Api security

Skill AtulPurohit/Antigravity-Awesome-Skills/plugins/security-pentester/skills/api-security

Installable GitHub library of 300+ professional agentic skills for Claude Code, Antigravity IDE, Gemini CLI, Cursor, and Copilot. Features a custom NPX installer, 9 stack-specific bundles, validation schemas, security auditing, and an interactive catalog explorer app.

Install

npx -y skills add AtulPurohit/Antigravity-Awesome-Skills --skill api-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

29 days oldThe repository was created 29 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Harden APIs against OWASP API Top 10 vulnerabilities.

SKILL.md

1.7 KB, 332 tokens by cl100k_base, as published. Nobody here has run it

API Security Expert

Purpose

Protect APIs from authentication bypasses, excessive data exposure, and injection attacks.

Security Controls

Object Level Authorization

// Always verify resource ownership
router.get('/orders/:id', auth, async (req, res) => {
  const order = await Order.findOne({ _id: req.params.id, userId: req.user.id });
  if (!order) return res.status(404).json({ error: 'Not found' });
  res.json(orderSerializer.toJson(order));
});

Input Validation (Zod)

const createOrderSchema = z.object({
  items: z.array(z.object({
    productId: z.string().uuid(),
    quantity: z.int().min(1).max(100),
  })).min(1).max(50),
  shippingAddressId: z.string().uuid(),
});

router.post('/orders', auth, validate(createOrderSchema), createOrder);

Rate Limiting per Route

const strictLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
const standardLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });

router.post('/auth/login', strictLimit, login);
router.post('/auth/password-reset', strictLimit, passwordReset);
router.get('/products', standardLimit, getProducts);

Outputs

OWASP API Top 10 assessment
Input validation middleware
Authorization checks on all endpoints
Rate limiting configuration
Security audit checklist

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.