APIsec Skills: API Security for AI Coding Agents

Put OWASP API Security Top 10 intelligence inside your coding agent. Every endpoint the agent generates is secure by default, with nothing to configure, no API keys, and nothing leaving your machine.

What It Does

Ask your coding agent to "add an endpoint to fetch orders by id". Without security context it returns the most direct answer, which usually means no authentication check, no ownership filter, and no input validation.

APIsec Skills embed security rules and skills into the agent's context. The same prompt produces hardened output, silently and automatically, every time.

Without APIsec Skills:

app.get('/api/orders/:id', async (req, res) => {
  const order = await Order.findById(req.params.id); // any user, any order
  res.json(order);
});

With APIsec Skills:

app.get('/api/orders/:id', authenticate, async (req, res) => {
  const order = await Order.findOne({
    _id: req.params.id,
    userId: req.user.id,   // ownership enforced
  });
  if (!order) return res.status(404).json({ error: 'Not found' });
  res.json(serializeOrder(order));  // filtered response
});

Same eight words typed. Completely different output.

What's Included

5 Security Rules (always active)

Rules sit in the agent's system context from the start of the session and shape every code generation. No commands are needed. The rule sources live in rules/, and ready-to-copy versions in each agent's native format live under agents/ (see Installation).

6 Security Skills (on-demand)

Skills load automatically when the agent detects a relevant task. Each produces a structured security report with OWASP references and actionable fixes.

Installation

The skills use the open Agent Skills format, so the same SKILL.md files work in every major coding agent. The always-on rules are agent-specific files, and this repository ships a ready-made set for each agent.

Clone once:

git clone https://github.com/apisec-inc/apisec-skills
cd apisec-skills

Claude Code

Install as a plugin (skills only, one command, updates from this repository):

/plugin marketplace add apisec-inc/apisec-skills
/plugin install apisec@apisec-skills

Or copy the skills by hand:

cp -r skills/* ~/.claude/skills/          # personal, every project
# or: cp -r skills/* .claude/skills/       # this project only

Add the always-on rules to your project:

mkdir -p .claude/rules && cp agents/claude-code/rules/*.md .claude/rules/

Cursor

cp -r skills .cursor/skills/
cp -r rules  .cursor/rules/

A .cursor-plugin/plugin.json manifest is included for the Cursor plugin format.

GitHub Copilot

cp -r skills .github/skills/               # also read from .agents/skills/
cp agents/copilot/copilot-instructions.md .github/copilot-instructions.md

OpenAI Codex CLI

cp -r skills .agents/skills/
cp agents/codex/AGENTS.md AGENTS.md         # or append to an existing AGENTS.md

Gemini CLI

cp -r skills .agents/skills/                # or ~/.gemini/skills/
cp agents/gemini/GEMINI.md GEMINI.md        # or append to an existing GEMINI.md

Windsurf

cp -r skills .agents/skills/
mkdir -p .windsurf/rules && cp agents/windsurf/rules/*.md .windsurf/rules/

Replit, Kiro, Roo Code, and others

cp -r skills .agents/skills/

For the rules, use whichever project instruction file your agent reads (AGENTS.md is the most common) and paste in agents/codex/AGENTS.md.

One repository, every major coding agent. The skills need no modification between tools, and the rules are generated from one set of sources by scripts/build-agent-rules.py, so every agent gets identical guidance.

How It Works

Rules are loaded into the agent's system context at session start. They shape every piece of code the agent generates, so the developer never needs to ask for secure output, and APIsec is never mentioned in this path.

Skills (SKILL.md files) are indexed by the agent at startup, with only the short description in context. When a developer's task matches a skill's description, the full skill loads automatically. This path produces APIsec security reports with OWASP references, severity ratings, and exact fix suggestions.

Developer types prompt
        |
        +-> Rules in system prompt      -> agent generates secure code (silent)
        |
        +-> Skill description matches   -> APIsec security report

Example Output

When the api-security-review skill fires on a controller file:

## APIsec Security Review

File reviewed: src/routes/orders.js
Reviewed against: OWASP API Security Top 10 2023
Security Score: D

### Critical Findings

#### [API1:2023] Broken Object Level Authorization, line 47
Pattern: Order.findById(req.params.id) without ownership filter
Risk: Any authenticated user can read, modify, or delete any order by changing the ID
Fix:
  const order = await Order.findOne({ _id: req.params.id, userId: req.user.id });

### Quick Wins: Top 3 Changes for Maximum Security Impact
1. [Critical] Add ownership filter to all findById calls (prevents BOLA)
2. [High] Add algorithm whitelist to JWT verification (prevents algorithm confusion)
3. [Medium] Cap pagination limit to 100 (prevents resource exhaustion)

Powered by APIsec · apisec.ai

OWASP API Top 10 2023 Coverage

Repository Layout

skills/                      six Agent Skills (SKILL.md each), portable to every agent
rules/                       five rule sources (.mdc), generated into every agent's format
agents/
  claude-code/rules/         generated: Claude Code .claude/rules/ files
  windsurf/rules/            generated: Windsurf .windsurf/rules/ files
  copilot/                   generated: .github/copilot-instructions.md
  codex/                     generated: AGENTS.md
  gemini/                    generated: GEMINI.md
scripts/build-agent-rules.py regenerates agents/ from rules/
.claude-plugin/              Claude Code plugin and marketplace manifests
.cursor-plugin/              Cursor plugin manifest

To change a rule, edit the .mdc file in rules/ and run python3 scripts/build-agent-rules.py.

License

MIT. Free to use, modify, and distribute.