API Security Testing
When Invoked
The user runs /vapt api <url> or this skill is triggered as part of Wave 3 during /vapt audit.
Prerequisites
Check for existing context:
- If
VAPT-WAVE2-CONTEXT.mdexists -> use discovered API endpoints - If
VAPT-SCAN.mdexists -> extract API paths from scan results - If no context -> discover API endpoints via common paths
Phase 1: API Discovery
1.1 OpenAPI / Swagger Detection
# Common OpenAPI spec locations
for path in /sw
[Description truncada. Veja o README completo no GitHub.]