api-security-testing

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/antigravity-api-security-testing/SKILL.md

The canonical home for this skill is api-security-testing in sickn33/antigravity-awesome-skills

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, lean workflow that sequences API security testing across seven clear phases with terminal quality gates. It is weakened by a lack of executable guidance and missing per-phase validation feedback loops for destructive batch testing.

Suggestions

Add per-phase validation/feedback checkpoints (e.g., 'confirm findings are reproducible before moving to the next phase') to lift the workflow-clarity cap for destructive batch operations.

Replace bare action lists with concrete, executable guidance — example commands, tool invocations, or payload templates — to improve actionability.

Consolidate the repeated boilerplate 'Copy-Paste Prompts' blocks into a single parameterized section to trim redundant tokens.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence without explaining basic API-security concepts, but the repeated boilerplate 'Copy-Paste Prompts' blocks across all seven phases add tokens that could be trimmed, so it is not a 5.	4 / 5
Actionability	It lists specific test targets ('Test JWT tokens', 'Test OAuth2 flows') and delegates to named skills via copy-paste prompts, but provides no executable code, commands, or concrete techniques, leaving the guidance incomplete.	3 / 5
Workflow Clarity	Seven phases are clearly sequenced with a final checklist and quality gates, but the workflow involves destructive/batch operations (injection, resource-exhaustion, rate-limit bypass tests) with no per-phase validation or feedback loops, which caps workflow clarity at 3.	3 / 5
Progressive Disclosure	The single file is well-organized into clear phases, checklists, and gates with no nested references and easy navigation; it exceeds the simple-skill threshold and contains some repetitive boilerplate, so it sits just below 5.	4 / 5
	Total	14 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates what the skill covers across REST and GraphQL API security, with good natural trigger terms and a distinct niche. Its main weakness is the absence of an explicit 'when to use' trigger clause, which caps completeness.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when testing REST/GraphQL API security, during API bug bounty engagements, or when validating API authentication and rate limiting') to raise completeness.

Include a few natural synonyms users say ('API pentesting', 'API vulnerabilities') to broaden trigger-term coverage.

Reframe coverage areas as concrete actions (e.g., 'test authentication, probe authorization, fuzz inputs') to push specificity toward 5.

Dimension	Reasoning	Score
Specificity	Names the domain ('API security testing workflow for REST and GraphQL APIs') and lists several concrete coverage areas (authentication, authorization, rate limiting, input validation, security best practices), with only minor gaps; these are coverage topics rather than discrete actions, so it stops short of a 5.	4 / 5
Completeness	The 'what' is clear and detailed, but there is no 'Use when...' clause or equivalent explicit trigger guidance for when Claude should invoke this skill, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ('API security testing', 'REST', 'GraphQL', 'authentication', 'authorization', 'rate limiting', 'input validation'); a few common synonyms like 'API pentesting' or 'API vulnerabilities' are missing, keeping it below 5.	4 / 5
Distinctiveness Conflict Risk	The REST/GraphQL API security-testing niche is fairly distinct, with only minor overlap risk against closely related general web-security or security-audit skills.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: boisenoise/skills-collections
Path: skills/antigravity-api-security-testing/SKILL.md
Commit: 19c310e

Reviewed: about 17 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.