apisec plugin
OWASP API Security Top 10 skills: BOLA detection, auth and RBAC scaffolding, injection checks, security tests, API security review, OpenAPI hardening.
How to install the apisec plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add apisec-inc/apisec-skills
/plugin install apisec@apisec-skillsWhat's inside apisec
19 parts read from the plugin's own files.
Agents 13
Call as @agent-apisec:name- @agent-apisec:claude-code:rules:admin-rbac
No description in the file.
- @agent-apisec:claude-code:rules:auth-required
No description in the file.
- @agent-apisec:claude-code:rules:error-sanitization
No description in the file.
- @agent-apisec:claude-code:rules:input-validation
No description in the file.
- @agent-apisec:claude-code:rules:ownership-check
No description in the file.
- @agent-apisec:codex:AGENTS
No description in the file.
- @agent-apisec:copilot:copilot-instructions
No description in the file.
- @agent-apisec:gemini:GEMINI
No description in the file.
- @agent-apisec:windsurf:rules:admin-rbac
Requires explicit role assertion before executing admin-scoped operations. Prevents privilege escalation and BFLA vulnerabilities.
- @agent-apisec:windsurf:rules:auth-required
Enforces authentication middleware on all API route handlers. Applies to Express, FastAPI, Django, Spring, Go Gin.
- @agent-apisec:windsurf:rules:error-sanitization
Prevents leaking internal error details, stack traces, or database error messages in API responses.
- @agent-apisec:windsurf:rules:input-validation
Requires validation of all user-supplied input before use. Prevents injection, unexpected types, and missing required fields.
- @agent-apisec:windsurf:rules:ownership-check
Requires ownership validation on any endpoint that accesses database records by user-supplied ID. Prevents BOLA/IDOR vulnerabilities.
Skills 6
Claude loads it when the task matches- api-security-review
Performs a structured security assessment of API code against the OWASP API Security Top 10 2023 standards.
- auth-rbac-scaffold
Generates secure authentication patterns and role-based access control systems while detecting OWASP API security vulnerabilities.
- bola-detector
Detects Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in API endpoints.
- injection-checker
Detects, classifies, and provides fixes for various injection vulnerabilities including SQL, NoSQL, command, and template injection.
- openapi-hardener
Secures API contracts by tightening OpenAPI, JSON Schema, Zod, Joi, and Pydantic definitions to prevent mass assignment and data exposure.
- security-test-generator
Generates adversarial, security-focused test cases for API endpoints to detect vulnerabilities like auth bypass, injection, and privilege escalation.
Using apisec in Claude Code
Ask for an agent by name:
@agent-apisec:claude-code:rules:admin-rbac
@agent-apisec:claude-code:rules:auth-requiredSkills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update apisec@apisec-skills
- Refresh the marketplace
- /plugin marketplace update apisec-skills
- Turn it off for now
- /plugin disable apisec@apisec-skills
- Remove it
- /plugin uninstall apisec@apisec-skills
Skills in apisec
- api-security-reviewapisec-inc/apisec-skills
Performs a structured security assessment of API code against the OWASP API Security Top 10 2023 standards.
21stars - auth-rbac-scaffoldapisec-inc/apisec-skills
Generates secure authentication patterns and role-based access control systems while detecting OWASP API security vulnerabilities.
21stars - bola-detectorapisec-inc/apisec-skills
Detects Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in API endpoints.
21stars - injection-checkerapisec-inc/apisec-skills
Detects, classifies, and provides fixes for various injection vulnerabilities including SQL, NoSQL, command, and template injection.
21stars - openapi-hardenerapisec-inc/apisec-skills
Secures API contracts by tightening OpenAPI, JSON Schema, Zod, Joi, and Pydantic definitions to prevent mass assignment and data exposure.
21stars - security-test-generatorapisec-inc/apisec-skills
Generates adversarial, security-focused test cases for API endpoints to detect vulnerabilities like auth bypass, injection, and privilege escalation.
21stars
apisec plugin questions
How do I install the apisec plugin?
In Claude Code run /plugin marketplace add apisec-inc/apisec-skills, then /plugin install apisec@apisec-skills.
What does the apisec plugin include?
apisec bundles 13 agents, 6 skills.
Which agents come with apisec?
claude-code/rules/admin-rbac, claude-code/rules/auth-required, claude-code/rules/error-sanitization, claude-code/rules/input-validation, claude-code/rules/ownership-check, codex/AGENTS +7. Call one with @agent-apisec:claude-code:rules:admin-rbac.
How do I update or remove the apisec plugin?
Update it with claude plugin update apisec@apisec-skills in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall apisec@apisec-skills.
What license is the apisec plugin under?
MIT, as stated in the plugin's manifest.