api-sec

Categorize API security testing into recon, authorization, token, and parameter issues.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/bingook/bingo --skill api-sec-bingook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-sec
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/api-sec
Command: npx skills add https://github.com/bingook/bingo --skill api-sec-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The Skill addresses the challenge of navigating complex API security issues by providing a structured approach to testing and analysis.

Core Features & Use Cases

  • API Recon and Docs: Facilitates discovery and documentation of API endpoints.
  • Authorization and BOLA: Handles object-level authorization issues and object ID enumeration.
  • JWT and Auth Abuse: Identifies and mitigates vulnerabilities in JWT tokens and authorization flows.
  • GraphQL and Hidden Parameters: Assesses GraphQL endpoint security and hidden parameters.

Quick Start

Utilize the api-sec skill to evaluate the security of an API endpoint by running 'api-sec scan https://api.example.com'.

Frequently Asked Questions about api-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API endpoints for Broken Object Level Authorization vulnerabilities?▼

To test API endpoints for Broken Object Level Authorization, you can route your security testing through pre-defined skill maps that categorize object authorization issues and handle object ID enumeration.

What is the best way to assess JWT token trust and authorization flow abuse?▼

Assessing JWT token trust involves identifying and mitigating vulnerabilities in JWT tokens and authorization flows by categorizing them under token trust issues for in-depth testing.

How do I discover hidden parameters and test GraphQL endpoint security?▼

Discovering hidden parameters and testing GraphQL endpoint security is handled by evaluating GraphQL endpoints and hidden parameters through structured vulnerability assessment skill maps.

Do I need prior API security knowledge to perform vulnerability assessments?▼

Yes, performing vulnerability assessments requires prior knowledge of API security concepts and potential vulnerabilities to effectively navigate the structured testing analysis.

How do I run a security scan on a specific API endpoint?▼

To run a security scan on a specific API endpoint, utilize the api-sec skill to evaluate the endpoint by running the command 'api-sec scan https://api.example.com'.