What problem does it solve? Frontend UIs often hide or disable actions, but the underlying API may still accept direct requests, letting attackers repeat actions, replay captured requests, manipulate IDs, inject extra fields, or bypass rate limits. This Skill guides a systematic audit of the gap between what the UI allows and what the API actually accepts. ## Core Features & Use Cases - Abuse Class Coverage: Tests seven abuse patterns including repetition, replay, ID manipulation, extra fields (mass assignment), alternative endpoints, missing rate limiting, and UI bypass. - Structured Investigation Procedure: Provides an 11-step workflow from endpoint inventory through evidence-backed reporting with confidence levels (CONFIRMED, HIGH CONFIDENCE, POSSIBLE, SPECULATIVE). - False Positive Filtering: Distinguishes real vulnerabilities from defended behaviors such as effective rate limits, field allowlists, nonces, and ownership checks. - Use Case: During a security review of a rewards platform, use this Skill to test whether POST /claim can be repeated 100 times, whether a captured vote request can be replayed, and whether a disabled delete button can be bypassed via a direct DELETE call. ## Quick Start Audit the API behind this application for direct-access abuse such as replay, mass assignment, and missing rate limiting, and report findings with reproduction requests.
