API Security Best Practices skill: what it does and how to install it

What it does. Reviews an API from caller identity through authorisation, validated input, storage and responses. It guides token verification, tenant-scoped access checks, strict parsing, abuse controls, secret handling and security-focused tests, then reports route policies, reproduced cases and remaining gaps.

When to use it. Use when adding protected endpoints, reviewing object access, replacing permissive parsing or investigating API abuse. It is not a full identity service, certified audit or penetration test, and passing structural checks does not prove a deployed API is secure.