Description
api-security-testing is a skill from the Strix project for security-testing a REST, GraphQL or gRPC API with autonomous agents. It explains why APIs need a different approach from web interfaces: there is no rendered surface to crawl, the most serious bugs are about authorization rather than injection, and the same endpoint can behave differently for each token. The workflow starts by gathering what the agents need. A schema, such as an OpenAPI or Swagger file, a Postman collection, a GraphQL endpoint or a gRPC proto file, lets the agents enumerate endpoints instead of guessing, and an OpenAPI or Postman file can be passed directly, while a proto file is passed as a workspace file. Two sets of credentials, ideally in different tenants, are needed to prove broken object-level authorization, and a low-privilege and a high-privilege token help prove function-level authorization problems. The skill also asks for example object IDs, out-of-scope routes, and any rate limits or web application firewall in front of the API. It uses the OWASP API Security Top 10 from 2023 as its coverage checklist. Only test APIs you own or are authorized to test, and prefer a staging environment, since the agents send real exploit payloads. It passes Gen Agent Trust Hub and Snyk on skills.sh, and Socket shows a warning. It has about 10,200 installs. Install it with npx skills add https://github.com/usestrix/strix --skill api-security-testing.…
Highlights
- Enumerates endpoints from OpenAPI, GraphQL or gRPC schemas
- Tests authorization problems with two tokens in different tenants
- Covers the OWASP API Security Top 10 from 2023
- Asks for scope, rate limits and example object IDs first
Ratings & Reviews
No ratings yet
Be the first to rate api-security-testing.
People also visit
application-security-testing
Application security testing (AppSec) across a whole product with Strix
fix-security-vulnerabilities-with-strix
Fix security vulnerabilities found by a Strix pentest
penetration-testing-with-strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix
api-security-testing FAQ
Which APIs can it test?
REST, GraphQL and gRPC.
What makes the testing effective?
A schema lets the agents enumerate endpoints. Two tokens in different tenants let them prove authorization flaws.
Should I test production?
Prefer staging. The agents send real exploit payloads and can change data.
Am I allowed to test any API?
Only APIs you own or are explicitly authorized to test.
How do I install it?
Run npx skills add https://github.com/usestrix/strix --skill api-security-testing.
What are the best api-security-testing alternatives?
Popular alternatives to api-security-testing include owasp-top-10-testing, application-security-testing and fix-security-vulnerabilities-with-strix. See all api-security-testing alternatives