사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-review시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
API Security Review
Perform comprehensive API security assessment following plays/api-security-review.md.
Steps
- Discovery & Reconnaissance
- Parse OpenAPI/Swagger specs or scan code for endpoints
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
- Map API gateway and middleware configurations
- Enumerate all API versions and deprecated endpoints
- Authentication Deep Dive
- JWT security (algorithm confusion, weak signing, token expiration)
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
- API key exposure and rotation policies
- Session management and token storage
- Assess All 10 OWASP API Risks with attack scenarios:
- API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
- API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
- API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
- API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
- API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
- API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
- API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
- API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
- API9 Inventory — Shadow APIs, zombie endpoints, version confusion
- API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
- Automated Testing
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
- Test for common vulnerabilities with specific payloads
- Validate rate limiting and throttling mechanisms
- API Gateway & Infrastructure Review
- Kong, nginx, Envoy, AWS API Gateway configurations
- WAF rules and bypass opportunities
- TLS configuration and certificate validation
Output
Comprehensive API security report including:
- API surface inventory with authentication mechanisms
- Risk matrix with severity ratings for all 10 categories
- Detailed findings with proof-of-concept examples
- Exploit scenarios and business impact analysis
- Prioritized remediation roadmap with code examples
- Testing artifacts and vulnerability evidence
OWASP References
- OWASP API Security Top 10 (2023)
- OWASP ASVS v5.0 — V13: API and Web Service
- OWASP Testing Guide: WSTG-APIT
- OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0
