api-schema-security
Skill0 starsChanged 11 days agoMITView on GitHub
Review and lint API specifications (OpenAPI 3.x, GraphQL schemas) for security — authentication on every operation, strict schemas (additionalProperties false, formats, max lengths), rate-limit and pagination limits, sensitive fields, server URLs — with Spectral/OWASP rulesets, and enforce schema validation at the gateway. Use when reviewing an API design, adding API linting to CI, or hardening request validation.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
API Schema Security
Lint
npx @stoplight/spectral-cli lint openapi.yaml --ruleset .spectral.yaml.spectral.yaml:
extends:
- spectral:oas
- https://unpkg.com/@stoplight/spectral-owasp-ruleset/dist/ruleset.mjsThe OWASP ruleset flags missing security schemes, HTTP servers, unbounded strings/arrays, missing rate-limit headers, numeric IDs, and more. 42Crunch and similar tools provide commercial audits.
Checklist
| Area | Check |
| AuthN | Global security requirement; no operation with security: [] unless intentionally public |
| Schemas | additionalProperties: false on request bodies (prevents mass assignment), maxLength/pattern/format on strings, maxItems on arrays, numeric minimum/maximum |
| Identifiers | Prefer non-sequential IDs; never rely on them for authorization |
| Responses | Explicit response schemas; no internal fields (hashes, internal IDs, tokens) |
| Pagination | Enforced max page size |
| Servers | https:// only; no internal hostnames in public specs |
| Errors | Generic error schema without stack traces |
| GraphQL | Disable introspection in production (or restrict), query depth/complexity limits, per-field authorization, persisted queries for public clients |
Enforce at runtime
Gateway request validation against the spec (Kong/Apigee/AWS API Gateway request validators, Envoy/OPA policies, framework validators like FastAPI/pydantic, express-openapi-validator) — reject unknown fields and invalid types before business logic.
Related skills
api-inventory, api-authorization-testing, release-gate
References
- OWASP API Security Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x11-t10/
- Spectral: https://github.com/stoplightio/spectral
- Spectral OWASP ruleset: https://github.com/stoplightio/spectral-owasp-ruleset
- OWASP GraphQL Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.