What types of sensitive data can it detect?

The skill includes patterns for identifying emails, SSNs, credit card numbers, password hashes, API keys, JWT tokens, internal IP addresses, and stack traces.

What is excessive data exposure in an API?

It is a vulnerability where an API returns more data fields than the client application needs, relying on the frontend to filter out sensitive information. Attackers can intercept these responses to find hidden PII or internal data.

How does this skill help with OWASP compliance?

This skill specifically addresses OWASP API3:2023 - Broken Object Property Level Authorization by providing automated scripts to detect when sensitive object properties are exposed to unauthorized users.

Does this skill work with GraphQL APIs?

Yes, it includes specialized workflows for GraphQL, including introspection to discover sensitive fields and testing for over-fetching vulnerabilities.

API Excessive Data Exposure Tester

Name: API Excessive Data Exposure Tester
Author: mukul975

bymukul975

•

4,121

•

Seguridad y Pruebas

Detects and tests for unintended data leakage in API responses where endpoints return more sensitive information than required by the client.

This skill automates the identification of OWASP API3:2023 (Broken Object Property Level Authorization) vulnerabilities by analyzing API responses for PII, internal identifiers, and debug information. It compares actual API output against documentation and frontend requirements to find fields that should be filtered server-side rather than client-side. It is particularly effective for testing REST and GraphQL architectures where mobile or web clients rely on insecure client-side filtering, helping security researchers and developers prevent data breaches and sensitive information disclosure.

Características Principales

014,121 GitHub stars

02Internal infrastructure and debug information leak discovery

03Cross-endpoint data leakage analysis for nested user objects

04Automated sensitive data pattern scanning for PII, tokens, and hashes

05GraphQL introspection and over-fetching vulnerability detection

06Schema comparison between API responses and frontend UI requirements

Casos de Uso

01Auditing mobile application backends for unintended PII leakage in shared endpoints

02Scanning API error responses for stack traces, internal IPs, and system details

03Validating GraphQL field-level authorization to prevent over-fetching of sensitive attributes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills exploiting-excessive-data-exposure-in-api

For use in Claude.ai and ChatGPT

Características Principales

014,121 GitHub stars

02Internal infrastructure and debug information leak discovery

03Cross-endpoint data leakage analysis for nested user objects

04Automated sensitive data pattern scanning for PII, tokens, and hashes

05GraphQL introspection and over-fetching vulnerability detection

06Schema comparison between API responses and frontend UI requirements

Casos de Uso

01Auditing mobile application backends for unintended PII leakage in shared endpoints

02Scanning API error responses for stack traces, internal IPs, and system details

03Validating GraphQL field-level authorization to prevent over-fetching of sensitive attributes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills exploiting-excessive-data-exposure-in-api

For use in Claude.ai and ChatGPT