api-security-testing
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.
Install
With your agent
Install OMGSkills skill "usestrix/strix:api-security-testing" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/api-security-testing ~/.claude/skills/api-security-testingFrom README
Security-test an API APIs fail differently from web UIs: there is no rendered surface to crawl, the interesting bugs are authorization-shaped rather than injection-shaped, and the same endpoint behaves differently per token. This workflow targets those specifics with Strix's autonomous agents, using the current OWASP API Security Top 10 (2023) as the coverage checklist. For the web-app equivalent, the current edition is the OWASP Top 10:2025 — see owasp-top-10-testing. , LLM , full CLI flags, and the managed-cloud path are in the penetration-testing-with-strix skill. Read it if strix --version fails or the target is not an API. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix).
More from this repo
ci-security-scanning-with-strix
Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
penetration-testing-with-strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that...
application-security-testing
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...