A professional security testing skill designed to enumerate and audit API endpoints against the OWASP API Security Top 10.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pentest-api-attacker
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pentest-api-attacker using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Pentest API Attacker?
Pentest API Attacker is a specialized security module within the Openclaw Skills ecosystem focused on identifying vulnerabilities in API architectures. It automates the discovery of endpoints and executes targeted attacks to uncover business logic flaws, authentication abuse, and protocol-specific weaknesses. By aligning with industry frameworks like PTES and MITRE ATT&CK (T1190), it provides security researchers with a standardized way to conduct authorized penetration tests.
This skill is built for precision and ethics, requiring strict scope validation before any active scanning occurs. It leverages deterministic artifacts to ensure that findings can be integrated into broader security workflows. Whether you are conducting a standalone audit or integrating security into a pipeline, this tool ensures your Openclaw Skills setup remains robust against modern API threats.
Pentest API Attacker Use Cases
- Discovering undocumented or 'shadow' API endpoints during a penetration test.
- Testing for authentication bypass and broken object-level authorization (BOLA) vulnerabilities.
- Automating security compliance checks against OWASP WSTG and NIST SP 800-115 standards.
- Generating reproducible Proof-of-Concept (PoC) notes for vulnerability reporting within Openclaw Skills.
How Pentest API Attacker Works
- The skill validates the target against a provided scope.json to prevent unauthorized or out-of-scope testing.
- It performs discovery and enumeration to map out the API attack surface.
- Targeted security checks are executed based on OWASP and MITRE ATT&CK methodologies.
- Vulnerabilities are recorded in a canonical finding format with detailed PoC notes.
- Deterministic JSON reports are exported for use by other tools or human analysts.
Pentest API Attacker Setup
To use this skill within your Openclaw Skills environment, ensure you have the required scripts and a valid scope definition.
# Run the attacker in dry-run mode to validate logic
python skills/pentest-api-attacker/scripts/api_attacker.py --scope scope.json --target <target_url> --input <input_path> --output <output_path> --format json --dry-run
# Execute live tests (requires explicit authorization flag)
python skills/pentest-api-attacker/scripts/api_attacker.py --scope scope.json --target <target_url> --i-have-authorization
Pentest API Attacker Data Schema & Taxonomy
The Pentest API Attacker generates structured JSON artifacts to maintain data integrity across Openclaw Skills workflows:
| Artifact | Description |
|---|---|
api-endpoints.json |
A comprehensive list of discovered API routes, methods, and parameters. |
api-findings.json |
Detailed security findings mapped to the canonical finding_schema. |
api-attack-report.json |
A summary report synthesizing the results of the attack session. |
Pentest API Attacker Advanced Features
- Mandatory scope validation to ensure ethical and legal compliance.
- Dry-run mode for simulating attack logic without sending active payloads.
- Integration with MITRE ATT&CK T1190 for standardized threat mapping.
- Support for the canonical finding_schema to ensure interoperability with other Openclaw Skills.
- Deterministic artifact generation for automated downstream security processing.
SKILL.md
Loading
Related Openclaw Skills
Pentest Active Directory
An automated security assessment tool for mapping and validating Active Directory identity attack paths and privilege escalation routes.
Nmap Pentest Scans
Orchestrate authorized Nmap host discovery, service enumeration, and automated security reporting.
ML Model Evaluation & Benchmarking
A technical tool for producing consistent model rankings from metric-weighted evaluation inputs and deterministic benchmarking logic.
ML Experiment Tracker
A standardized framework for planning and documenting reproducible machine learning experiments before training begins.
Pentest Auth Bypass
A specialized security testing skill designed to identify authentication bypass vulnerabilities and account takeover risks.
Pentest C2 Operator
A specialized tool for managing authorized Command and Control simulation workflows and measuring defensive detection effectiveness.
Featured*
