| name | api-overview |
| description | Modern API category — gRPC, SOAP/WSDL, WebSocket, Server-Sent Events. Routing skill: identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill. |
| allowed-tools | Bash Read Write |
| metadata | {"when_to_use":"api protocol modern grpc soap wsdl websocket ws sse server-sent-events http2 streaming","subdomain":"api","tags":"api, modern-protocols","mitre_attack":"T1190"} |
Modern API Attack Category
This is a routing skill. Identify the API protocol then load the matching sub-skill.
Sub-skills
| Protocol | Sub-skill | Wire signature |
|---|
| gRPC | grpc | HTTP/2 + `application/grpc[+proto |
| SOAP/WSDL | soap-wsdl | XML body in text/xml/application/soap+xml, ?wsdl discovery |
| WebSocket | websocket | HTTP Upgrade: websocket handshake, then framed binary/text |
| Server-Sent Events | server-sent-events | Content-Type: text/event-stream, one-way streaming |
Quick fingerprint
curl -sk -I --http2 https://target/svc | grep -i 'application/grpc'
curl -sk "https://target/endpoint?wsdl" | head -1
curl -sk -X POST -H 'Content-Type: text/xml' https://target/endpoint
curl -sk -I -H "Connection: Upgrade" -H "Upgrade: websocket" https://target/ws | head -1
curl -sk -i https://target/stream -H "Accept: text/event-stream" | grep 'text/event-stream'
Sibling skills
For REST + GraphQL go to:
load_skill("/skills/standard/exploit/web/SKILL.md") — sub-skills graphql, idor, mass-assignment, etc.
