h0p3sf4ll

API Security Review — Security skill for Claude Code

Security community

OWASP API Security Top 10 (2023) review of REST, GraphQL, or gRPC APIs.

How to install API Security Review

Installs to ~/.claude/commands/h0p3sf4ll-threatlint-api-security-review.md

Terminal

mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/h0p3sf4ll/threatlint/HEAD/.claude/commands/api-security-review.md -o ~/.claude/commands/h0p3sf4ll-threatlint-api-security-review.md

Restart Claude Code, or start a new session, for it to be picked up.

What API Security Review does

description: "OWASP API Security Top 10 (2023) review of REST, GraphQL, or gRPC APIs. Finds broken object-level auth, excessive data exposure, missing rate limits, function-level auth gaps, and more. Saves a Word document." argument-hint: "Optional: specific API path, router file, or service to review (default: all APIs discovered)"

Delegate to the `appsec-api-security-reviewer` agent. Pass any path or service name as the review scope.

The agent will:

Map all API endpoints from rout

Alternatives in Security

Skill Audit — Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review 2.8k ★
Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
MCP Security Checklist (SlowMist) — Comprehensive checklist: input validation, rate limiting, RBAC, credential management, container hardening 819 ★