{
  "markdown": "# Backend API Security Skills\n\nAI-powered security skills for **Node.js and Python backend APIs**. Targeted to\nREST / GraphQL / webhook APIs.\n\n## Skills\n\n| Skill | Mode | What it does |\n|---|---|---|\n| [`api-recon`](plugin/skills/api-recon/) | static | Pre-audit reconnaissance — route graph, auth matrix, invariants, architecture map. Language-agnostic. Run this first on unfamiliar repos. |\n| [`nodejs-api-auditor`](plugin/skills/nodejs-api-auditor/) | static | Audits Node.js APIs (Express, NestJS, Fastify, Koa). 8 parallel agents, confidence-ranked findings. |\n| [`python-api-auditor`](plugin/skills/python-api-auditor/) | static | Audits Python APIs (FastAPI, Django, Flask, Starlette). Same agent roster, Python grep patterns. |\n| [`runtime-audit`](plugin/skills/runtime-audit/) | **dynamic** | Fires real HTTP probes at a running API. Verifies static findings with curl-equivalent reproductions. Safety-gated by target tier. |\n\n**Static vs dynamic.** The auditors read source code and reason about it — good for breadth, sometimes issues false positives. `runtime-audit` sends real requests to a running target — good for proof, bounded by the endpoints and credentials you give it. Use them together: static finds the surface, dynamic confirms the exploits.\n\nEach static auditor runs 8 focused agents in parallel: `authz`, `authn`, `injection`,\n`deserialization-and-ssrf`, `crypto-and-secrets`,\n`resource-and-business-logic`, `config-and-supply-chain`,\n`llm-and-integration`. `runtime-audit` mirrors the same 8 personas as HTTP probe agents.\n\n## Install\n\n**From the marketplace** (inside any Claude Code session):\n\n```\n/plugin marketplace add souzavinny/backend-security-skills\n/plugin install backend-security-skills\n/reload-plugins\n```\n\nOnce installed, invoke from within a target repo:\n\n```\naudit this api\nreview api security on src/routes/orders.ts\nrun api-recon on this codebase\nrun runtime audit              # zero-config; autodetects or prompts\n```\n\n**Developer / local install** (pin to your checkout):\n\n```\nclaude --plugin-dir /path/to/backend-security-skills/plugin \"audit this api\"\nclaude --plugin-dir /path/to/backend-security-skills/plugin \"run api-recon on this codebase\"\n```\n\nFor repeated runs on the same repo, drop a [`runtime-audit.yaml`](plugin/skills/runtime-audit/runtime-audit.example.yaml) and skip the prompts entirely.\n\n## Output\n\nEach auditor writes a confidence-ranked report to:\n\n```\nassets/findings/{project}-api-audit-report-{YYYYMMDD-HHMMSS}.md\n```\n\nSorted **by severity first** (Critical → High → Medium → Low → Info), then confidence. Findings at or above the confidence threshold (default 75) include a diff-style fix; below-threshold findings get description only. Leads (partial exploit paths) are listed unscored for manual follow-up.\n\n### Integration flags\n\nEvery skill supports:\n\n- `--format json` — machine-readable output (same findings, JSON schema). For Jira / Linear / Slack / CI integrations.\n- `--severity-threshold <critical|high|medium|low|info>` — omit lower-severity findings from the report body.\n- `--exit-code-on <severity>` — non-zero exit if any finding at or above the threshold. Makes CI gating trivial: `run runtime audit --exit-code-on high` fails the pipeline on any new High or Critical.\n\nStatic auditors also support:\n\n- `--since <git-ref>` — diff mode. Filter findings to only those in code changed vs `<ref>`. Ideal for PR review: `audit this api --since main`.\n- `--audit-ignore <path>` — suppress findings by `group_key` match (default: `.audit-ignore` at repo root).\n\n`runtime-audit` also supports:\n\n- `--non-interactive` — fail fast in CI if the 3-way fork would be reached (prints the required flags).\n\n`api-recon` writes to `api-recon/` at the project root:\n\n- `architecture.json` — route graph, auth matrix, trust boundaries\n- `recon.md` — executive summary, threat model, verdict\n- `entry-points.md` — full route catalog with auth, params, downstream calls\n- `invariants.md` — tenant isolation, ownership, rate-limit, idempotency invariants\n- `architecture.svg` — rendered route/service dependency graph\n\n`runtime-audit` writes to `assets/findings/` + `assets/transcripts/`:\n\n- `{target-host}-runtime-audit-{ts}.md` — findings ranked `CONFIRMED` / `LIKELY` / `LEAD` with curl-equivalent reproductions\n- `assets/transcripts/{ts}/NNN-*.http` — full HTTP request/response transcripts per probe\n\n## Tips\n\n- **Scope tight.** Point the auditor at the 1–3 files you changed, not the whole\n  repo. Smaller scope = denser context per agent = higher-signal findings.\n- **Run twice.** LLM output is non-deterministic — a second pass often catches\n  things the first missed.\n- **Typical pipeline:** `api-recon` → static auditor → `runtime-audit` with `--from-report` to\n  verify the static findings live. This stacks breadth (static) with proof (dynamic).\n- **Never point `runtime-audit` at production without explicit authorization.** The skill\n  refuses non-local targets without `--tier staging`/`--tier prod` flags — respect that.\n\n## Evals\n\nEach skill ships benchmark ground-truth for public vulnerable apps:\n\n- Node (static): OWASP Juice Shop, OWASP NodeGoat, Damn Vulnerable NodeJS App\n- Python (static): OWASP VAmPI, django.nV, Damn Small Vulnerable Web\n- Runtime: Juice Shop + VAmPI (dockerized, runs live via `docker compose`)\n\nSee `{skill}/evals/runner.md` to reproduce.\n\n## License · Contributing\n\n[MIT](LICENSE). See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).\n",
  "bytes": 5467,
  "sha": "71b4240322fd89ca72a32018bb46a05d12f59f9184bfc3d90f67ef9079589e07",
  "repo_slug": "souzavinny/backend-security-skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_souzavinny_backend_security_skills_backe_37559264/readme"
}