exploiting-api-injection-vulnerabilities

exploiting-api-injection-vulnerabilities is a Penetration testing & red team skill for AI agents, published by killvxk in the cybersecurity-skills-zh repository on GitHub. Skillspace rates exploiting-api-injection-vulnerabilities F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.

通过 API 参数、请求头和请求体，测试 API 的注入漏洞，包括 SQL 注入、NoSQL 注入、操作系统命令注入、LDAP 注入和服务端请求伪造（SSRF）。测试人员针对不同的后端技术和注入上下文构造恶意载荷，以提取数据、执行命令或访问内部服务。对应 OWASP API8:2023 安全错误配置和 API7:2023 SSRF。适用于 API 注入测试、API 中的 SQL 注入、NoSQL 注入、SSRF 测试或 API 输入验证评估等请求场景。

Grade
F
Quality
45 / 100
Safety
Risky
GitHub stars
32

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since.

View source on GitHubkillvxk/cybersecurity-skills-zh

Our review

Architecture
84 / 100
Maturity
Packaged: licensed, with a version or references
Security scan
High-risk patterns
License
Apache-2.0
Adoption
Adopted by 0 other repositories, in 1 collections

What the scanner flagged

  • accesses sensitive system files
  • mentions secrets in text

Not checked yet

  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Penetration testing & red team

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.