Api pentest

Skill yuelenghan/orbit/skills/api-pentest

Adapted public skill for authorized API and web application security testing across REST, GraphQL, and gRPC interfaces.From its SKILL.md

Install

npx -y skills add yuelenghan/orbit --skill api-pentest

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.5 KB, 249 tokens by cl100k_base, as published. Nobody here has run it

API Penetration Testing

Adapted from Anthropic-Cybersecurity-Skills/skills/conducting-api-security-testing/SKILL.md for Orbit.

Use this skill for authorized API and web application security testing, especially when the target involves REST, GraphQL, gRPC, authentication flows, authorization testing, IDOR, rate limiting, input validation, or business logic abuse.

When to Use

REST API security testing
GraphQL security assessment
gRPC security testing
authorization and authentication testing
API business logic and data exposure review

Inputs

confirmed authorization context
target boundary
target-specific endpoint, host range, or cloud scope

Safety Boundary

Do not use this skill without explicit authorization from the target owner. Do not use it for destructive denial-of-service activity or malicious exploitation outside an approved testing scope.

Focus Areas

broken object and function-level authorization
authentication and token handling
input validation and injection paths
rate limiting and abuse controls
excessive data exposure
business logic flaws

Output Expectations

Provide:

tested scope
findings and severity
proof-of-concept or reproduction steps
remediation guidance

What ships with it: 1 file

319 B alongside SKILL.md

LICENSES/

NOTICE.txt319 B

Gives 0 of the 12 instructions most security skills give in 249 tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accessin 82 of 666, across 79 files
Hash passwords with BCryptin 55 of 666, across 39 files
Implement rate limiting for public endpointsin 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputin 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

Test REST GraphQL and gRPC interfaces
Assess authentication and token handling
Evaluate input validation and injection paths
Test rate limiting and abuse controls
Review for excessive data exposure

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.