skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-api-inventory-and-discovery

Discovers and catalogs documented, shadow, and zombie API endpoints across an organization's attack surface.

4|Updated Apr 28, 2026
Search Tags:#owasp#api-security#inventory#penetration-testing#attack-surface#api-discovery#shadow-api
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-inventory-and-discovery-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-api-inventory-and-discovery
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-api-inventory-and-discovery
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-inventory-and-discovery-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, boto3, and includes scripts (resource) and references (resource) components.

What problem does it solve? Organizations lose track of their APIs as teams deploy microservices without central governance, leaving shadow and zombie endpoints unmonitored and exposed. This Skill builds a comprehensive API inventory so security teams can find undocumented, deprecated, and unauthenticated endpoints before attackers do. ## Core Features & Use Cases - Multi-Vector Discovery: Combines passive HAR traffic analysis, active endpoint probing, DNS subdomain enumeration, JavaScript source parsing, and AWS API Gateway inventory. - Shadow and Zombie API Detection: Compares discovered endpoints against documented catalogs to flag undocumented APIs and deprecated versions still responding. - Risk Classification: Labels endpoints by risk level, highlighting admin interfaces, exposed GraphQL introspection, and public Swagger documentation. - Use Case: During an authorized assessment, run the agent against a target domain to enumerate API subdomains, parse an exposed openapi.json spec, and produce a report showing 31 shadow APIs and 3 unauthenticated zombie endpoints. ## Quick Start Ask the agent to perform an API inventory and discovery audit against your authorized target domain and report any shadow or zombie APIs it finds.

Frequently Asked Questions about performing-api-inventory-and-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find shadow APIs in my organization?▼

Shadow API discovery combines DNS subdomain enumeration, active probing of common API paths like /api/v1 and /graphql, and JavaScript source analysis for hardcoded endpoint URLs. Discovered endpoints are then compared against the documented API catalog to flag undocumented ones.

How to detect zombie or deprecated API versions still accessible?▼

Zombie APIs are detected by probing versioned paths such as /v1/ and /v2/ and checking whether deprecated versions still respond. The agent also parses OpenAPI specs for endpoints marked deprecated and flags any that remain reachable without authentication.

What tools are used for API endpoint discovery?▼

The workflow uses Amass and subfinder for DNS enumeration, httpx and nuclei for live host probing, and LinkFinder-style regex parsing for JavaScript analysis. The included Python agent uses the requests library for endpoint probing and Swagger spec parsing.

Can this skill inventory AWS API Gateway endpoints?▼

Yes, the workflow includes an AWS inventory step using boto3 to enumerate API Gateway v1 REST APIs and v2 HTTP APIs, listing routes, stages, and methods across accounts. This requires valid cloud credentials with read access.

Is API discovery scanning legal to run against any domain?▼

No, API discovery involves active scanning of network infrastructure and requires written authorization specifying target domains and ranges. The skill explicitly states it must not be used without permission and is intended for authorized assessments only.

Related Skills

Explore More Software Engineering Skills→
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced
cinjoffcinjoff
1

secure

Scan codebases for OWASP Top 10 security vulnerabilities with parallel agents.

Community
Advanced
DariusCorvusDariusCorvus
37

canary

Monitor deployed applications for console errors, performance regressions, and page failures.

Community
Advanced
api7api7
1

a6-recipe-health-check

Configure active and passive upstream health checks for APISIX via the a6 CLI.

Official
Intermediate