API Security Testing
Security-test a REST, GraphQL, or gRPC API with Strix : autonomous agents.
Works in any agent
2 static scans, 0 counted findings.
Recorded for this package revision; Edge checks the exact bundle again when your agent loads it.
What this skill does for you
Security-test a REST, GraphQL, or gRPC API with Strix : autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) : broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.
Quoted from the skill description in the pinned sourceUse it with Edge
Set up Edge for me: read getedge.cc/SKILL.md and follow it. Then use Edge to load the api-security-testing skill from usestrix/strix.
Paste it into Claude, ChatGPT, Codex or Cursor.
Or read the skill source first.
Security evidence
| Scanner | Date | Result | Findings |
|---|---|---|---|
| Edge static checks | 2026-09-29 | Pass | 0 |
| Edge committed-secret checks | 2026-09-29 | Pass | 0 |
Static scans check the code, not how well the skill works.
Scanner scope, raw findings and mirrored provider records
Edge static checks (Edge-run): edge-static/1.0.0. Scope: Static patterns for remote execution, credentials with network sends, obfuscation, prompt overrides, hidden Unicode, binaries and persistence. Revision: 0c702723aa4adf2d388b7218510a6207676bb2e0. Raw findings: not supplied. Counted findings: .
Edge committed-secret checks (Edge-run): edge-secrets/1.0.0. Scope: Credentials committed in the skill's files (values never shown). Revision: 0c702723aa4adf2d388b7218510a6207676bb2e0. Raw findings: not supplied. Counted findings: .
Socket (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Snyk (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Source and licence
- Repository
- https://github.com/usestrix/strix
- Pinned skill file
- View source at revision
- Revision
- 0c702723aa4adf2d388b7218510a6207676bb2e0
- Package hash
- sha256:59f3ea7341909db88153a7b78a4dfd3bb846cda018a84b756555bb7c08c23bf1
- Licence
- Apache-2.0
Files in the scanned package
| File | Size |
|---|---|
| SKILL.md | 6.2 KB |
Try API Security Testing in your agent.
Security-test a REST, GraphQL, or gRPC API with Strix : autonomous agents.