api-recon-and-docs

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

3,756
installs: 0 up / 0 down, score 0.00
votes: 2,523
repo stars
Updated: 1 month ago
In the catalog since: 1 Oct 2026
From: yaklang/hack-skills

Get it through your agent npx skills add yaklang/hack-skills@api-recon-and-docs

Skill instructions

Rendered from the published SKILL.md, 55 lines.

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.

1. PRIMARY GOALS

Discover all reachable API entrypoints.
Extract schemas, optional fields, and role differences.
Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

2. RECON CHECKLIST

JavaScript and client mining

curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u

Common documentation and schema paths

/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql

Version and product drift

/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/

3. WHAT TO EXTRACT FROM DOCS

optional and undocumented fields
admin-only request examples
deprecated endpoints that may still be active
schema hints like additionalProperties: true
parameter names tied to filtering, sorting, IDs, roles, or tenancy

4. NEXT ROUTING

Finding	Next Skill
object IDs everywhere	api authorization and bola
JWT, OAuth, role claims	api auth and jwt abuse
GraphQL or hidden fields	graphql and hidden parameters
strong auth boundary but suspicious business flow	business logic vulnerabilities

Get it through your agent

Call the Graph-of-Skills MCP server's retrieve_skill_bundle tool and it returns this skill's text inside your budget.

{
  "tool": "retrieve_skill_bundle",
  "arguments": {
    "query": "api-recon-and-docs"
  }
}

New to this? Set up Graph-of-Skills or get a free key. The text on this page comes from its authors: how skills are sourced and what we check. If none fits your task, your agent can write a skill for your own library. To keep a skill from your own library on a machine, see how to install one of your skills.

Share on X Share on LinkedIn Share on Bluesky Share on Hacker News

Share on Reddit

Source

Source repository yaklang/hack-skills
Listing on skills.sh

From yaklang/hack-skills via skills.sh

Related skills

recon-and-methodology
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.
3,970 installs
api-sec
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
3,895 installs
golang-documentation
Comprehensive documentation guide for Golang projects, covering godoc comments, README, CONTRIBUTING, CHANGELOG, Go Playground, Example tests, API docs, and llms.txt. Use when writing or reviewing doc comments, documentation, adding code examples, setting up doc sites, or discussing documentation best practices. Triggers for both libraries and applications/CLIs.
40,064 installs
find-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service — even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer — do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.
9,260 installs
docs-guard
Review generated or changed documentation before it ships — READMEs, API references, docstrings, PHPDoc/JSDoc, changelogs, tutorials, and doc sites. Best used reactively after an agent writes or edits docs, after code changes documented behavior, or before publishing docs. Use when the user says 'review the docs', 'is this documentation accurate', 'update the docs', 'write a README', 'document this API', 'add a docstring', or 'add a changelog entry'. Core job: verify every referenced function, flag, endpoint, config key, and code sample against the source; catch docs-vs-code drift; strip filler and unverifiable claims. DO NOT USE for production code review (use clean-code-guard), test review (use test-guard), marketing copy or blog posts, prose style editing of non-technical writing, or documentation site theming.
3,931 installs

More from yaklang/hack-skills

hack
Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the current asset cluster before expanding, follow half-chains to real control, and require live verification of secrets.
4,296 installs
android-pentesting-tricks
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
4,020 installs
sqli-sql-injection
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
3,983 installs
code-obfuscation-deobfuscation
Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.
3,980 installs
recon-and-methodology
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.
3,970 installs

Content is provided as published by its creators; you are responsible for how you use it.

To request removal, use the contact form.