api-fuzzing-bug-bounty

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

Quality

55%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Critical

Do not install without reviewing

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/api-fuzzing-bug-bounty/SKILL.md

Quality

Content

27%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill reads more like a comprehensive cheat sheet or reference dump than a focused, actionable skill for Claude. While it contains useful payloads and attack patterns, it suffers from significant verbosity, explains concepts Claude already knows, and packs everything into one monolithic file without progressive disclosure. The workflow lacks validation checkpoints and feedback loops critical for security testing operations.

Suggestions

Split the monolithic content into separate files: a concise SKILL.md overview with core workflow, and reference files for GraphQL testing (GRAPHQL.md), tool references (TOOLS.md), bypass techniques (BYPASSES.md), and payload examples (PAYLOADS.md).

Remove explanatory content Claude already knows (API types overview table, what IDOR is, what SSRF is) and replace with terse labels before actionable payloads.

Add explicit validation checkpoints to the workflow: how to confirm a vulnerability is real (e.g., 'If response differs between AND 1=1 and AND 1=2, confirmed SQLi'), and when to escalate vs. move on.

Remove the 'When to Use' boilerplate section and trim 'Inputs/Prerequisites' and 'Outputs/Deliverables' which add no actionable value for Claude.

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose at ~350+ lines, includes unnecessary sections like 'API Types Overview' table (Claude knows this), explains what IDOR is, lists extensive tool URLs that could be in a separate reference file, and includes a meaningless 'When to Use' section. The 'Purpose', 'Inputs/Prerequisites', and 'Outputs/Deliverables' sections restate obvious information.	1 / 3
Actionability	Provides concrete payloads and test patterns that are copy-paste ready (IDOR bypasses, GraphQL introspection, SQL injection in JSON), but many examples are incomplete snippets rather than executable workflows. The reconnaissance commands reference tools without installation steps, and payloads lack context on how to interpret results beyond simple OK/ERROR annotations.	2 / 3
Workflow Clarity	Steps 1-5 provide a reasonable sequence for API testing, but there are no validation checkpoints or feedback loops. For destructive/batch operations like DoS testing or brute forcing, there's no guidance on when to stop, how to verify findings, or how to confirm a vulnerability vs. a false positive. The workflow is more of a checklist of attack categories than a guided process.	2 / 3
Progressive Disclosure	Everything is crammed into a single monolithic file with no references to supporting files. The tools reference table, detailed GraphQL testing, PDF export attacks, and the extensive bypass techniques could all be split into separate reference files. With no bundle files provided, the content is a wall of text that would benefit significantly from decomposition.	1 / 3
	Total	6 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong description with excellent specificity and trigger term coverage for the API security testing domain. It clearly lists concrete capabilities and uses natural terminology that security professionals would search for. The main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about API security testing, API hacking, finding API vulnerabilities, or testing endpoints during bug bounty or penetration testing engagements.'

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: testing REST/SOAP/GraphQL APIs, vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors. These are concrete, actionable capabilities.	3 / 3
Completeness	Clearly answers 'what does this do' with specific techniques and API types, but lacks an explicit 'Use when...' clause or equivalent trigger guidance. The when is only implied through context (bug bounty, penetration testing).	2 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'REST', 'SOAP', 'GraphQL', 'API', 'bug bounty', 'penetration testing', 'authentication bypass', 'IDOR'. These are terms security professionals naturally use when seeking this type of guidance.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive with a clear niche: API security testing in bug bounty/pentest contexts. The combination of specific API types (REST, SOAP, GraphQL) with specific attack vectors (IDOR, auth bypass) makes it unlikely to conflict with general API development or other security skills.	3 / 3
	Total	11 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: sickn33/antigravity-awesome-skills
Commit: d89c349

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.