Api Shield Pro

API Shield Pro helps your AI coding agent audit and harden REST APIs at the application layer, with working code for your framework instead of generic advice.

WHAT IT DOES

• Audits your existing routes against a 30+ item pre-deploy checklist and reports findings as CRITICAL / HIGH / MEDIUM / LOW, each with location, impact and fix
• Generates middleware for Express (Node.js), FastAPI (Python) and Gin (Go)
• Tells you how to verify each control with curl commands

WHAT IS COVERED

• Authentication: pinned JWT algorithms, issuer/audience/expiry checks, strict limits on login, reset and OTP endpoints
• Rate limiting: per-IP, per-user and per-endpoint limits, 429 responses with Retry-After
• Input validation: schema allowlists, unknown fields rejected, body size limits, NoSQL operator objects blocked
• CORS and headers: explicit origin allowlist, HSTS, nosniff, frame protection, Referrer-Policy, CSP
• Structured security logging without secrets

WHAT YOU GET

• SKILL.md with a 4-step workflow (context, audit, generate, verify)
• Framework references: express.md, fastapi.md, gin.md
• pre-deploy-checklist.md

HOW TO USE Install the skill and say: "Secure my FastAPI login endpoint with a 5 attempts per 15 minutes limit" or "Review these routes before I deploy". The skill asks up to 3 short questions (framework, auth model, proxy setup), then continues.

HONEST LIMITS Application layer only. It does not replace a WAF/CDN for volumetric DDoS, infrastructure hardening or a penetration test. Injection protection relies on parameterized queries and schema validation, not string sanitizing.