Home / Skills / offensive-api-security

offensive-api-security

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and

ScannedSkillSource: GitHub

7,620 stars +163 this week Updated 23d ago License MIT Context ≈156 tokens always loaded

79popular

Why this score

Stars

20/35

Usage (forks)

9/15

Upkeep

25/25

License

15/15

Owner history

10/10

This repo hosts 10 skills, so its 7,620 stars are split between them (about 762 each) for scoring.

Popularity score: 79/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Oct 20, 2026 at commit a8de813edc9f, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.

Name	Score	Stars	Context	Updated
This oneoffensive-api-security SnailSploit/Claude-Red · Skill	79	★ 7.6k	≈156 always	23d ago
api-security 0xSteph/pentest-ai-agents · Subagent Both about security and exploitation	64	★ 2.4k	≈57 in chat	29d ago
09-web-security Masriyan/Claude-Code-CyberSecurity-Skill · Skill Both about security and owasp	66	★ 490	≈21 always	19d ago
backend-api-security-backend-security-coder wshobson/agents · Subagent Both about security and authentication	80	★ 41k	≈58 in chat	16d ago
api-protocol-security zhaji2333/CkSKILLS · Skill Both about security and bola	55	★ 122	≈45 always	2mo ago
ai-mcp-security Netw0rkNoob/VulnClaw · Skill Both about security	71	★ 3.8k	≈20 always	23d ago

Install

mkdir -p .claude/skills/offensive-api-security

curl -sL https://codeload.github.com/SnailSploit/Claude-Red/tar.gz/a8de813edc9f66f60d44cfe42d47750e89d9930b | tar -xz -C .claude/skills/offensive-api-security --strip-components=4 "Claude-Red-a8de813edc9f66f60d44cfe42d47750e89d9930b/Skills/api/offensive-api-security"

To remove it later:

rm -rf .claude/skills/offensive-api-security

npx skills add SnailSploit/Claude-Red --skill offensive-api-security

Pinned to commit a8de813edc9f as listed by GitHub.

Context cost: ≈156 tokens loaded every session (name and description), plus ≈5.0k tokens when the skill is used.

The Claude Code command downloads this skill folder at the pinned commit into .claude/skills/. The Skills CLI (npx skills) works with many agents but can't pin a version, so it installs whatever is current.

Used for

Engineering › Testing & QA Security › Security review

Facts

Repo: SnailSploit/Claude-Red
Stars: 7,620
Forks: 1,001
Last push: 2026-10-12 (23d ago)
License: MIT
Owner: SnailSploit · since 2021
Language: Python
Works with: Claude Code, Skills CLI