backend-security-skills

Generates an api-recon/ folder containing a pre-audit reconnaissance report for a backend API. Produces route-graph, entry-point catalog, auth matrix, invariants, and an architecture diagram. Language-agnostic (Node.js / Python). Triggers on 'api-recon', 'api recon', 'api reconnaissance', 'api readiness', 'api audit readiness', 'run recon on this api', 'prep this api', 'summarize this api'.

Security audit of Node.js backend APIs while you develop. Trigger on "api audit", "audit this api", "review api security", "check this endpoint". Modes - default (full repo) or a specific filename.

Security audit of Python backend APIs while you develop. Trigger on "api audit", "audit this api", "review api security", "check this endpoint" (Python targets). Modes - default (full repo) or a specific filename.

Dynamic security testing for running backend APIs. Sends real HTTP requests to a live target, confirms vulnerabilities with reproducible transcripts. Trigger on "runtime audit", "run runtime audit", "live audit", "dynamic security test", "test this api live". Zero-config common case via runtime-audit.yaml; interactive 3-way fork otherwise.