# API Security > Skills for testing API security including GraphQL and REST API vulnerabilities. Use when this capability is needed. - Skill: `tomevault-io/api-security-2` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/api-security-2` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/api-security-2/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/api-security-2 --- # API Security Testing REST and GraphQL API endpoints for vulnerabilities. ## Skills - [GraphQL Attacks](references/graphql-attacks.md) - GraphQL-specific vulnerabilities - [API Testing](references/api-testing.md) - REST API security testing ## Quick Reference | API Type | Common Issues | Tools | |----------|---------------|-------| | REST | IDOR, Auth, Mass Assignment | Burp, Postman | | GraphQL | Introspection, DoS, Auth | InQL, graphql-cop | --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.