offensive-api-security

offensive-api-security is a Penetration testing & red team skill for AI agents, published by SnailSploit in the Claude-Red repository on GitHub. Skillspace rates offensive-api-security D (63/100) and the safety scan flagged it for review; the rating is based on static analysis only.

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

Grade
D
Quality
63 / 100
Safety
Needs review
GitHub stars
3,959

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHubSnailSploit/Claude-Red

Our review

Architecture
90 / 100
Maturity
Basic: a single SKILL.md
Security scan
Medium-risk patterns
License
Not declared. Check the repository before reusing it.

What the scanner flagged

  • suspicious outbound endpoint
  • mentions secrets in text

Not checked yet

  • Category is a classifier prediction; no model has read this skill yet
  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Penetration testing & red team

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.