API Security Tester

This skill performs static code analysis of REST and GraphQL API implementations for vulnerabilities mapped to the OWASP API Security Top 10:2023. It identifies 10 categories of API-specific security issues — broken authorization, authentication flaws, excessive data exposure, resource consumption abuse, SSRF, and more — across JavaScript/TypeScript (Express, Fastify, NestJS), Python (Flask, Django, FastAPI), Go (net/http, Gin), and Java (Spring Boot). Each finding is mapped to CWE and OWASP API Top 10:2023 standards with UNSAFE/SAFE code pairs for remediation.

When to Use

• When the user asks to "audit API security", "review API endpoints", or "check for API vulnerabilities"
• When the user mentions "OWASP API Top 10", "BOLA", "broken authorization", or "API authentication issues"
• When reviewing REST API route handlers, GraphQL resolvers, or API middleware
• When a pull request modifies API authentication, authorization, or input validation logic
• When the user asks about "rate limiting", "mass assignment", "excessive data exposure", or "SSRF"
• When scanning code that defines API routes (Express app.get, FastAPI @app.get, Spring @GetMapping, etc.)
• When reviewing GraphQL schemas, resolvers, or query depth/complexity settings

When NOT to Use