cyberaudit-skill 3.0.6 → 3.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberaudit-skill",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "Universal security audit skill for AI agents. Install once, audit any web or mobile app. OpenCode, Claude Code, Cursor, Kiro, Gemini — all supported.",
   "keywords": [
     "mcp",

package/skills/cyberaudit/COMMANDS.md

@@ -56,6 +56,21 @@ When user types `/cyberaudit` or `/audit` — **list all commands below**.
 | `/audit:ionic` | Ionic audit |
 | `/audit:expo` | Expo audit |
 
+## API
+
+| Command | Action |
+|---|---|
+| `/audit:api` | Full API audit (OWASP API Top 10) |
+| `/audit:auth-api` | API authentication & authorization |
+| `/audit:api:rest` | REST API audit |
+| `/audit:api:graphql` | GraphQL API audit |
+| `/audit:api:ws` | WebSocket API audit |
+| `/audit:api:bola` | BOLA/IDOR audit |
+| `/audit:api:bopla` | BOPLA (BFLA) audit |
+| `/audit:api:rate-limit` | Rate limiting audit |
+| `/audit:api:inventory` | API inventory/discovery |
+| `/audit:api:third-party` | Third-party API audit |
+
 ## Compliance
 
 | Command | Action |
@@ -68,4 +83,4 @@ When user types `/cyberaudit` or `/audit` — **list all commands below**.
 
 ## Execution
 
-For any `/audit:xxx` command, load the corresponding files from `web/`, `mobile/`, or `reports/`, then execute the audit methodology from `SKILL.md`.
+For any `/audit:xxx` command, load the corresponding files from `web/`, `mobile/`, `api/`, or `reports/`, then execute the audit methodology from `SKILL.md`.

package/skills/cyberaudit/SKILL.md

@@ -70,6 +70,20 @@ Security audit intelligence for AI agents. Universal, framework-agnostic, method
 | `/audit:ionic` | Ionic audit |
 | `/audit:expo` | Expo audit |
 
+### API
+| Command | Action |
+|---|---|
+| `/audit:api` | Full API audit (OWASP API Top 10) |
+| `/audit:auth-api` | API authentication & authorization |
+| `/audit:api:rest` | REST API audit |
+| `/audit:api:graphql` | GraphQL API audit |
+| `/audit:api:ws` | WebSocket API audit |
+| `/audit:api:bola` | BOLA/IDOR audit |
+| `/audit:api:bopla` | BOPLA (BFLA) audit |
+| `/audit:api:rate-limit` | Rate limiting audit |
+| `/audit:api:inventory` | API inventory/discovery |
+| `/audit:api:third-party` | Third-party API audit |
+
 ### Compliance
 | Command | Action |
 |---|---|
@@ -84,7 +98,7 @@ Security audit intelligence for AI agents. Universal, framework-agnostic, method
 Execute on every audit request:
 
 **STEP 1 — IDENTIFICATION** (30 sec)
-- TYPE → Web / Mobile / Both
+- TYPE → Web / Mobile / API / Both
 - FRAMEWORK → Identify precisely (React, Laravel, Flutter, etc.)
 - CONTEXT → Dev / Staging / Production
 - SCOPE → Entire code / Single module
@@ -93,6 +107,7 @@ Execute on every audit request:
 **STEP 2 — MODE LOADING**
 - Web → Load web checklist + framework-specific guide
 - Mobile → Load mobile checklist + framework-specific guide
+- API → Load API checklist + type-specific guide (REST/GraphQL/WebSocket)
 
 **STEP 3 — STRUCTURED AUDIT**
 Follow the loaded philosophy. Never skip a phase. Document each finding immediately.
@@ -178,6 +193,11 @@ Every report must include:
 - **Express**: CORS, helmet, input validation, error handling
 - **NestJS**: Guards, pipes, serialization, GraphQL security
 
+### API Types
+- **REST**: Resource IDOR/BOLA, mass assignment, parameter injection, deprecated endpoints
+- **GraphQL**: Introspection, depth/complexity, batching attacks, field-level auth
+- **WebSocket**: Authentication on connect, per-message auth, origin validation, rate limiting
+
 ### Mobile Frameworks
 - **React Native**: AsyncStorage, deep links, WebView XSS, JS bundle exposure
 - **Flutter**: Method channels, root detection, local storage, obfuscation
@@ -217,9 +237,24 @@ This skill lives at `~/.skills/cyberaudit/`. Additional sub-skills:
 ├── MASTER.md             (full vulnerability taxonomy + scoring)
 ├── USAGE-GUIDE.md        (user-facing documentation)
 ├── README.md             (project overview)
+├── api/
+│   ├── API-PHILOSOPHY.md
+│   ├── API-CHECKLIST.md
+│   ├── API-REMEDIATION-LIBRARY.md
+│   ├── types/
+│   │   ├── REST.md
+│   │   ├── GRAPHQL.md
+│   │   └── WEBSOCKET.md
+│   └── vulnerabilities/
+│       ├── BOLA.md
+│       ├── BOPLA.md
+│       ├── RATE-LIMITING.md
+│       ├── INVENTORY.md
+│       └── THIRD-PARTY-API.md
 ├── reports/
 │   ├── REPORT-TEMPLATE-WEB.md
 │   ├── REPORT-TEMPLATE-MOBILE.md
+│   ├── REPORT-TEMPLATE-API.md
 │   └── EXECUTIVE-SUMMARY-TEMPLATE.md
 ├── shared/
 │   ├── COMPLIANCE.md
@@ -254,7 +289,8 @@ This skill lives at `~/.skills/cyberaudit/`. Additional sub-skills:
 ```
 
 For detailed framework-specific checks, load the appropriate file from `web/frameworks/` or `mobile/frameworks/`.
-For vulnerability-specific deep dives, load from `web/vulnerabilities/` or `mobile/vulnerabilities/`.
+For vulnerability-specific deep dives, load from `web/vulnerabilities/`, `mobile/vulnerabilities/`, or `api/vulnerabilities/`.
+For API-specific audits, load from `api/` (philosophy, checklist, type guide, remediation library).
 
 ---
 

package/skills/cyberaudit/api/API-CHECKLIST.md

@@ -0,0 +1,102 @@
+# API SECURITY CHECKLIST — CyberAudit Skill
+
+## Phase 0 — Discovery
+
+- [ ] All endpoints documented and audited
+- [ ] Shadow/deprecated endpoints identified
+- [ ] Auth mechanism identified per endpoint
+- [ ] All HTTP methods tested on each endpoint
+- [ ] Parameter variations tested
+- [ ] Content-type variations tested
+
+## Phase 1 — Authentication
+
+- [ ] JWT signature verified (not just decoded)
+- [ ] JWT `alg` restricted (no "none" algorithm)
+- [ ] JWT expiration enforced server-side
+- [ ] JWT secret strong and rotated
+- [ ] OAuth redirect_uri validated
+- [ ] OAuth state parameter used
+- [ ] API keys not exposed in URLs
+- [ ] API keys revocable
+- [ ] API keys scoped to minimum permissions
+- [ ] No hardcoded credentials in code
+- [ ] Multi-factor authentication available
+- [ ] Password hashing: bcrypt/argon2
+
+## Phase 2 — Authorization
+
+- [ ] IDOR test on every object endpoint
+- [ ] BFLA test on every admin function
+- [ ] Role-based access control enforced
+- [ ] Mass assignment protected
+- [ ] UUIDs used instead of sequential IDs
+- [ ] Object ownership verified server-side
+- [ ] Vertical privilege escalation tested
+- [ ] Horizontal privilege escalation tested
+- [ ] Indirect object reference checked
+
+## Phase 3 — Input Validation
+
+- [ ] SQL injection: parameterized queries
+- [ ] NoSQL injection: sanitize operators
+- [ ] Command injection: avoid exec() with input
+- [ ] XML injection: disable external entities
+- [ ] SSRF: validate redirect URLs
+- [ ] Path traversal: restrict file access
+- [ ] Parameter pollution: last value wins?
+- [ ] Schema validation bypass: extra fields
+- [ ] Content-type confusion: application/json vs XML
+- [ ] GraphQL: depth limiting
+- [ ] GraphQL: query complexity limiting
+- [ ] GraphQL: disable introspection in production
+
+## Phase 4 — Rate Limiting
+
+- [ ] Rate limiting on ALL endpoints
+- [ ] Stricter limits on auth endpoints
+- [ ] Rate limiting by user/IP/token
+- [ ] Proper 429 response with Retry-After
+- [ ] Brute force protection on login
+- [ ] Enumeration prevention (consistent messages)
+- [ ] Pagination has max limit
+- [ ] Pagination cursor-based for sensitive data
+- [ ] Resource usage monitoring
+
+## Phase 5 — Data Exposure
+
+- [ ] Responses contain minimum data
+- [ ] No sensitive data in error messages
+- [ ] No stack traces in production
+- [ ] No debug endpoints exposed
+- [ ] Logging excludes sensitive fields
+- [ ] PII exposure audited per endpoint
+- [ ] Consistent response format (no info leak)
+- [ ] CORS whitelist restrictive
+- [ ] CORS credentials: true without wildcard origin
+- [ ] Security headers: CSP, HSTS, X-Frame, etc.
+
+## Phase 6 — WebSocket Security
+
+- [ ] WSS enforced (no unencrypted WS)
+- [ ] Authentication on connect
+- [ ] Authorization per message
+- [ ] Input validation per message
+- [ ] Rate limiting per connection
+- [ ] Message size limits
+- [ ] Origin validation
+- [ ] Connection timeout
+- [ ] Reconnection not automatic for sensitive actions
+
+## Phase 7 — Third-Party APIs
+
+- [ ] Outgoing HTTPS enforced
+- [ ] Certificate validation (no self-signed skip)
+- [ ] Timeout configured
+- [ ] Retry logic with backoff
+- [ ] Webhook signature verified
+- [ ] Third-party data treated as untrusted
+- [ ] Third-party credentials stored securely
+- [ ] Third-party API key rotation
+- [ ] Webhook payload validation
+- [ ] IP allowlisting where possible

package/skills/cyberaudit/api/API-PHILOSOPHY.md

@@ -0,0 +1,121 @@
+# API AUDIT PHILOSOPHY — CyberAudit Skill
+# The mindset of an API security expert
+
+## The API Mental DNA
+
+An API is not a website with less HTML.
+It is a bare attack surface, no interface,
+no friction, accessible by machines
+that can send thousands of requests per second.
+
+When you audit an API, think like
+an attacker who read the entire documentation
+AND is looking for what the documentation does not say.
+
+Modern APIs have three unique characteristics
+that make them particularly dangerous:
+
+  1. THEY TRUST BY DESIGN
+     An API is built to be consumed.
+     Its nature is to accept requests.
+     The challenge: distinguish legitimate requests
+     from malicious ones.
+
+  2. THEY EXPOSE BUSINESS LOGIC DIRECTLY
+     No UI to hide functionality.
+     Every endpoint is an exposed business function.
+     An attacker reading your docs sees your architecture.
+
+  3. THEY ARE DESIGNED FOR AUTOMATION
+     What is a feature for developers
+     is a weapon for attackers.
+     A script can test 10,000 IDs in 10 seconds.
+
+## The 8 Truths of API Security
+
+TRUTH 1 — THE OBJECT IS THE ATTACK UNIT
+  On the web, you attack pages.
+  On an API, you attack objects.
+  GET /users/1 → GET /users/2 → GET /users/3...
+  IDOR is the #1 vulnerability in APIs.
+  Every endpoint with an ID is an attack vector.
+
+TRUTH 2 — AUTHENTICATION ≠ AUTHORIZATION
+  An API can perfectly authenticate a user
+  and still give them access to everyone else's data.
+  Valid token ≠ authorized access to this resource.
+
+TRUTH 3 — EVERYTHING IS AN INPUT
+  Headers, query params, body, cookies, files.
+  An API trusts what it receives.
+  Validation must happen at every boundary.
+
+TRUTH 4 — RATE LIMITING IS SECURITY
+  Without rate limiting, an API is defenseless.
+  Brute force, enumeration, DDoS — all prevented
+  by a simple rate limit.
+
+TRUTH 5 — THE DOCUMENTATION IS AN ATTACK PLAN
+  Your OpenAPI spec tells attackers exactly
+  where to look. Every endpoint described
+  is an endpoint tested.
+
+TRUTH 6 — INTERNAL APIS ARE NOT SAFE
+  "Internal only" means no WAF, no rate limiting,
+  no auth, no monitoring. Internal APIs are
+  the most vulnerable.
+
+TRUTH 7 — LEGACY ENDPOINTS ARE BACKDOORS
+  /v1/users, /api/old/orders, deprecated routes
+  that were forgotten. They still work.
+  They have weaker security.
+
+TRUTH 8 — THIRD-PARTY APIS ARE YOUR LIABILITY
+  The API you consume can be compromised.
+  The API you expose can be abused by partners.
+  Trust must be verified, not assumed.
+
+## The API Audit Flow
+
+PHASE 0 — DISCOVERY & MAPPING
+  □ List ALL endpoints (documented + undocumented)
+  □ Identify auth mechanisms per endpoint
+  □ Map data types and sensitivity
+  □ Find shadow APIs and deprecated endpoints
+  □ Test every HTTP method on every endpoint
+
+PHASE 1 — AUTHENTICATION
+  □ Token handling (JWT, OAuth, API keys)
+  □ Token validation on every endpoint
+  □ Token expiration and rotation
+  □ Weak authentication mechanisms
+
+PHASE 2 — AUTHORIZATION
+  □ IDOR/BOLA on every object access
+  □ BFLA on every admin function
+  □ Mass assignment protection
+  □ Role-based access control verification
+
+PHASE 3 — INPUT VALIDATION
+  □ Injection testing on all inputs
+  □ Parameter pollution
+  □ Content-type validation
+  □ Schema validation bypass
+
+PHASE 4 — RATE LIMITING & ABUSE
+  □ Brute force protection
+  □ Enumeration prevention
+  □ Pagination abuse
+  □ Resource exhaustion
+
+PHASE 5 — DATA EXPOSURE
+  □ Over-fetching in responses
+  □ Sensitive data in error messages
+  □ Excessive data in list endpoints
+  □ Debug endpoints exposed
+
+PHASE 6 — CONFIGURATION
+  □ CORS misconfiguration
+  □ TLS/SSL verification
+  □ Security headers
+  □ Debug mode disabled

package/skills/cyberaudit/api/API-REMEDIATION-LIBRARY.md

@@ -0,0 +1,149 @@
+# API Remediation Library — CyberAudit Skill
+
+## Authentication Fixes
+
+### JWT Hardening
+```javascript
+// Secure JWT configuration
+const jwt = require('jsonwebtoken');
+const token = jwt.sign(
+  { userId: user.id, role: user.role },
+  process.env.JWT_SECRET,
+  { algorithm: 'HS256', expiresIn: '15m', issuer: 'myapp' }
+);
+```
+- Disable 'none' algorithm
+- Verify signature on every request
+- Use short expiration (15-30 min)
+- Implement refresh token rotation
+
+### API Key Management
+```javascript
+// Hash keys before storing
+const crypto = require('crypto');
+const hash = crypto.createHash('sha256').update(rawKey).digest('hex');
+db.apiKeys.create({ hash, userId, scopes: ['read:orders'] });
+```
+- Never store raw keys in database
+- Prefix keys for identification (sk_live_xxx)
+- Support key rotation without downtime
+- Scope keys to minimum permissions
+
+## Authorization Fixes
+
+### Ownership Check Middleware
+```javascript
+function verifyOwnership(model) {
+  return async (req, res, next) => {
+    const resource = await model.findById(req.params.id);
+    if (!resource) return res.status(404).json({ error: 'Not found' });
+    if (resource.userId !== req.user.id && req.user.role !== 'admin') {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    req.resource = resource;
+    next();
+  };
+}
+```
+
+### Role-Based Access Control
+```javascript
+function authorize(...roles) {
+  return (req, res, next) => {
+    if (!roles.includes(req.user.role)) {
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    next();
+  };
+}
+// Usage: deleteUser -> authenticate, authorize('admin')
+```
+
+## Input Validation Fixes
+
+### Schema Validation (Joi)
+```javascript
+const Joi = require('joi');
+const schema = Joi.object({
+  name: Joi.string().min(2).max(100).required(),
+  email: Joi.string().email().required(),
+  role: Joi.string().valid('user', 'admin').default('user')
+});
+const { error, value } = schema.validate(req.body);
+if (error) return res.status(400).json({ error: error.details[0].message });
+```
+
+### SQL Injection Prevention
+```javascript
+// Always use parameterized queries
+db.query('SELECT * FROM users WHERE id = $1', [userId]);
+// Never: db.query(`SELECT * FROM users WHERE id = ${userId}`);
+```
+
+### NoSQL Injection Prevention
+```javascript
+// Sanitize operators before query
+function sanitize(obj) {
+  if (typeof obj !== 'object') return obj;
+  delete obj.$where; delete obj.$ne; delete obj.$regex;
+  // ... remove other dangerous operators
+}
+db.collection('users').find(sanitize(query));
+```
+
+## Rate Limiting Fixes
+
+### Express Rate Limit
+```javascript
+const rateLimit = require('express-rate-limit');
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5,
+  message: { error: 'Too many attempts, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+app.use('/api/auth/login', loginLimiter);
+```
+
+## WebSocket Fixes
+
+### Authentication on Connect
+```javascript
+const WebSocket = require('ws');
+const server = new WebSocket.Server({ port: 8080 });
+server.on('connection', (socket, req) => {
+  const token = new URL(req.url, 'http://localhost').searchParams.get('token');
+  try {
+    const user = jwt.verify(token, process.env.JWT_SECRET);
+    socket.user = user; // Attach verified user
+  } catch {
+    socket.close(4001, 'Authentication failed');
+  }
+});
+```
+
+### Per-Message Authorization
+```javascript
+socket.on('message', (data) => {
+  const msg = JSON.parse(data);
+  if (msg.action === 'deleteUser') {
+    if (!socket.user.isAdmin) {
+      socket.send(JSON.stringify({ error: 'Forbidden' }));
+      return;
+    }
+    // Proceed with delete
+  }
+});
+```
+
+## Security Headers
+
+```javascript
+const helmet = require('helmet');
+app.use(helmet({
+  contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } },
+  hsts: { maxAge: 31536000, includeSubDomains: true }
+}));
+app.disable('x-powered-by');
+```

package/skills/cyberaudit/api/types/GRAPHQL.md

@@ -0,0 +1,82 @@
+# GraphQL API — Security Audit Guide
+
+## Unique Risks
+
+GraphQL changes the attack model fundamentally:
+- Single endpoint, all operations
+- Client decides what data to fetch
+- Nested queries can cause DoS
+- Introspection leaks the entire schema
+
+## Vulnerability Patterns
+
+### CRITICAL — Introspection Enabled
+```graphql
+query { __schema { types { name fields { name } } } }
+```
+An attacker gets your entire schema: all types, fields, mutations.
+Fix: disable introspection in production.
+
+### CRITICAL — No Depth Limiting
+```graphql
+query {
+  user { posts { comments { user { posts { comments { ... } } } } } }
+}
+```
+Deeply nested queries can crash the server.
+Fix: max depth limit (typically 5-7 levels).
+
+### HIGH — No Query Complexity Analysis
+Some queries are cheap (single field), some are expensive (list all).
+```graphql
+query { allUsers { posts { comments } } }
+```
+Fix: assign cost to each field, reject queries over limit.
+
+### HIGH — Batching Attacks
+```graphql
+query {
+  u1: user(id: 1) { creditCard }
+  u2: user(id: 2) { creditCard }
+  # ... 500 more
+}
+```
+Single query enumerates many records.
+Fix: rate limit by query complexity, not just by request count.
+
+### HIGH — Missing Authorization
+GraphQL resolves fields independently. A field might be authorized at the query level but not at the nested resolver level.
+```
+User.orders → authorized in resolver ✓
+User.orders[0].adminNotes → resolver forgets auth check ✗
+```
+Fix: authorize every resolver independently.
+
+### MEDIUM — Field Suggestions
+```
+query { uesrs { name } }
+# Response: "Did you mean 'users'?"
+```
+Suggestions leak valid field names.
+Fix: disable suggestions in production.
+
+### MEDIUM — Mutations Without Rate Limiting
+Mutations modify data. Unchecked mutations allow:
+- Mass account creation
+- Mass password reset requests
+- Rapid data modification
+
+Fix: stricter rate limits on mutations vs queries.
+
+## GraphQL-Specific Best Practices
+
+1. Disable introspection in production
+2. Implement query depth limiting
+3. Implement query complexity analysis
+4. Rate limit by query complexity, not count
+5. Authorize every resolver independently
+6. Disable field suggestions
+7. Use persisted queries where possible
+8. Limit batch request size
+9. Validate all mutation inputs strictly
+10. Monitor for abnormal query patterns

package/skills/cyberaudit/api/types/REST.md

@@ -0,0 +1,71 @@
+# REST API — Security Audit Guide
+
+## Threat Model
+
+REST APIs are resource-oriented. Each endpoint maps to a CRUD operation on a resource. The attack surface is every URL + method combination.
+
+## Vulnerability Patterns
+
+### CRITICAL — IDOR/BOLA
+Every resource access must verify ownership.
+```
+GET /api/orders/1     → verify order belongs to user
+PUT /api/users/2/role → verify admin + ownership
+```
+Test: replace IDs sequentially, check access.
+
+### CRITICAL — Mass Assignment
+Extra fields in request body modify protected attributes.
+```
+POST /api/users
+{ "name": "test", "role": "admin" }  ← role should be ignored
+```
+Fix: whitelist allowed fields server-side.
+
+### CRITICAL — Injection in Parameters
+URL params, query strings, headers all carry injection risk.
+```
+GET /api/users?search=' OR 1=1 --
+GET /api/users?sort=email; DROP TABLE users --
+```
+Fix: parameterized queries, input validation.
+
+### HIGH — Authentication Bypass
+```
+GET /api/admin/users            ← 401 Unauthorized
+GET /api/admin/users?role=admin  ← 200 OK (bypass via param)
+```
+Fix: auth middleware on route groups, not individual handlers.
+
+### HIGH — Improper Asset Management
+Deprecated endpoints still active:
+```
+GET /api/v1/users  (current)
+GET /api/v0/users  (old, no auth)
+```
+Fix: decommission old versions, redirect with 410.
+
+### MEDIUM — Excessive Data Exposure
+```
+GET /api/users returns:
+{ "id": 1, "name": "John", "ssn": "123-45-6789", "password_hash": "$2a$..." }
+```
+Fix: Response DTOs, exclude sensitive fields.
+
+### MEDIUM — Rate Limiting Absent
+Without rate limiting:
+- Brute force login: 1000 tries/min
+- Enumeration: scan all user IDs
+- DoS: flood expensive endpoints
+
+Fix: rate limiting per user/IP/token.
+
+## REST-Specific Best Practices
+
+1. Use proper HTTP methods (GET read, POST create, PUT full update, PATCH partial)
+2. Return proper status codes (401 unauth, 403 forbidden, 429 rate limit)
+3. Validate Content-Type header (reject unexpected formats)
+4. Never expose internal IDs in URLs if sequential
+5. Use HATEOAS links carefully (don't leak endpoints)
+6. Version your API properly (URL or header based)
+7. Document all endpoints (but don't include security details)

package/skills/cyberaudit/api/types/WEBSOCKET.md

@@ -0,0 +1,75 @@
+# WebSocket API — Security Audit Guide
+
+## Unique Risks
+
+WebSockets are persistent, bidirectional, and often bypass traditional web security controls:
+- No per-request headers or cookies after initial handshake
+- WAFs struggle to inspect WebSocket traffic
+- Long-lived connections increase attack surface
+
+## Vulnerability Patterns
+
+### CRITICAL — No Authentication on Connect
+```javascript
+const ws = new WebSocket('wss://api.example.com/ws');
+// No auth token sent → anyone can connect
+```
+Fix: require JWT/token in connection header or first message.
+
+### CRITICAL — No Per-Message Authorization
+Connection is authenticated, but subsequent messages are not authorized.
+```
+User connects (valid token) → sends: {"action": "deleteUser", "target": 5}
+No check if user is admin or owns user 5.
+```
+Fix: authorize every message independently.
+
+### HIGH — No Input Validation
+```
+ws.send(JSON.stringify({ action: "query", sql: "DROP TABLE users" }));
+```
+Fix: validate all message content server-side. Never trust the client.
+
+### HIGH — Message Injection
+If messages are parsed or rendered unescaped:
+```
+ws.send(JSON.stringify({ action: "chat", message: "<script>...</script>" }));
+```
+Fix: escape output, strip HTML, validate message schema.
+
+### MEDIUM — No Rate Limiting
+Without per-connection rate limiting:
+- Message flood
+- Resource exhaustion
+- Data exfiltration via rapid queries
+Fix: rate limit per connection, close connections that exceed limits.
+
+### MEDIUM — No Origin Validation
+```javascript
+// Server accepts connections from any origin
+```
+An attacker's website can open WebSocket connections on behalf of logged-in users (CSWSH — Cross-Site WebSocket Hijacking).
+Fix: validate Origin header during handshake.
+
+### MEDIUM — No Connection Timeout
+Connections stay open indefinitely, consuming resources.
+Fix: implement idle timeout, absolute timeout, and heartbeat.
+
+### LOW — Unencrypted Connections
+```
+const ws = new WebSocket('ws://api.example.com/ws');
+```
+Fix: mandatory WSS (TLS) for all WebSocket connections.
+
+## WebSocket-Specific Best Practices
+
+1. Authenticate on connection (token in first message or header)
+2. Authorize every message independently
+3. Validate all message content and schema
+4. Rate limit per connection
+5. Validate Origin header during handshake
+6. Implement idle timeout and absolute timeout
+7. Use WSS exclusively (no plain WS)
+8. Limit message size
+9. Log all connections and disconnections
+10. Monitor for abnormal message patterns

package/skills/cyberaudit/api/vulnerabilities/BOLA.md

@@ -0,0 +1,41 @@
+# BOLA — Broken Object Level Authorization (API1:2023)
+
+OWASP API Security Top 10 — #1
+
+## Description
+
+BOLA (also known as IDOR) occurs when an API does not verify that the requesting user is authorized to access a specific object. The attacker simply changes an object ID in the request to access another user's data.
+
+## Detection
+
+```javascript
+// Vulnerable: no ownership check
+app.get('/api/orders/:id', (req, res) => {
+  const order = db.orders.findById(req.params.id);
+  res.json(order);
+});
+
+// Secure: ownership check
+app.get('/api/orders/:id', authenticate, (req, res) => {
+  const order = db.orders.findById(req.params.id);
+  if (order.userId !== req.user.id && !req.user.isAdmin) {
+    return res.status(403).json({ error: 'Forbidden' });
+  }
+  res.json(order);
+});
+```
+
+## Testing
+
+1. Create user A and user B
+2. Get A's auth token
+3. Access B's resources by changing IDs
+4. If successful → BOLA
+
+## Remediation
+
+1. Verify ownership on every object access
+2. Use UUIDs instead of sequential IDs
+3. Implement proper authorization middleware
+4. Log all access control failures
+5. Test with automated scanners

package/skills/cyberaudit/api/vulnerabilities/BOPLA.md

@@ -0,0 +1,38 @@
+# BOPLA — Broken Function Level Authorization (API2:2023)
+
+OWASP API Security Top 10 — #2
+
+## Description
+
+BOPLA occurs when an API exposes administrative or privileged functions that regular users can access. The attacker uses a regular user token to call admin endpoints.
+
+## Detection
+
+```javascript
+// Vulnerable: no admin check
+app.delete('/api/admin/users/:id', authenticate, (req, res) => {
+  db.users.delete(req.params.id);
+  res.status(204).send();
+});
+
+// Secure: role check
+app.delete('/api/admin/users/:id', authenticate, authorize('admin'), (req, res) => {
+  db.users.delete(req.params.id);
+  res.status(204).send();
+});
+```
+
+## Testing
+
+1. Create a regular user and an admin user
+2. Get regular user token
+3. Try all admin endpoints with regular token
+4. If any succeed → BOPLA
+
+## Remediation
+
+1. Implement role-based access control
+2. Verify authorization on every admin function
+3. Never rely on route-level auth alone
+4. Use function-level authorization decorators/middleware
+5. Test with least-privilege tokens

package/skills/cyberaudit/api/vulnerabilities/INVENTORY.md

@@ -0,0 +1,47 @@
+# API Inventory — Asset Management
+
+## Why It Matters
+
+APIs proliferate faster than documentation:
+- Shadow APIs (undeclared, unmonitored)
+- Deprecated versions (still running, weaker security)
+- Debug endpoints (exposed in production)
+- Misconfigured new endpoints
+
+## Discovery Techniques
+
+### Automated
+```bash
+# Subdomain enumeration
+subfinder -d example.com | httpx -silent
+
+# Path enumeration
+ffuf -w /usr/share/wordlists/api.txt -u https://api.example.com/FUZZ
+
+# Swagger/OpenAPI discovery
+ffuf -w endpoints.txt -u https://example.com/FUZZ/swagger.json
+```
+
+### Manual
+- Review JavaScript source for API calls
+- Check network tab in browser devtools
+- Monitor DNS records for subdomain patterns
+- Review job postings for tech stack hints
+
+### From Response Analysis
+- Look for API version headers
+- Check response structure differences
+- Identify internal hostnames or IPs
+
+## Inventory Checklist
+
+- [ ] All API subdomains mapped
+- [ ] All API paths discovered
+- [ ] HTTP methods tested per path
+- [ ] Content types tested per endpoint
+- [ ] Authentication status per endpoint
+- [ ] Version history documented
+- [ ] Deprecated endpoints flagged
+- [ ] Debug/test endpoints identified
+- [ ] Third-party API dependencies listed
+- [ ] Shadow APIs found and documented

package/skills/cyberaudit/api/vulnerabilities/RATE-LIMITING.md

@@ -0,0 +1,66 @@
+# Rate Limiting — API Abuse Prevention
+
+## Why It Matters
+
+Without rate limiting:
+- Brute force: 10,000 passwords tested in 1 minute
+- Enumeration: entire user database scraped
+- DoS: server overwhelmed by single client
+- Financial: costs from cloud API calls
+
+## Implementation Patterns
+
+### By IP
+```nginx
+limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
+```
+Pros: simple, no client changes
+Cons: shared IPs (NAT), proxy bypass
+
+### By User ID
+```javascript
+// After authentication
+const key = `ratelimit:${req.user.id}`;
+const count = await redis.incr(key);
+if (count > 100) return 429;
+```
+Pros: accurate per user
+Cons: requires auth, unauthenticated = IP fallback
+
+### By Token
+```javascript
+const key = `ratelimit:${req.headers['x-api-key']}`;
+```
+Pros: works for service accounts
+Cons: tokens can be shared
+
+### Hybrid
+```javascript
+const key = req.user?.id || req.ip;
+```
+Best approach: authenticated users by ID, anonymous by IP.
+
+## Recommended Limits
+
+| Endpoint Type | Limit | Window |
+|--------------|-------|--------|
+| Login        | 5     | 15 min |
+| Registration | 3     | 1 hour |
+| Password Reset| 3    | 1 hour |
+| General API  | 100   | 1 min  |
+| File Upload  | 10    | 1 hour |
+| Search       | 30    | 1 min  |
+| WebSocket Msg| 60    | 1 min  |
+
+## Response
+
+```http
+HTTP/1.1 429 Too Many Requests
+Retry-After: 900
+Content-Type: application/json
+
+{
+  "error": "rate_limit_exceeded",
+  "retry_after_seconds": 900
+}
+```

package/skills/cyberaudit/api/vulnerabilities/THIRD-PARTY-API.md

@@ -0,0 +1,57 @@
+# Third-Party API Security
+
+## The Trust Problem
+
+Your security depends on APIs you do not control:
+- Payment gateways, auth providers, SaaS integrations
+- Data enrichment services, analytics, monitoring
+- AI/ML APIs, cloud functions, webhooks
+
+## Risk Categories
+
+### 1. Data Exposure
+When your app sends data to third parties:
+  - Are they encrypting at rest?
+  - Do they log sensitive data?
+  - What happens to data on account deletion?
+  - Do they sell or share data?
+
+### 2. Supply Chain Attack
+When third-party API is compromised:
+  - Attacker controls responses
+  - Malicious data injected downstream
+  - Credential theft from third-party breach
+
+### 3. Webhook Abuse
+When third party calls your endpoint:
+  - Spoofed webhook calls
+  - Replay attacks
+  - Payload manipulation
+  - Webhook endpoint DDoS
+
+## Remediation
+
+### Outgoing Calls
+1. Enforce HTTPS with certificate validation
+2. Set timeouts on all requests
+3. Implement retry logic with exponential backoff
+4. Treat all external data as untrusted
+5. Validate response schemas
+6. Log all external calls for audit
+7. Store credentials in a secrets manager
+
+### Incoming Webhooks
+1. Verify webhook signatures (HMAC)
+2. Validate payload schema
+3. Use a webhook secret per integration
+4. Implement replay protection (timestamp + nonce)
+5. Rate limit per webhook source
+6. IP allowlist where possible
+7. Return 200 quickly, process async
+
+### Monitoring
+1. Monitor for unusual third-party response patterns
+2. Alert on third-party SLA breaches
+3. Review third-party security postures regularly
+4. Test third-party failure modes (graceful degradation)
+5. Keep third-party dependencies minimal

package/skills/cyberaudit/reports/REPORT-TEMPLATE-API.md

@@ -0,0 +1,89 @@
+# API Security Audit Report
+
+**Target:** [API Name/URL]
+**Date:** [YYYY-MM-DD]
+**Auditor:** [Name]
+**Version:** [API Version]
+
+## Executive Summary
+
+[Brief overview: scope, critical findings, overall risk level]
+
+**Risk Level:** [Critical / High / Medium / Low]
+**Endpoints Tested:** [X]
+**Vulnerabilities Found:** [X]
+
+## Scope
+
+### In Scope
+- [Endpoint 1]
+- [Endpoint 2]
+- [Authentication mechanism]
+- [API version]
+
+### Out of Scope
+- [Anything excluded]
+
+## Methodology
+
+- [X] Discovery & Mapping
+- [X] Authentication Testing
+- [X] Authorization Testing (BOLA/BOPLA)
+- [X] Input Validation
+- [X] Rate Limiting
+- [X] Data Exposure
+- [X] Configuration Review
+
+## Findings
+
+### CRITICAL
+| # | Finding | Endpoint | Impact | Remediation |
+|---|---------|----------|--------|-------------|
+| 1 | [Title] | [URL] | [Impact] | [Fix] |
+| 2 | [Title] | [URL] | [Impact] | [Fix] |
+
+### HIGH
+| # | Finding | Endpoint | Impact | Remediation |
+|---|---------|----------|--------|-------------|
+| 3 | [Title] | [URL] | [Impact] | [Fix] |
+
+### MEDIUM
+| # | Finding | Endpoint | Impact | Remediation |
+|---|---------|----------|--------|-------------|
+| 4 | [Title] | [URL] | [Impact] | [Fix] |
+
+## Detailed Findings
+
+### Finding 1: [Title] (Critical)
+**Endpoint:** [URL]
+**Description:** [Detailed description]
+**Request:**
+```http
+GET /api/...
+```
+**Response:**
+```http
+HTTP/1.1 200 OK
+{ ... }
+```
+**Impact:** [Business/technical impact]
+**Remediation:** [Step-by-step fix]
+**CVSS:** [Score]
+
+### Finding 2: [Title]
+...
+
+## Recommendations
+
+1. [Priority action]
+2. [Priority action]
+3. [Priority action]
+
+## Appendix
+
+### Tools Used
+- [Tool/version]
+
+### Reference
+- OWASP API Security Top 10 (2023)
+- [Other references]