API Testing Skill

SkillDev tools

Evaluates REST, GraphQL, and JSON-RPC APIs for authorization issues (BOLA/IDOR), schema exposure, and business logic flaws.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the API Testing Skill skill

What this skill tells your AI

The instructions your AI receives, as published by zyrexnn/cybermes in skills/api-testing/SKILL.md and read by ahel’s review.

Analyze candidate API endpoints identified during web enumeration for API security risks (OWASP API Security Top 10).

Catalog API Endpoints: Aggregate candidate endpoints from /workspace/recon/<target>/api_candidates.txt.
Schema & Documentation Discovery: Inspect common API documentation paths:
- /swagger.json, /openapi.json, /api-docs
- /graphql (check schema introspection query)
- /v1/, /v2/ versioning discrepancies
Analyze API Attack Surfaces:
- Broken Object Level Authorization (BOLA/IDOR): Inspect numeric or GUID parameters in URI paths (/api/users/101).
- Broken Authentication: Test missing Authorization or Bearer tokens on sensitive resources.
- Mass Assignment: Check if object update payloads accept unexpected attributes (e.g., role: "admin", is_verified: true).
- Excessive Data Exposure: Compare frontend display vs full raw API JSON response objects.
Preserve Request/Response Logs: Store all curl commands and raw JSON responses in /workspace/output/api_tests/<target>/.

Do not perform automated volumetric fuzzing without explicit scope authorization.
Test authorization boundaries using two distinct test accounts (Account A vs Account B), never modifying target data without authorization.

Advanced