API Security Best Practices Skill (sickn33) for Claude Code: What It Does and How to Install It

Makes the agent review and write API code with exact token checks, per-object authorization and validated input.

Installs: 8.9K; on skills.sh
Stars: 49K; on GitHub
Updated: Nov 2026; last repo commit

The agent walks the request boundary from caller identity to the response, in five sections: authenticate the exact token contract, authorize the resource and operation, parse once and then use the validated value, control abuse without claiming DDoS protection, and handle passwords, secrets and logging. It ends with a worked example, a PATCH /users/:id profile update checked in 5 steps, and a limitations section.

The examples are sketches for Express, jsonwebtoken, Zod and a Prisma-style data layer, not a full service. The skill says to use synthetic identities in a test environment, and that production scans, account writes and message sends need their own authority. It tells the agent to keep your identity provider and data model rather than add a second auth system.

Good for

Developers adding a protected endpoint or reviewing object access
Teams replacing permissive request parsing in a Node API
Anyone investigating an API abuse path from a failing route

Install api-security-best-practices

Claude Code

Copy this prompt.

Install the api-security-best-practices skill in Claude Code. Run this command:

/plugin marketplace add sickn33/agentic-awesome-skills
/plugin install agentic-bundle-aas-secure-app-builder@agentic-awesome-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Claude Code.

The plugin route installs the AAS Secure App Builder bundle, which holds 12 skills (counted from the repo tree) including this one. The skills CLI and folder routes install only this skill. The root plugin, agentic-awesome-skills, also contains it among 2,753 skills, which is far more than most people want.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Sections in SKILL.md

When to Use
Inputs and prerequisites
1. Authenticate the exact token contract
Refresh sessions
2. Authorize the resource and operation
3. Parse once, then use the validated value
4. Control abuse without claiming DDoS protection
5. Passwords, secrets and logging
Worked example: a profile update boundary
Limitations
References

Key facts

Author: sickn33 and contributors (marketplace manifest author)
License: MIT for code (LICENSE); CC BY 4.0 for non-code content (LICENSE-CONTENT)
Installs on skills.sh: 8,888 (Nov 2, 2026)
GitHub stars: 48,978 for the whole repo (Nov 2, 2026)
Last repo commit: Nov 1, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes: 1 file: SKILL.md (no scripts)
SKILL.md metadata: risk: critical, source: community, date_added 2026-02-27
Part of: The Secure App Builder plugin (12 skills) and the full catalog plugin

What it includes

Fixed algorithm, issuer and audience, required claims, refresh sessions
Includes refresh sessions: store a digest, rotate atomically, revoke the family on reuse.
Read · 1. Authenticate the exact token contract
Owner and tenant predicate inside the database mutation
Read · 2. Authorize the resource and operation
Strict parsing for IDs and bodies, parameterized queries, allowlisted fields
Try: “Review this PATCH route for unvalidated input”
Read · 3. Parse once, then use the validated value
Shared-store rate limits, IPv6-aware keys, trust proxy set to real hops
Read · 4. Control abuse
Argon2id for new designs, no raw tokens in logs, sanitized errors
Read · 5. Passwords, secrets and logging
PATCH /users/:id checked in 5 steps, with expected 401, 400 and denial results
Read · Worked example
Not a security audit; report untested routes and failure modes
Read · Limitations

From the official docs

Permissions

Medium risk

The agent edits code that decides who can reach your API, and the examples are sketches. Review each change and test with fake identities before production.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It rewrites the code that guards your API
The skill covers token verification, refresh sessions, owner and tenant checks and password handling. Review each change and run your own tests, because the examples are sketches. github.com
The plugin route installs 12 skills
The Secure App Builder bundle holds 12 skills by the repo tree. Its plugin folder holds only manifests and the skills folder. The skills CLI route installs only this skill. github.com
Test with fake identities, not production
SKILL.md says to use synthetic identities in a test environment and that production scans, account writes and message sends need their own authority. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only switch exists.
Sign-in and keys	SKILL.md names no key. It tells the agent never to log raw tokens or passwords.
Scopes	Edits authentication, authorization, validation and rate-limit code in your project The bundle plugin route installs 12 skills in total

Questions

What does the api-security-best-practices skill do?

It makes the agent follow a checklist for API security when it writes or reviews endpoints. The checklist covers token checks, authorization per object and tenant, input validation, abuse limits, and secrets and logging.

How do I install it?

Use the install box at the top of this page. It lists a Claude Code plugin bundle that holds 12 skills, a skills CLI command for this skill only, and folder routes.

Is it a security audit?

No. The Limitations section says it is not a full identity service, certified security audit or penetration test, and tells the agent to report any untested route, tenant path or failure mode.

Does it only work for Node?

The code sketches use Express, jsonwebtoken, Zod and a Prisma-style layer. The checks are written in general terms, and SKILL.md says to confirm APIs against the installed versions before integrating.

Do I need an API key?

No key is named in SKILL.md. The skill folder bundles no scripts.

Is it safe?

It changes the code that decides who can call your API, so review every diff. SKILL.md says to test with synthetic identities in a test environment and that production scans or account writes need their own authority.

What does the "risk: critical" label mean?

It is a metadata field in the SKILL.md frontmatter. SKILL.md itself says not to infer a clean security posture from a risk metadata label.

Information

updated Nov 2, 2026

Repository: sickn33/agentic-awesome-skills
Folder: skills/api-security-best-practices

sickn33/agentic-awesome-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

agentic-awesome-skills README · github.com
agentic-awesome-skills Claude Code guide · github.com
agentic-awesome-skills marketplace.json · github.com
api-security-best-practices SKILL.md · github.com