Specification
- Skill ID
- yaklang/hack-skills/api-recon-and-docs
- Publisher
- yaklang
- Repository
- hack-skills
- Installs
- 0
- Files
- 1
- Synced
- Sep 23, 2026
How to use it
Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.
yaklang/hack-skills/api-recon-and-docsInstalls these files- SKILL.md
What this skill tells the agent
SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface
AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.
1. PRIMARY GOALS
- Discover all reachable API entrypoints.
- Extract schemas, optional fields, and role differences.
- Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.
2. RECON CHECKLIST
JavaScript and client mining
curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -uCommon documentation and schema paths
/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gqlVersion and product drift
/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/3. WHAT TO EXTRACT FROM DOCS
- optional and undocumented fields
- admin-only request examples
- deprecated endpoints that may still be active
- schema hints like
additionalProperties: true - parameter names tied to filtering, sorting, IDs, roles, or tenancy
4. NEXT ROUTING
| Finding | Next Skill |
|---|---|
| object IDs everywhere | api authorization and bola |
| JWT, OAuth, role claims | api auth and jwt abuse |
| GraphQL or hidden fields | graphql and hidden parameters |
| strong auth boundary but suspicious business flow | business logic vulnerabilities |
More from yaklang
Use this skill in a project
Open any RiverX project, search the Skills panel for yaklang/hack-skills/api-recon-and-docs, and install it in one click.