Skip to content
SkillCheatSheet Sign in

api-security-testing

An AI agent skill from usestrix/strix, scored 60 out of 100 by code.

60/ 100C

Code score by group

  • Spec20/20
  • Description8/20
  • Procedure3/15
  • Done criteria4/15
  • Resources10/10
  • Scripts5/8
  • Safety7/7
  • Upkeep3/5

It loses the most points in Description (12), the group that checks whether the description says what the skill does and when to use it.

What the author says it does

Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, secu…

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
usestrix/strix
Folder
skills/api-security-testing
License
Apache-2.0
GitHub stars
75,087
SKILL.md lines
62
Other files
0

Add api-security-testing to your agent

npx skills add usestrix/strix --skill api-security-testing

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

More skills from usestrix/strix

  1. penetration-testing-with-strix

    Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

    76B
  2. ci-security-scanning-with-strix

    Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

    70B
  3. fix-security-vulnerabilities-with-strix

    Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…

    69C
  4. find-security-vulnerabilities-in-code

    Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization…

    65C
  5. web-app-penetration-testing

    Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, brok…

    65C
  6. managed-pentesting-with-strix

    Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Sa…

    64C
  7. owasp-top-10-testing

    Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control…

    62C
  8. application-security-testing

    Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn th…

    59C

All skills in usestrix/strix

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.