This skill encodes the OWASP API Security Top 10 for secure API design, code review, and vulnerability prevention. References are loaded per risk (progressive disclosure).
| API1 Broken Object Level Authorization | references/api1-broken-object-level-authorization.md | | API2 Broken Authentication | references/api2-broken-authentication.md | | API3 Broken Object Property Level Authorization | references/api3-broken-object-property-authorization.md |
| API4 Unrestricted Resource Consumption | references/api4-unrestricted-resource-consumption.md | | API5 Broken Function Level Authorization | references/api5-broken-function-level-authorization.md | | API6 Unrestricted Access to Sensitive Business Flows | references/api6-sensitive-business-flows.md |
OWASP API Security Top 10 - prevention, detection, and remediation for REST/GraphQL/API security. Use when designing or reviewing APIs - object- and function-level authorization, authentication, rate limiting and resource consumption, sensitive business flows, SSRF, API inventory and versioning, or consumption of third-party APIs. Source: yariv1025/skills.