CtrlK
BlogDocsLog inGet started
Tessl Logo

api-fuzzing-bug-bounty

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.

64

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/api-fuzzing-bug-bounty/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, payload-rich reference that scores well on actionability and conciseness. It is held back by a workflow lacking validation checkpoints and by a monolithic structure with no progressive disclosure into bundle files.

Suggestions

Add explicit validation/verification checkpoints to the Core Workflow (e.g., after each test step, confirm the finding is a true positive and document reproduction steps before moving on), especially around the DoS and batched-request techniques.

Split the large Tools Reference, Common API Vulnerabilities Checklist, and per-technique payload catalogs into files under references/ (e.g., TOOLS.md, PAYLOADS.md) and link them from a leaner SKILL.md overview.

De-duplicate the Quick Reference table against the detailed sections, or fold it into the section it summarizes, to remove restated content.

DimensionReasoningScore

Conciseness

The body is dense and mostly actionable payloads/commands with little concept over-explanation, but the Quick Reference, Common Vulnerabilities Checklist, and Tools Reference tables partially restate detail already covered in the step sections and could be trimmed.

4 / 5

Actionability

Copy-paste-ready payloads and commands throughout — exact IDOR bypass JSON, SQLi-in-JSON boolean probes, GraphQL introspection queries, curl examples, and 403 bypass path lists cover the common cases concretely.

5 / 5

Workflow Clarity

Steps 1–5 (Reconnaissance → Auth → IDOR → Injection → Method) give a clear sequence, but there are no validation/verification checkpoints (e.g., confirm a finding is a true positive, assess impact before reporting); the included DoS-via-limits and batched-request techniques trigger the destructive/batch cap of 3.

3 / 5

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ absent) and the ~425-line body is a monolith with large tool tables and exhaustive payload catalogs inlined that belong in separate reference files; section headers are clear but nothing is split out or linked.

3 / 5

Total

15

/

20

Passed

Description

81%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has excellent, natural trigger coverage and a distinct niche, with an explicit "Use when" clause. Its main weakness is a vague capability statement that leans on the trigger list rather than naming what the skill concretely does.

DimensionReasoningScore

Specificity

The explicit capability statement is the vague "needs guidance on API security assessment techniques," though concrete actions (fuzz APIs, find IDOR vulnerabilities, test REST/GraphQL) are embedded in the trigger list rather than stated as standalone capabilities.

3 / 5

Completeness

Both "what" and "when" are present with an explicit "This skill should be used when the user asks to…" clause, but the "what" ("guidance on API security assessment techniques") is generic where it could name concrete assessment activities.

4 / 5

Trigger Term Quality

Comprehensive natural quoted triggers a bug-bounty hunter would actually say — "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing" — with good synonym coverage; file extensions do not apply to this domain.

5 / 5

Distinctiveness Conflict Risk

The IDOR/GraphQL/REST-fuzzing/bug-bounty triggers carve a clear, specific niche with minimal overlap risk against other skills.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zebbern/claude-code-guide
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.