Name: api-recon-and-docs
Author: yaklang

Imported from yaklang/hack-skills (skills/api-recon-and-docs/SKILL.md) via skills.sh. Install upstream with npx skills add yaklang/hack-skills --skill api-recon-and-docs. Copyright stays with the author.

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.

1. PRIMARY GOALS

Discover all reachable API entrypoints.
Extract schemas, optional fields, and role differences.
Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

2. RECON CHECKLIST

JavaScript and client mining

curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u

Common documentation and schema paths

/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql

Version and product drift

/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/

3. WHAT TO EXTRACT FROM DOCS

optional and undocumented fields
admin-only request examples
deprecated endpoints that may still be active
schema hints like additionalProperties: true
parameter names tied to filtering, sorting, IDs, roles, or tenancy

4. NEXT ROUTING

Finding	Next Skill
object IDs everywhere	api authorization and bola
JWT, OAuth, role claims	api auth and jwt abuse
GraphQL or hidden fields	graphql and hidden parameters
strong auth boundary but suspicious business flow	business logic vulnerabilities

Install api-recon-and-docs and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "yaklang-hack-skills-api-recon-and-docs", "kind": "skill", "name": "api-recon-and-docs", "description": "API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.", "publisher": "yaklang", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/yaklang/hack-skills", "path": "skills/api-recon-and-docs/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/yaklang/hack-skills/api-recon-and-docs", "key": "yaklang/hack-skills/skills/api-recon-and-docs/SKILL.md" } }, "instructions": "# SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface\n\n> **AI LOAD INSTRUCTION**: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.\n\n## 1. PRIMARY GOALS\n\n1. Discover all reachable API entrypoints.\n2. Extract schemas, optional fields, and role differences.\n3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.\n\n## 2. RECON CHECKLIST\n\n### JavaScript and client mining\n\n```bash\ncurl https://target/app.js | grep -oE '(/api|/", "cost": { "context_tokens": 400 } }

api-recon-and-docs

About

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

1. PRIMARY GOALS

2. RECON CHECKLIST

JavaScript and client mining

Common documentation and schema paths

Version and product drift

3. WHAT TO EXTRACT FROM DOCS

4. NEXT ROUTING

Install api-recon-and-docs and it becomes one more candidate the router can pick - when it fits.

Use it

Manifest

Reviews