aegis-api-security
Installation
SKILL.md
Scope & Objectives
Objective
Audit the HTTP-facing surface of the target repository for API-specific design and configuration failures that let a client exceed its intended authority: write fields the server never meant to expose, consume unbounded resources, enumerate internals through schema and documentation surfaces, skip transport or channel authentication, or ride privileged channels cross-origin. For every finding produce file:line evidence, a reproduction recipe (static-first), a severity with rationale, and a framework-correct fix.
In Scope
| Class | Typical finding | Primary CWE |
|---|---|---|
| Mass assignment / over-posting | Client sets role, is_admin, price, user_id through request-body binding to ORM entities |
CWE-915 |
| Rate limiting & anti-automation | Unthrottled auth/search/export endpoints, no pagination caps, no per-key quotas | CWE-770, CWE-799 |
| GraphQL configuration | Prod introspection, exposed playground/GraphiQL, no depth/complexity limits, batching abuse, field-suggestion leakage | CWE-200, CWE-400 |
| gRPC / protobuf | Public reflection service, plaintext h2c listeners reachable externally, missing per-RPC auth interceptors | CWE-306, CWE-200 |
| REST hygiene | _method override shadowing, state-changing GET, deprecated versions still live, unauthenticated OpenAPI docs, debug headers, CORS wildcard with credentials, content-type confusion entry points, leaky error envelopes |
CWE-200, CWE-942 |
| API key management | Keys accepted in URLs, shared keys embedded in mobile/SDK builds, god-mode unscoped keys, no revocation flow | CWE-798 |
| WebSocket / SSE channels | Missing Origin validation at upgrade, handshake-only authentication, topics without per-user ACLs | CWE-346, CWE-862 |