api security audit agent
Professional API security auditor for identifying BOLA, tenant isolation failures, and OWASP Top 10 risks.
$5
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsapi security audit agent
Example session with this skill installed
Audit this OpenAPI spec for a multi-tenant fintech app. Pay close attention to the /transfers and /accounts endpoints. We use JWT for auth. [OpenAPI YAML attached]
- Read your context and instructions
- Compiled the api security audit
I have completed the security audit of the fintech API specification. The review focused on tenant isolation and authorization flows for financial transactions.
API Security Audit Report: Fintech Core
Executive Summary
The API design has strong authentication foundations but suffers from significant authorization gaps at the object level (BOLA) and lacks sufficient abuse controls for high-frequency transfers.
Findings Summary
| ID | Severity | Status | Risk Class | Attack Surface | Remediation |
|---|---|---|---|---|---|
| SEC-001 | Critical | Confirmed | API1:2023 BOLA | /accounts/{id} | Enforce server-side ownership check |
| SEC-002 | High | Design Weakness | API4:2023 Resource Consumption | /transfers | Implement per-tenant rate limiting |
| SEC-003 | Medium | Evidence Gap | API2:2023 Broken Auth | JWT Validation | Verify RS256 signature enforcement |
Detailed Finding: SEC-001 - Broken Object Level Authorization
- Status: Confirmed Weakness
- Affected Operations:
GET /accounts/{id},PATCH /accounts/{id}
Threat Scenario: An authenticated user can access or modify any account details by incrementing the integer {id} in the URL path. The spec does not indicate a check that the account_id belongs to the tenant_id extracted from the JWT.
Evidence: The account_id is a simple integer path parameter with no corresponding middleware check defined in the operation summary.
Remediation: Implement a repository-level filter that includes tenant_id in every SQL query: SELECT * FROM accounts WHERE id = ? AND tenant_id = ?.
Next steps
- Implement the suggested SQL filter for all account-related queries.
- Provide the JWT validation middleware source code to resolve the SEC-003 evidence gap.
- Define a global rate-limiting policy to mitigate SEC-002.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
Vague security advice doesn't fix bugs. General-purpose LLMs often miss deep authorization flaws, tenant isolation gaps, or broken object-level access in complex API designs.
What it does
- Identifies OWASP API Top 10 risks including BOLA, BFLA, and mass assignment.
- Maps trust boundaries across public, internal, and service-to-service interfaces.
- Evaluates tenant isolation strategies in database queries and background jobs.
- Generates a control coverage matrix for authentication, validation, and abuse controls.
- Produces evidence-based findings that separate confirmed weaknesses from missing documentation.
Why this beats prompting it yourself
This skill implements a structured audit methodology that forces evaluation of per-object authorization, not just endpoint access. It prevents the common AI mistake of assuming a framework is secure by default or that TLS solves application-level auth issues.
Use cases
- Reviewing OpenAPI/Swagger specs for data exposure before a release.
- Auditing multi-tenant logic in middleware and policy definitions.
- Hardening webhook implementations against SSRF and replay attacks.
- Performing a security gap analysis on legacy internal API documentation.
Known limitations
Cannot guarantee runtime security without access to production environment variables or traffic logs. Does not perform destructive testing or live exploitation.
Requires API specifications or source code to provide high-confidence findings. Does not perform live penetration testing or destructive exploits.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 2 months ago
Permissions
No special permissions declared or detected