Routes API security testing into recon, authorization, token abuse, and GraphQL workflows.
npx skills add https://github.com/lNwNl/Praxis --skill api-sec-lnwnl
Please help me install this Agent Skill. Skill: api-sec Source: https://github.com/lNwNl/Praxis/tree/main/skills/api-sec Command: npx skills add https://github.com/lNwNl/Praxis --skill api-sec-lnwnl
High-intent search queries and answers about installing and using this skill.
Start by identifying what the API exposes: Swagger or OpenAPI docs, object IDs in URLs or JSON, JWT tokens in traffic, or GraphQL endpoints. Each observation maps to a specific testing track such as recon, BOLA authorization checks, token abuse, or schema abuse.
BOLA (Broken Object Level Authorization) occurs when APIs expose object IDs without verifying user ownership. Test for it whenever IDs appear in URLs, JSON bodies, headers, or GraphQL arguments by substituting other users' identifiers.
When a JWT appears in API traffic, route to token abuse testing: examine header trust, claim manipulation, signature validation, and rate-limit bypass. The api-auth-and-jwt-abuse workflow covers these checks.
No, it is a routing entry point only. It classifies observations and points to deeper topic skills like api-recon-and-docs, api-authorization-and-bola, api-auth-and-jwt-abuse, and graphql-and-hidden-parameters that contain the detailed procedures.
Prioritize GraphQL testing when a /graphql endpoint or batched JSON arrays are present. Introspection, batching abuse, and undocumented fields require dedicated techniques that differ from standard REST authorization checks.
adam-sDiscover website APIs by capturing browser traffic and generate typed proxy routes.
securityfortechIdentify GraphQL IDOR vulnerabilities via schema introspection and resolver probing.
sayseven7Plan reconnaissance workflows for new security testing targets.
anajuliabitAudit GitHub repositories with Semgrep, TruffleHog, and osv-scanner for vulnerabilities.
