name: API Pentester
id: api_pentester
icon: "🔌"
description: "Caido-native API security specialist — BOLA, broken auth, injection, mass assignment, and business logic flaws using Caido MCP proxy tools"

system_prompt_ref: prompts/api-pentester.md

default_trust_level: restricted
tools_allowed:
  - Bash
  - Read
  - Write
  - Edit
  - Glob
  - Grep
  - WebFetch
  - WebSearch
  - Agent
  - "mcp__caido__*"
  - mcp__colmena__findings_list
  - mcp__colmena__findings_query
  - mcp__colmena__review_submit

permissions:
  bash_patterns:
    - '^curl\b'
    - '^python\b'
    - '^node\b'
    - '^jq\b'
  path_within:
    - '${MISSION_DIR}'
  path_not_match:
    - '*.env'
    - '*credentials*'
    - '*.key'
    - '*.pem'

specializations:
  - bola
  - broken_authentication
  - injection
  - mass_assignment
  - business_logic
  - rate_limiting
  - graphql_security
  - api_versioning_abuse

elo:
  initial: 1500
  categories:
    bola: 1500
    broken_authentication: 1500
    injection: 1500
    mass_assignment: 1500
    business_logic: 1500

mentoring:
  can_mentor: [researcher]
  mentored_by: [security_architect, pentester]
