← All skills
offensive-api-abuse
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By SnailSploit/Claude-Red (GitHub) · coding · 10,590 stars · scanned at commit a8de813
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through…
Works with any agent that supports SKILL.md skills.
What this skill can do
Connects to the internet
This is disclosed by the author in the skill's SKILL.md or README.
Found in 35 places.
Show 17 more
- Skills/api/offensive-api-abuse/SKILL.md, line 53
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 58
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 61
curl -s -X DELETE -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 64
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 72
curl -s -X PATCH -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 77
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 82
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 96
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 101
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 127
resp = requests.post(TARGET, json=payload, headers={"Content-Type": "application/json"}) - Skills/api/offensive-api-abuse/SKILL.md, line 143
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 149
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 163
curl -s -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 167
curl -s -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 170
curl -s -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 180
curl -s -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 184
curl -s -H "Authorization: Bearer $TOKEN" \
and 15 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 19 places.
Show 16 more
- Skills/api/offensive-api-abuse/SKILL.md, line 96
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 143
curl -s -X POST -H "Content-Type: application/json" \ - Skills/api/offensive-api-abuse/SKILL.md, line 163
curl -s -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 176
echo "eyJpZCI6MTAwMX0=" | base64 -d # Decode cursor: {"id":1001} - Skills/api/offensive-api-abuse/SKILL.md, line 198
curl -s -X POST -H "Authorization: Bearer $TOKEN" \ - Skills/api/offensive-api-abuse/SKILL.md, line 213
internal_targets=( - Skills/api/offensive-api-abuse/SKILL.md, line 276
seq 1 20 | parallel -j 20 'curl -s -o /dev/null -w "Request {}: %{http_code}\n" \ - Skills/api/offensive-api-abuse/SKILL.md, line 291
jwt_tool "$JWT_TOKEN" - Skills/api/offensive-api-abuse/SKILL.md, line 309
jwt_tool "$JWT_TOKEN" -I -hc kid -hv "../../dev/null" -S hs256 -p "" - Skills/api/offensive-api-abuse/SKILL.md, line 316
openssl genrsa -out attacker_key.pem 2048 - Skills/api/offensive-api-abuse/SKILL.md, line 339
jwt_tool "$JWT_TOKEN" -I -pc role -pv admin -S hs256 -p "$KNOWN_SECRET" - Skills/api/offensive-api-abuse/SKILL.md, line 354
gh api search/code -q '.items[] | {repo: .repository.full_name, path: .path}' \ - Skills/api/offensive-api-abuse/SKILL.md, line 363
curl -s "https://target.example.com/" | \ - Skills/api/offensive-api-abuse/SKILL.md, line 384
arjun -u "https://target.example.com/api/v1/users" -m GET \ - Skills/api/offensive-api-abuse/SKILL.md, line 395
wordlist=( - Skills/api/offensive-api-abuse/SKILL.md, line 424
for len in 10 20 30 40 50; do
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'offensive-api-abuse' ] || [ -L ~/.agents/skills/'offensive-api-abuse' ]; then echo 'A skill folder named offensive-api-abuse already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SnailSploit/Claude-Red' "$d" && git -C "$d" checkout --quiet 'a8de813edc9f66f60d44cfe42d47750e89d9930b' -- 'Skills/api/offensive-api-abuse' && mkdir -p ~/.agents/skills && cp -R "$d"/'Skills/api/offensive-api-abuse' ~/.agents/skills/'offensive-api-abuse' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'offensive-api-abuse' ~/.claude/skills/'offensive-api-abuse' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for SnailSploit/Claude-Red shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/SnailSploit/Claude-Red/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | a8de813 | 92 |
| 2026-11-07 | a8de813 | 82 |