Mode d’emploi
- Copiez la commande et examinez le paquet avant de l’installer dans votre environnement agent.
- Consultez le document original pour les outils, identifiants et environnements requis.
- Décrivez les entrées et le livrable souhaité ; comparez la sortie aux sources.
npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-reviewAvant de commencer
- L’installation n’inclut ni abonnement au modèle, ni quota API, ni accès aux fichiers.
- Étoiles et installations reflètent l’activité, pas un test indépendant de qualité ou de sécurité.
Document Skill original
Rendu depuis le dépôt source en conservant titres, exemples, code, tableaux, liens et images.
API Security Review
Perform comprehensive API security assessment following plays/api-security-review.md.
Steps
- Discovery & Reconnaissance
- Parse OpenAPI/Swagger specs or scan code for endpoints
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
- Map API gateway and middleware configurations
- Enumerate all API versions and deprecated endpoints
- Authentication Deep Dive
- JWT security (algorithm confusion, weak signing, token expiration)
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
- API key exposure and rotation policies
- Session management and token storage
- Assess All 10 OWASP API Risks with attack scenarios:
- API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
- API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
- API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
- API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
- API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
- API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
- API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
- API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
- API9 Inventory — Shadow APIs, zombie endpoints, version confusion
- API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
- Automated Testing
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
- Test for common vulnerabilities with specific payloads
- Validate rate limiting and throttling mechanisms
- API Gateway & Infrastructure Review
- Kong, nginx, Envoy, AWS API Gateway configurations
- WAF rules and bypass opportunities
- TLS configuration and certificate validation
Output
Comprehensive API security report including:
- API surface inventory with authentication mechanisms
- Risk matrix with severity ratings for all 10 categories
- Detailed findings with proof-of-concept examples
- Exploit scenarios and business impact analysis
- Prioritized remediation roadmap with code examples
- Testing artifacts and vulnerability evidence
OWASP References
- OWASP API Security Top 10 (2023)
- OWASP ASVS v5.0 — V13: API and Web Service
- OWASP Testing Guide: WSTG-APIT
- OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0
