apisec-skills

In the author's own words, from each skill's SKILL.md.

• api-security-review

  Use when developer explicitly asks to review an endpoint, controller, service, or API for security issues. Also triggers on: "review this for security", "is this secure", "check this endpoint", "security audit", "what are the vulnerabilities here", or when asked to review a full route file or controller file. This is the comprehensive holistic review skill — covers all OWASP API Top 10 2023 in on…

  skills/api-security-review/SKILL.md on GitHub (opens in a new tab)

• auth-rbac-scaffold

  Use when developer is implementing authentication, building login/logout flows, writing JWT validation, adding middleware, creating role-based access control, building permission systems, or asking how to protect routes. Also triggers on keywords: auth, bearer token, JWT, session, middleware, permissions, roles, scopes, OAuth. Generates secure auth patterns and catches insecure implementations —…

  skills/auth-rbac-scaffold/SKILL.md on GitHub (opens in a new tab)

• bola-detector

  Use when writing or reviewing any API endpoint that retrieves, updates, or deletes a record by user-supplied ID. Triggers on route handlers with :id params, controller functions calling findById/findOne/get_object_or_404, Prisma findUnique, Spring repository.findById, or any ORM lookup by identifier. Does NOT trigger on generic "review this endpoint" requests — use api-security-review for holisti…

  skills/bola-detector/SKILL.md on GitHub (opens in a new tab)

• injection-checker

  Use when writing database queries, file system operations, shell commands, XML/HTML processing, template rendering, or any operation that incorporates user-supplied input into a command or query. Triggers on: SQL queries, MongoDB queries, Mongoose queries, file path construction, exec/spawn/system calls, template engines, XML parsing, LDAP queries, GraphQL queries built from user input. Detects i…

  skills/injection-checker/SKILL.md on GitHub (opens in a new tab)

• openapi-hardener

  Use when developer is writing, reviewing, or editing an OpenAPI spec (swagger.yaml, openapi.yaml, openapi.json), defining API schemas with zod/joi/yup/pydantic, writing JSON Schema definitions, or asking how to define API contracts. Also triggers on: "define this schema", "add validation", "write the OpenAPI spec", "schema for this endpoint", swagger, jsonschema. Tightens loose definitions that c…

  skills/openapi-hardener/SKILL.md on GitHub (opens in a new tab)

• security-test-generator

  Use when developer is writing tests, asked to add test coverage, writing Jest/Mocha/pytest/JUnit test files, or when reviewing an endpoint that has only happy-path tests. Also triggers when developer says "write tests for this", "add test coverage", or "what should I test here". Generates security-focused test cases that complement functional tests — covering auth bypass, privilege escalation, in…

  skills/security-test-generator/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 431k stars · 5 skills
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 185k stars · 6 skills
• agent-skillsby addyosmani Production-grade engineering skills for AI coding agents. 113k stars · 25 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 110k stars · 1 skill
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 93.5k stars · 5 skills
• awesome-claude-skillsby ComposioHQ A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows 78.8k stars