本文へ移動
cccskills
無料GitHub で公開

api-security-testing

Security testing checklist for HTTP APIs—authn/z, input validation, rate limits, sensitive data exposure, and common OWASP API issues. Use when reviewing or testing REST/GraphQL endpoints before release.

インストール方法を見る

含まれるファイル(1)

  • SKILL.md1.9 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

API security testing

Preconditions

  • Test in non-production unless explicitly authorized.
  • Use dedicated test accounts; never real customer PII in payloads.

Test matrix (prioritized)

Authentication and session

  • Missing/invalid token rejected (401)
  • Expired or revoked credentials rejected
  • Session fixation / cookie flags (HttpOnly, Secure, SameSite) where applicable

Authorization

  • Horizontal: user A cannot access user B's resource IDs
  • Vertical: non-admin cannot invoke admin routes
  • IDOR on path/query/body identifiers

Input and abuse

  • Oversized payloads rejected
  • Injection surfaces parameterized (SQL, command, template)
  • Rate limiting on auth and expensive endpoints

Data exposure

  • Errors do not leak stack traces or secrets in prod-like config
  • Responses omit internal fields (tokens, hashes, full PAN)
  • Pagination does not bypass auth filters

Transport and config

  • HTTPS enforced; HSTS where applicable
  • CORS not * with credentials
  • Security headers on API gateway if present

Web-facing surfaces (when API serves or pairs with UI)

  • CSP or explicit script policy documented
  • CSRF protection on cookie-based mutations
  • Clickjacking headers (X-Frame-Options or CSP frame-ancestors) where relevant
  • File upload: type/size limits, virus scan hook if required by policy

Reporting

For each finding: endpoint, steps, impact, severity, remediation, retest status.

Boundaries

  • Defensive testing only; no unauthorized production scanning.
  • For deep pen-test, engage formal AppSec process.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

"Implement and select ad bidding strategies from manual CPC to automated target-CPA and target-ROAS. Use this skill when the user needs to choose a bidding strategy, set up automated bidding, or optimize bid parameters — even if they say 'what bidding strategy should I use', 'target CPA setup', or 'smart bidding configuration'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

"Optimize advertising budget allocation across campaigns using marginal returns analysis. Use this skill when the user needs to distribute budget across multiple campaigns, optimize spend pacing, or maximize overall ROAS under budget constraints — even if they say 'how to split my ad budget', 'campaign budget optimization', or 'diminishing returns on ad spend'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

"Build CTR prediction models for estimating ad click-through rates from features. Use this skill when the user needs to predict click probability, build an ad ranking model, or evaluate ad creative performance — even if they say 'predict click rate', 'ad relevance scoring', or 'which ad will get more clicks'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

"Implement Generalized Second Price auction for ad slot allocation and pricing. Use this skill when the user needs to understand search ad auctions, compute ad positions and costs-per-click, or analyze bidding dynamics — even if they say 'how does Google Ads auction work', 'ad rank calculation', or 'second price auction for ads'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

"Implement VCG mechanism for incentive-compatible ad slot allocation with truthful bidding. Use this skill when the user needs to design a truthful auction mechanism, compute externality-based payments, or understand why platforms may prefer GSP over VCG — even if they say 'truthful auction design', 'VCG payments', or 'incentive-compatible mechanism'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

"Explain blockchain fundamentals including distributed ledger architecture, consensus mechanisms, and block structure. Use this skill when the user needs to understand blockchain concepts, evaluate whether blockchain fits a use case, or design a blockchain-based solution — even if they say 'how does blockchain work', 'do I need blockchain', or 'distributed ledger'.".

日本語の概要は準備中です。原文の説明を表示しています。

charlieviettq/awesome-agent-skill262026年7月20日 更新

charlieviettq のスキルをすべて見る

このスキルの問題を報告する