api-security

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

覆盖常见 API 风险，适合在代码生成或审查阶段快速校验。

这个 Skill 做什么

对 HTTP/GraphQL/gRPC 等 API 应用 OWASP Top10 的安全校验与最佳实践。

帮你把 OWASP API Top10 的防护思想落到实处，处理认证、授权和输入校验这些 API 常见漏洞。适用于生成或审查 HTTP、GraphQL、gRPC 接口，或在写 handler、resolver、service 方法时使用。特点是默认要求鉴权、最小权限和严格参数化/白名单校验，能把注入、越权等常见风险统一覆盖。

▸ 展开 SKILL.md 英文原文

Apply OWASP API Top 10 patterns to authentication, authorization, and input validation — Applies to: when generating HTTP handlers; when generating GraphQL resolvers; when generating gRPC service methods; when reviewing API endpoint changes

开发编程API安全OWASP鉴权通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/api-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/api-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/api-security/SKILL.md. -->

# API Security

Apply OWASP API Top 10 patterns to authentication, authorization, and input validation

## ALWAYS

- Require authentication on every non-public endpoint. Default to authenticated; opt out for genuinely public routes by explicit annotation.
- Apply authorization at the object level — confirm the authenticated subject actually has access to the requested resource ID, not just that they're logged in (defeats the OWASP API1 BOLA / IDOR class).
- Bind object-level authz to the **gateway

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有