What problem does it solve? Old API versions, deprecated routes, and undocumented endpoints often stay reachable without receiving the security fixes applied to the current version, creating shadow and zombie API attack surface that standard testing misses. ## Core Features & Use Cases - Version Surface Enumeration: Probes path-based, header-based, and subdomain-based API versioning to find every live version of an API. - Spec Discovery and Diffing: Pulls current and archived OpenAPI/Swagger specs (including via the Wayback Machine) and diffs endpoint inventories to find zombie routes. - Behavioral Regression Testing: Compares auth strength, rate limiting, input validation, and field exposure between old and current versions of the same operation. - Use Case: During an authorized engagement, you find a mobile app hardcoding calls to /api/v1/ while the web app uses /api/v2/. This skill walks you through confirming v1 is live, diffing its spec against v2, and testing whether v1 accepts expired tokens or skips rate limits. ## Quick Start Ask the agent to enumerate all reachable API versions on the authorized target and behaviorally diff the oldest live version against the current one for auth, rate-limit, and validation regressions.
