SKILL49application-security
Reviewing API Security
Reviews API identity, object/function/property authorization, resource and business-flow abuse, SSRF, configuration, inventory, and third-party consumption.
Primary benefit
Finds API-specific security failures that generic web review often misses, especially authorization and business-invariant violations.When to use
Use when an authorized API or backend boundary needs security review for authentication, object/function/property authorization, resource abuse, business-flow abuse, SSRF, configuration, inventory, and third-party consumption.
When not to use
Do not use to probe APIs outside the user's authorized scope or when the work is limited to general web-browser controls with no API boundary involved.
Use cases
Review a multi-tenant API for object and function authorization gaps
Assess a webhook or third-party API integration for SSRF and unsafe upstream-data handling
Example prompts
Use reviewing-api-security to audit this authorized API's identity, authorization, business-flow, resource, SSRF, and inventory risks with controlled evidence.Install this skill
Choose the command for your operating system and run it from the repository root.
Bash
./install.sh --skill reviewing-api-securityPowerShell
./install.ps1 --skill reviewing-api-securityChatGPT
Download Skill ZIPCompatibility
- Surfaces
- ChatGPT · Codex · Claude Code
- Operating systems
- Linux · macOS · Windows
- Install modes
- PluginFilesystem
Dependencies
No external dependencies
Part of systems
Curated systems that canonically include this method.
Used in evidence
Reports that explicitly list this method among the applied methods.