API Fuzzing (Bug Bounty)
Fuzzes REST and GraphQL APIs to find IDOR and other bug-bounty-worthy flaws.
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 12, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 0660dc5
An authorized-pentest / bug-bounty API methodology guide (recon, auth testing, IDOR/BOLA, injection, GraphQL) — tested defensively against a local throwaway API with a deliberately planted IDOR, localhost-only, no external targets. Verbatim clone+copy install worked first try; the skill is a single self-contained SKILL.md checklist (curl-driven manual technique, not an automated scanner) with accurate tool references and no automation overclaims, though it ships no legal/scope disclaimer for a dual-use offensive guide. In A/B both arms caught the planted IDOR (Alice's token reading Bob's order, leaking card_last4) bidirectionally with identical negative-control discipline and the same 403/404 ownership-check fix; the skill added a recon sweep and explicit checklist framing but produced no materially better catch than the base's direct audit.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 3/5
- Output vs. baseline 5/10
- Docs & honesty 4/5
What API Fuzzing (Bug Bounty) does
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
How to install API Fuzzing (Bug Bounty)
git clone https://github.com/zebbern/claude-code-guide
cd claude-code-guide
mkdir -p ~/.claude/skills
cp -r skills/api-fuzzing-bug-bounty ~/.claude/skills/api-fuzzing-bug-bounty
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger API Fuzzing (Bug Bounty)
-
/api-fuzzing-bug-bountyFuzzes REST and GraphQL APIs to find IDOR and other bug-bounty-worthy flaws.
It also activates on plain-language prompts like these:
-
Fuzz this REST API for IDOR vulnerabilities -
Test this GraphQL endpoint for security flaws -
Run an API penetration test for bug bounty
Frequently asked questions
- Is the API Fuzzing (Bug Bounty) skill free?
- Yes. The skill itself is free from zebbern/claude-code-guide. SkillProof publishes the install command and an independent test verdict at no cost.
- Does API Fuzzing (Bug Bounty) work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 12, 2026. Verdict: Works with setup. An authorized-pentest / bug-bounty API methodology guide (recon, auth testing, IDOR/BOLA, injection, GraphQL) — tested defensively against a local throwaway API with a deliberately planted IDOR, localhost-only, no external targets. Verbatim clone+copy install worked first try; the skill is a single self-contained SKILL.md checklist (curl-driven manual technique, not an automated scanner) with accurate tool references and no automation overclaims, though it ships no legal/scope disclaimer for a dual-use offensive guide. In A/B both arms caught the planted IDOR (Alice's token reading Bob's order, leaking card_last4) bidirectionally with identical negative-control discipline and the same 403/404 ownership-check fix; the skill added a recon sweep and explicit checklist framing but produced no materially better catch than the base's direct audit.
- What is the API Fuzzing (Bug Bounty) SkillProof Score?
- 6.8/10 — installs cleanly 5/5, triggers reliably 3/5, output vs. baseline 5/10, docs & honesty 4/5.
- How do I install API Fuzzing (Bug Bounty)?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use API Fuzzing (Bug Bounty) with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.