api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

1.17x

Quality

37%

Does it follow best practices?

Impact

100%

1.17x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./plugins/antigravity-awesome-skills-claude/skills/api-security-best-practices/SKILL.md

Evaluation results

100%

13%

User Authentication Service

JWT authentication with refresh tokens and secure secret handling

Criteria

Without context

With context

JWT secret from env var

100%

Short access token expiry

100%

Refresh token with longer expiry

100%

Refresh token stored in DB

62%

100%

DB validation on refresh

75%

100%

Issuer/audience in JWT

100%

No sensitive data in JWT payload

100%

bcrypt password hashing

100%

Sanitized auth error messages

100%

No internal errors exposed

100%

Token invalidation on logout

100%

Input validation on login

100%

API Gateway Security Hardening

API rate limiting with Redis and Helmet.js security headers

Criteria

Without context

With context

Redis rate limit store

100%

General API rate limit

100%

Stricter auth rate limit

100%

skipSuccessfulRequests on auth

100%

Rate limit headers returned

100%

Helmet.js applied

100%

HSTS configured

100%

hidePoweredBy enabled

100%

Content Security Policy set

100%

CORS restricts origins

100%

Per-user key generator

100%

No Redis credentials hardcoded

100%

24%

Community Forum API — Authorization and Input Handling

Authorization checks, HTML sanitization, and password policy enforcement

Criteria

Without context

With context

Ownership check on delete

100%

RBAC check on delete

100%

403 for unauthorized delete

100%

DOMPurify for HTML sanitization

100%

HTML allowlist in sanitization

50%

100%

Password minimum length 12

100%

Password complexity rules

100%

bcrypt hashing with rounds >= 10

100%

Generic DB error messages

75%

100%

No password returned in response

100%

Input validation before DB

100%

Auth middleware applied

100%

Repository: sickn33/antigravity-awesome-skills
Commit: b3869ba

Evaluated: 17 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

User Authentication Service API Gateway Security Hardening Community Forum API — Authorization and Input Handling

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.