used in logic decisions?
- Is there signature/HMAC validation?

### Step 2: Test Webhook Payload Injection
```bash
# If you control the webhook source (e.g., you registered a webhook):
# Send a webhook with malicious payload in fields the target processes

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-unsafe-third-party-consumption/SKILL.md