spencergeee/API Fuzzing for Bug Bounty
.agent/skills/api-fuzzing-bug-bounty/SKILL.md
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
development
Updated Apr 14, 2026
$ install --global
skillsauthnpx skillsauth add spencergeee/spentrade API Fuzzing for Bug BountyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 30, 2026, 7:02 AM36.2s17 files scanned
SKILL.md
- name:
- API Fuzzing for Bug Bounty
- description:
- This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
- author:
- zebbern
- version:
- 4.1.0-fractal
API Fuzzing for Bug Bounty
Purpose
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
Inputs/Prerequisites
- Burp Suite or similar proxy tool
- API wordlists (SecLists, api_wordlist)
- Understanding of REST/GraphQL/SOAP protocols
- Python for scripting
- Target API endpoints and documentation (if available)
Outputs/Deliverables
- Identified API vulnerabilities
- IDOR exploitation proofs
- Authentication bypass techniques
- SQL injection points
- Unauthorized data access documentation
API Types Overview
| Type | Protocol | Data Format | Structure | |------|----------|-------------|-----------| | SOAP | HTTP | XML | Header + Body | | REST | HTTP | JSON/XML/URL | Defined endpoints | | GraphQL | HTTP | Custom Query | Single endpoint |
Core Workflow
🧠 Knowledge Modules (Fractal Skills)
1. Step 1: API Reconnaissance
2. Step 2: Authentication Testing
3. Step 3: IDOR Testing
4. Step 4: Injection Testing
5. Step 5: Method Testing
6. Introspection Query
7. GraphQL IDOR
8. GraphQL SQL/NoSQL Injection
9. Rate Limit Bypass (Batching)
10. GraphQL DoS (Nested Queries)
11. GraphQL XSS
12. GraphQL Tools
13. PDF Export Attacks
14. DoS via Limits
15. Example 1: IDOR Exploitation
16. Example 2: GraphQL Introspection
Related Skills
spencergeee/brand-guidelines
development
VerifiedTrustedCommunity
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
SKILL.mdUpdated Apr 14, 2026
spencergeee/brand-guidelines
development
VerifiedTrustedCommunity
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
SKILL.mdUpdated Apr 14, 2026
spencergeee/blockrun
testing
VerifiedTrustedCommunity
Use when user needs capabilities Claude lacks (image generation, real-time X/Twitter data) or explicitly requests external models ("blockrun", "use grok", "use gpt", "dall-e", "deepseek")
SKILL.mdUpdated Apr 14, 2026
spencergeee/blockchain-developer
development
VerifiedTrustedCommunity
Build production-ready Web3 applications, smart contracts, and decentralized systems. Implements DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integrations. Use PROACTIVELY for smart contracts, Web3 apps, DeFi protocols, or blockchain infrastructure.
SKILL.mdUpdated Apr 14, 2026