offensive-api-security

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./Skills/api/offensive-api-security/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable examples but is verbose and monolithic, and the workflow lacks validation checkpoints for destructive/batch operations. Splitting protocol-specific detail into reference files and adding safety gates would improve the score.

Suggestions

Add explicit validation/safety checkpoints to the Quick Workflow (e.g., confirm scope/authorization before scanning, verify rate-limit response handling, stop-and-confirm before destructive admin actions).

Move gRPC, WebSocket, and SSRF deep-dive sections into separate reference files (e.g. references/grpc-testing.md) and keep SKILL.md as a concise overview with one-level-deep links.

Trim concept explanations Claude already knows (what BOLA is, what WebSocket bypasses) and keep only technique-specific guidance.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with concrete commands, but the ~500-line body includes explanatory prose Claude already knows (e.g., 'BOLA is the most prevalent API vulnerability', 'WebSocket connections bypass many traditional HTTP security controls') and could be tightened.	3 / 5
Actionability	Provides fully executable, copy-paste-ready curl, grpcurl, websocat, and Python examples covering the common cases across REST, gRPC, and WebSocket.	5 / 5
Workflow Clarity	A clear 10-step Quick Workflow is present, but this destructive/batch offensive skill (mass scanning, credential brute loops) lacks explicit validation/safety checkpoints, capping workflow clarity at 3 per the feedback-loop guidance.	3 / 5
Progressive Disclosure	All content is inlined in SKILL.md with no bundle files; per-protocol deep dives and cheatsheet content that could live in separate reference files are monolithically inlined, with only external URLs split out.	3 / 5
	Total	14 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, well-keyworded, and distinctive, but lacks an explicit 'Use when...' trigger clause, which caps completeness at 3. Adding a concrete usage trigger would raise the overall score.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when conducting authorized penetration testing of REST, gRPC, or WebSocket APIs or when the user mentions API security testing, BOLA/IDOR, or the OWASP API Top 10.'

Tighten the long enumeration of techniques; the description reads as a feature list rather than a trigger, slightly diluting the natural phrasing a user would say.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions across REST, gRPC, and WebSocket (BOLA/IDOR, verb tampering, content-type switching, protobuf interception, reflection enumeration, metadata injection, origin bypass, message injection, CSWSH) with comprehensive coverage.	5 / 5
Completeness	The 'what' is clearly stated (comprehensive testing methodology across three protocols), but there is no explicit 'Use when...' trigger clause; 'Designed for authorized penetration testing engagements' only weakly implies when, so completeness is capped at 3 per the missing-trigger guidance.	3 / 5
Trigger Term Quality	Includes natural user-facing terms and synonyms such as 'API security testing', 'OWASP API Security Top 10', 'penetration testing', 'REST', 'gRPC', 'WebSocket', 'BOLA/IDOR', and 'SSRF'.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (offensive API security across REST/gRPC/WebSocket) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: SnailSploit/Claude-Red
Path: Skills/api/offensive-api-security/SKILL.md
Commit: 24d7968

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.