API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
SKILL.md
readonly
name
api-security-testing
description
API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
category
granular-workflow-bundle
risk
safe
source
personal
date_added
2026-02-27
API Security Testing Workflow
Overview
Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.
When to Use This Workflow
Use this workflow when:
Testing REST API security
Assessing GraphQL endpoints
Validating API authentication
Testing API rate limiting
Bug bounty API testing
Workflow Phases
Phase 1: API Discovery
Skills to Invoke
api-fuzzing-bug-bounty - API fuzzing
scanning-tools - API scanning
Actions
Enumerate endpoints
Document API methods
Identify parameters
Map data flows
Review documentation
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to discover API endpoints
Phase 2: Authentication Testing
Skills to Invoke
broken-authentication - Auth testing
api-security-best-practices - API auth
Actions
Test API key validation
Test JWT tokens
Test OAuth2 flows
Test token expiration
Test refresh tokens
Copy-Paste Prompts
Use @broken-authentication to test API authentication
Phase 3: Authorization Testing
Skills to Invoke
idor-testing - IDOR testing
Actions
Test object-level authorization
Test function-level authorization
Test role-based access
Test privilege escalation
Test multi-tenant isolation
Copy-Paste Prompts
Use @idor-testing to test API authorization
Phase 4: Input Validation
Skills to Invoke
api-fuzzing-bug-bounty - API fuzzing
sql-injection-testing - Injection testing
Actions
Test parameter validation
Test SQL injection
Test NoSQL injection
Test command injection
Test XXE injection
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to fuzz API parameters
Phase 5: Rate Limiting
Skills to Invoke
api-security-best-practices - Rate limiting
Actions
Test rate limit headers
Test brute force protection
Test resource exhaustion
Test bypass techniques
Document limitations
Copy-Paste Prompts
Use @api-security-best-practices to test rate limiting
Phase 6: GraphQL Testing
Skills to Invoke
api-fuzzing-bug-bounty - GraphQL fuzzing
Actions
Test introspection
Test query depth
Test query complexity
Test batch queries
Test field suggestions
Copy-Paste Prompts
Use @api-fuzzing-bug-bounty to test GraphQL security
Phase 7: Error Handling
Skills to Invoke
api-security-best-practices - Error handling
Actions
Test error messages
Check information disclosure
Test stack traces
Verify logging
Document findings
Copy-Paste Prompts
Use @api-security-best-practices to audit API error handling
API Security Checklist
Authentication working
Authorization enforced
Input validated
Rate limiting active
Errors sanitized
Logging enabled
CORS configured
HTTPS enforced
Quality Gates
All endpoints tested
Vulnerabilities documented
Remediation provided
Report generated
Related Workflow Bundles
security-audit - Security auditing
web-security-testing - Web security
api-development - API development
Limitations
Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.