Individual skill

api-security-checklist

Web app API security checklist. Provides OWASP Top 10-based vulnerability checks, authentication/authorization patterns, input validation, Rate Limiting, CORS, CSRF, and SQL Injection defense as a backend-dev extension skill. Use for requests like 'API security', 'OWASP', 'auth implementation', 'SQL Injection', 'XSS defense', 'CORS configuration', 'security checklist', and other backend security design tasks. However, penetration testing or WAF configuration is outside this skill's scope.

en/16-fullstack-webapp/.claude/skills/api-security-checklist/skill.md

Read pinned source

Source commit 8e8d35c6a19166614d1af1df85512266d51121ae

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,323
Repository last updated: Mar 22, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

security Derived category
design Derived category
data Derived category
testing Derived category
data-databases Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

skill.mdcore · 6,636 bytes

Read excerpt


# API Security Checklist — Web App API Security Checklist

An OWASP-based security checklist, authentication patterns, and defense code guide that the backend-dev agent uses during API development.

## Target Agent

`backend-dev` — Applies this skill's security checklist directly to API implementation.

## OWASP API Security Top 10 Check

| Rank | Vulnerability | Check Item | Defense |
|------|-------------|-----------|---------|
| A1 | **BOLA** (Broken Object Level Authorization) | Can another user's resources be accessed? | Verify object ownership at every endpoint |
| A2 | **Broken Authentication** | Weak passwords, unlimited login attempts? | bcrypt hashing, Rate Limit, MFA |