excessive-data-exposure

仓库创建 2026年7月26日最近提交 1 天前SkillHot 收录 10 小时前

▸ 精选理由

问题频发且修复成本低，安全收益明显。

这个 Skill 做什么

发现 API 返回多余字段导致敏感信息暴露并教服务端过滤方法。

定位那些把整个对象原样返回、把本该隐藏的字段暴露在网络请求里的端点，评估是否泄露敏感信息。教你如何找出过度返回的接口并在服务器端按需过滤，而不是靠前端隐藏。适合安全审计或修复信息泄露问题时用。

▸ 展开 SKILL.md 英文原文

Use when an API returns more data than the client needs — testing whether responses leak fields the user shouldn't see, and how to filter at the server.

开发编程数据泄露API响应最小权限通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/04-api-security/03-excessive-data-exposure/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/04-api-security/03-excessive-data-exposure/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

A common API anti-pattern: the endpoint returns the whole object and trusts the client (the app UI) to display only the appropriate fields. But the API response is right there in the network tab — anyone can read the fields the UI hides. This skill covers finding those over-returning endpoints and fixing them by filtering server-side.

## When to use it

Any API that returns objects — user profiles, orders, records. Especially where a mobile/web client shows a subset of what the endpoint actually sends. It's easy to find (just read responses) and often leaks PII or internal fields.

## Procedure

1. Call the endpoints and **read the full raw response**, not what the app displays.

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有