Stats
Actions
Tags
'%20stop-opacity%3D'0.16'%2F%3E%3Cstop%20offset%3D'1'%20stop-color%3D'rgb(200%2C90%2C60)'%20stop-opacity%3D'0.03'%2F%3E%3C%2FlinearGradient%3E%3C%2Fdefs%3E%3Crect%20width%3D'320'%20height%3D'200'%20fill%3D'url(%23g)'%2F%3E%3Ccircle%20cx%3D'250'%20cy%3D'56'%20r%3D'92'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.06'%2F%3E%3Ccircle%20cx%3D'64'%20cy%3D'172'%20r%3D'58'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.05'%2F%3E%3C%2Fsvg%3E)
From skull
Review API security (REST & GraphQL) — broken object/function level authorization (BOLA/BFLA), mass assignment, excessive data exposure, missing rate-limiting / resource limits, weak input validation, and GraphQL introspection/depth/batching. Use when reviewing API endpoints, controllers, resolvers, or serializers.
How this skill is triggered — by the user, by Claude, or both
Slash command
/skull:sec-apiThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
APIs leak and break differently from page apps — the top risks are authorization and over-exposure.
APIs leak and break differently from page apps — the top risks are authorization and over-exposure.
sec-authz-review.)update(req.body), Model(**data)) lets
a client set fields it shouldn't (is_admin, role, owner_id). Flag bulk binds; require an explicit
allowlist of writable fields.path:line · OWASP-APIx / CWE · severity · evidence · fix. Coverage note (endpoints / resolvers reviewed).
npx claudepluginhub aturzone/skullAudits REST, GraphQL, and RPC APIs against OWASP API Security Top 10, focusing on BOLA, authentication, and access control.
Identifies OWASP API Security Top 10 (2023) vulnerabilities like BOLA in REST, GraphQL, gRPC APIs during audits, with code examples and detection patterns for Express, Flask, Spring Boot, Go.
Review API security including authentication, authorization, rate limiting, input validation, and data exposure.