offensive-api-security

测试 API 安全性 覆盖 REST/gRPC/WebSocket 攻击面

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

请帮我安装这个 Agent Skill：https://github.com/SnailSploit/Claude-Red/tree/main/Skills/api/offensive-api-security

1. 先读取该目录下的 SKILL.md 和其他文件，检查是否有可疑内容（执行未知脚本、读取密钥、向外发送数据等），用中文告诉我它会做什么、需要哪些权限；
2. 等我确认后，再把整个目录安装到 ~/.claude/skills/offensive-api-security/（如果你不是 Claude Code，安装到你自己约定的 skills 目录）；
3. 安装后告诉我怎么触发它。

git clone --depth 1 --filter=blob:none --sparse https://github.com/SnailSploit/Claude-Red.git /tmp/offensive-api-security-src
cd /tmp/offensive-api-security-src && git sparse-checkout set "Skills/api/offensive-api-security"
mkdir -p ~/.claude/skills && cp -r "Skills/api/offensive-api-security" ~/.claude/skills/offensive-api-security

Skill 可以让智能体执行脚本。安装第三方 Skill 前务必看一遍内容，详见「安全」一课。