Api pentest

Skill yuelenghan/orbit/skills/api-pentest

An open-source arsenal of reusable skills for AI agents — repo understanding, code review, delivery workflows, security pentests, and plug-and-play integrations with Jira, GitHub, GitLab, Jenkins & more. Drop into Claude Code, Codex, or any skill-aware host.

Install

npx -y skills add yuelenghan/orbit --skill api-pentest

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Adapted public skill for authorized API and web application security testing across REST, GraphQL, and gRPC interfaces.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.5 KB, as published. Nobody here has run it

API Penetration Testing

Adapted from Anthropic-Cybersecurity-Skills/skills/conducting-api-security-testing/SKILL.md for Orbit.

Use this skill for authorized API and web application security testing, especially when the target involves REST, GraphQL, gRPC, authentication flows, authorization testing, IDOR, rate limiting, input validation, or business logic abuse.

When to Use

REST API security testing
GraphQL security assessment
gRPC security testing
authorization and authentication testing
API business logic and data exposure review

Inputs

confirmed authorization context
target boundary
target-specific endpoint, host range, or cloud scope

Safety Boundary

Do not use this skill without explicit authorization from the target owner. Do not use it for destructive denial-of-service activity or malicious exploitation outside an approved testing scope.

Focus Areas

broken object and function-level authorization
authentication and token handling
input validation and injection paths
rate limiting and abuse controls
excessive data exposure
business logic flaws

Output Expectations

Provide:

tested scope
findings and severity
proof-of-concept or reproduction steps
remediation guidance