Loading...
Loading...
Found 4 Skills
Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.
Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configuring API key or JWT authentication, locking down Cloud Run or Cloud Run functions backends with a gateway service account, reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom domain setup, or LLM model routing.
Apply, list, or edit provider-native policies on API instances (Kong plugin, Apigee template, Azure policy, or MuleSoft/Anypoint) via the MuleSoft Platform MCP Server. TRIGGER when: the user asks what protection they have on a provider's APIs ("what protection do I have for my Apigee APIs"), wants to change an already-applied native policy ("improve the IP filtering to include 1.1.1.1"), or apply one native plugin to an already-chosen instance ("add ip-restriction on this Kong service"). DO NOT TRIGGER when: they want one Universal/canonical policy across many instances or providers — use skill apply-universal-policy. DO NOT TRIGGER to remove, detach, enable, or disable a policy, or when they are driving Anypoint REST (skill apply-policy-to-api-instance).