How do I install the API Grpc skill?

Run npx skillmds@latest add noorqureshi/api-grpc in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Grpc safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Grpc?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Grpc free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Grpc?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Grpc by noorqureshi — Agent Skill

Name: API Grpc
Author: NoorQureshi

API Grpc

Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, ports like 50051), grpc-web, or "protobuf". Signals: grpc, protobuf, reflection service, ServerReflection.

NoorQureshi 69afa2f 2.1 KB Updated Sep 17, 2026

File contents

gRPC / Protobuf API attacks

When it applies

The target exposes gRPC (or grpc-web). Binary framing over HTTP/2 makes it feel opaque, but the same authz/injection bugs apply — and server reflection often hands you the whole API.

Why it works

gRPC methods are RPCs with typed messages; security still lives per-method. Reflection (if on) exposes every service/method, and teams frequently skip auth on internal-looking RPCs or trust the client-generated stubs to enforce access.

Method

Enumerate via reflection: grpcurl -plaintext host:50051 list then list <service> and describe <method>; grpcui for an interactive UI. No reflection? Recover .proto from the client/mobile app or JS (grpc-web).
Call methods directly: grpcurl -d '{"id":123}' host:port pkg.Service/Method — test BOLA/BFLA by calling privileged methods or swapping object ids with a low-priv token.
Auth testing: replay with/without metadata (the gRPC equivalent of headers/tokens); many servers authenticate the connection but not each method.
Injection: message fields feed backends — test SQLi/NoSQLi/command injection in string fields.
grpc-web: it rides HTTP/1.1+base64 — proxy through Burp, decode frames, tamper.

Gotchas

Reflection off ≠ safe — extract the schema from clients; then grpcurl with a local .proto.
Binary framing hides bugs from scanners; manual method-by-method testing is the win.
HTTP/2 + TLS: use -plaintext only when the service is plaintext; otherwise pass certs.

Verify success

Call a method your role shouldn't reach, read/modify another object, or land an injection — proving per-method authz or input handling is broken.

References

grpcurl/grpcui docs; OWASP API Security (2023); "hacking gRPC" write-ups.

---name: api-grpcdescription: Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, ports like 50051), grpc-web, or "protobuf". Signals: grpc, protobuf, reflection service, ServerReflection.---# gRPC / Protobuf API attacks## When it appliesThe target exposes gRPC (or grpc-web). Binary framing over HTTP/2 makes it feel opaque, but thesame authz/injection bugs apply — and server reflection often hands you the whole API.## Why it worksgRPC methods are RPCs with typed messages; security still lives per-method. Reflection (if on)exposes every service/method, and teams frequently skip auth on internal-looking RPCs or trustthe client-generated stubs to enforce access.## Method1. **Enumerate via reflection**: `grpcurl -plaintext host:50051 list` then `list <service>` and `describe <method>`; `grpcui` for an interactive UI. No reflection? Recover `.proto` from the client/mobile app or JS (grpc-web).2. **Call methods directly**: `grpcurl -d '{"id":123}' host:port pkg.Service/Method` — test BOLA/BFLA by calling privileged methods or swapping object ids with a low-priv token.3. **Auth testing**: replay with/without metadata (the gRPC equivalent of headers/tokens); many servers authenticate the connection but not each method.4. **Injection**: message fields feed backends — test SQLi/NoSQLi/command injection in string fields.5. **grpc-web**: it rides HTTP/1.1+base64 — proxy through Burp, decode frames, tamper.## Gotchas- Reflection off ≠ safe — extract the schema from clients; then `grpcurl` with a local `.proto`.- Binary framing hides bugs from scanners; manual method-by-method testing is the win.- HTTP/2 + TLS: use `-plaintext` only when the service is plaintext; otherwise pass certs.## Verify successCall a method your role shouldn't reach, read/modify another object, or land an injection —proving per-method authz or input handling is broken.## Referencesgrpcurl/grpcui docs; OWASP API Security (2023); "hacking gRPC" write-ups.

Frequently asked questions