القائمة
REST, GraphQL, and gRPC API security audit — authentication, authorization, data exposure, and configuration
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/ersinkoc/security-check --skill sc-api-securityيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase.
C#/.NET-specific security deep scan
Go-specific security deep scan
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | sc-api-security |
| description | REST, GraphQL, and gRPC API security audit — authentication, authorization, data exposure, and configuration |
| license | MIT |
| metadata | {"author":"ersinkoc","category":"security","version":"1.0.0"} |
Performs a comprehensive security audit of API endpoints covering broken object-level authorization, broken function-level authorization, excessive data exposure, missing rate limiting, mass assignment, security misconfiguration, and injection via API parameters. Covers REST, GraphQL, and gRPC API patterns, aligned with the OWASP API Security Top 10.
Called by sc-orchestrator during Phase 2 when APIs are detected in the architecture.
# REST
"app.get(", "app.post(", "app.put(", "app.delete(", "app.patch(",
"router.get(", "@GetMapping", "@PostMapping", "@app.route(",
"[HttpGet]", "[HttpPost]", "r.GET(", "r.POST("
# GraphQL
"typeDefs", "resolvers", "Mutation", "Query", "Subscription"
# gRPC
".proto", "service ", "rpc ", "grpc.Server"
# API configuration
"swagger", "openapi", "api-docs", "Swashbuckle"
1. Broken Object Level Authorization (BOLA/IDOR):
2. Broken Authentication:
3. Broken Object Property Level Authorization:
// VULNERABLE: Returning all user fields including sensitive ones
app.get('/api/users/:id', async (req, res) => {
const user = await User.findById(req.params.id);
res.json(user); // Includes passwordHash, internalId, role, etc.
});
// SAFE: Return only needed fields
app.get('/api/users/:id', async (req, res) => {
const user = await User.findById(req.params.id).select('name email avatar');
res.json(user);
});
4. Unrestricted Resource Consumption:
?limit=999999)5. Broken Function Level Authorization:
6. Server-Side Request Forgery:
7. Security Misconfiguration:
// Check for exposed API documentation in production
// /swagger, /api-docs, /graphql (introspection), /openapi.json
// Check for verbose error messages in API responses
// Check for missing security headers
8. Lack of Protection from Automated Threats: