scanning-api-security

Detect API security vulnerabilities including injection, broken auth, and data exposure. Use when scanning APIs for security vulnerabilities. Trigger with phrases like "scan API security", "check for vulnerabilities", or "audit API security".

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/api-development/api-security-scanner/skills/scanning-api-security/SKILL.md

Quality

Content

57%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-structured with a clear numbered workflow and good progressive disclosure into real reference files, but it includes some unnecessary background explanation, lacks executable code/commands, and omits inline validation checkpoints that would lift workflow clarity.

Suggestions

Trim the Overview and Prerequisites of concepts Claude already knows (e.g., the OWASP category enumeration and standard tool listings) to improve token efficiency.

Add concrete, executable commands or code snippets (e.g., example Grep patterns or a nuclei/ZAP invocation) for at least the highest-value steps to move actionability toward copy-paste ready.

Insert validation checkpoints into the workflow (e.g., 'verify every mutation endpoint appears in the auth matrix before proceeding to dependency scanning') so the multi-step scan has explicit feedback loops.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient, but the Overview and Prerequisites sections restate concepts Claude already knows (e.g., enumerating OWASP categories and listing standard tools like ZAP/Burp), so it could be tightened.	2 / 3
Actionability	The steps give concrete, specific guidance (e.g., 'verify CORS Access-Control-Allow-Origin is not set to wildcard', check for raw SQL concatenation), but they are descriptive instructions rather than executable code or copy-paste commands, so they are incomplete relative to the top anchor.	2 / 3
Workflow Clarity	Nine clearly numbered steps provide a clear sequence, but there are no validation/verification checkpoints for the batch scanning operation, and error handling is moved to a separate table rather than inline feedback loops, capping clarity at 2.	2 / 3
Progressive Disclosure	The SKILL.md is an organized overview that signals one-level-deep references (implementation.md, errors.md, examples.md), all of which exist as real files, with easy navigation and no nested references.	3 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong across all dimensions: it states concrete capabilities, provides explicit natural-language trigger phrases, answers both 'what' and 'when', and is clearly distinct from other skills.

Dimension	Reasoning	Score
Specificity	It lists multiple concrete actions — 'Detect API security vulnerabilities including injection, broken auth, and data exposure' — matching the anchor for naming several specific actions.	3 / 3
Completeness	It clearly answers both what ('Detect API security vulnerabilities including injection, broken auth, and data exposure') and when ('Use when scanning APIs for security vulnerabilities') with explicit triggers.	3 / 3
Trigger Term Quality	Explicit natural trigger phrases are given — 'scan API security', 'check for vulnerabilities', or 'audit API security' — which are terms a user would naturally say, with good coverage.	3 / 3
Distinctiveness Conflict Risk	It occupies a clear niche (API security auditing) with distinct, specific triggers, making it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/api-development/api-security-scanner/skills/scanning-api-security/SKILL.md
Commit: 0540a62

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.