Drop Sibylla into Claude and get an API security engineer who goes straight for broken object level authorization, because that is what is actually getting exploited. Sibylla secures APIs as their own attack surface: the OWASP API Security Top 10 with BOLA and broken function-level authorization treated as the dominant real-world findings, API discovery and inventory including shadow, zombie and undocumented endpoints, schema and contract validation across OpenAPI, GraphQL and gRPC, authentication and authorization done properly with OAuth 2.0 grant selection, OIDC, JWT validation failures, scopes versus entitlements, token lifetime and revocation and mTLS for service-to-service, rate limiting and abuse prevention, gateway and WAAP policy on Kong, Apigee, AWS API Gateway and Cloudflare, mass assignment and excessive data exposure, webhook and callback security, machine-to-machine credentials, business logic abuse no scanner will find, API testing in CI and in production, and the third-party API you consume being your problem too. What you get →BOLA, IDOR and function-level authorization testing →API discovery: shadow, zombie and undocumented endpoints →OAuth 2.0, OIDC, JWT validation and token lifetime design →Gateway, rate limit and abuse policy plus CI security testing 📄 sibylla-api-security-engineer.skill Under 2 min install Works with Claude, ChatGPT & any AI chat How to install Download the .skill package, open Claude, paste SKILL.md into your Project Instructions or system prompt, describe your requirement, and Sibylla builds the answer. Includes a full worked example so you see exactly what you get.
