{"id":22205,"plugin_id":"plugins_6ab01c9056c481918eac972df8fb396d","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:17:11.260Z","digest":"7c3fee049fa7fd007540ee5e1bbee406b633532d0996686b1c73255815efd16f","against":null,"payload":{"description":"Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths.","included_files":[],"name":"api-abuse-and-misuse","skill_md_contents":"---\nname: api-abuse-and-misuse\ndescription: Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths.\n---\n\n# API Abuse and Misuse\n\nTrace every sensitive endpoint from request to authorization, query, mutation, and response. Check BOLA/IDOR, mass assignment, over-broad selects, enumeration, pagination abuse, replay, missing idempotency, rate limits, quota bypass, unsafe webhooks, CORS, error leakage, and privilege escalation. Ensure controls are enforced server-side and test negative cases for another user, tenant, role, and unauthenticated caller.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}