promptfoo-framework-owasp-apilisted

# OWASP API Security Top 10 The OWASP API Security Top 10 (2023) identifies critical API risks. LLM applications with function calling, tool usage, or agent architectures are particularly susceptible — the LLM acts as a dynamic interface between users and backend systems. Use `owasp:api` for comprehensive testing. ## Use this skill when - Testing LLM apps with API/function-cling/tool access against OWASP API Top 10 - Testing BOLA (API1), BFLA (API5), SSRF (API7) - Testing broken authentication, resource consumption, security misconfiguration - Testing sensitive business flows, inventory management, unsafe API consumption ## Do not use this skill when - Testing OWASP LLM Top 10 → use `promptfoo-framework-owasp-llm` - Testing OWASP Agentic → use `promptfoo-framework-owasp-agentic` - Testing general agent security → use `promptfoo-redteam-agents` ## 🛡️ Edge cases (mandatory handling) - **LLMs as API interfaces** — natural language input, autonomous tool usage, context-dependent authorization, and indirect injection create unique API security challenges. - **Defense in depth** — implement authorization at BOTH the LLM and API layers. - **Principle of least privilege** — limit LLM access to only necessary APIs and functions. - **Input validation** — validate LLM outputs before passing to APIs. - **Rate limiting** — apply both token-based and API call rate limits. ## 🎯 Core workflow 1. **Comprehensive testing** — `redteam: plugins: [owasp:api]` covers all 10. 2. **Targeted t