chain-idor-to-priv-esc

Build chains where IDOR enables privilege escalation and high-impact control-plane actions.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-organized instruction-only security skill with a clear multi-step chain and an explicit validation checkpoint; its only weakness is actionability that lacks the operational specifics to be fully executable.

Suggestions

Add concrete operational detail to each step, e.g. how to detect the IDOR target object, how to escalate (token theft vs. role parameter tampering), and how to evidence the privileged action.

Optionally include a short example payload or request-shape illustration to make the chain copy-paste ready while staying concise.

Dimension	Reasoning	Score
Conciseness	The body is maximally lean with no padding and no explanation of concepts Claude already knows (e.g. what IDOR or privilege escalation is); every line is actionable instruction, matching 'lean and efficient; every token earns its place'.	3 / 3
Actionability	Guidance names concrete objects and actions ('steal recovery token', 'admin-level action', 'before/after authorization state') but stops short of operational specifics needed to fully execute, fitting 'some concrete guidance but incomplete; missing key details'.	2 / 3
Workflow Clarity	A clear three-step numbered 'Canonical path' is paired with an explicit 'Validation' step requiring before/after authorization evidence, matching 'clear sequence with explicit validation steps'.	3 / 3
Progressive Disclosure	The skill is well under 50 lines, needs no external references (no bundle files exist), and is organized into 'Canonical path' and 'Validation' sections, satisfying the simple-skill allowance for a top score.	3 / 3
	Total	11 / 12 Passed

Description

50%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear, specific security niche (IDOR-to-priv-esc chaining) but omits an explicit 'Use when...' trigger clause and lists only one compound action, so it scores consistently at the middle level across all dimensions.

Suggestions

Add an explicit trigger clause, e.g. 'Use when chaining an IDOR vulnerability into privilege escalation or high-impact control-plane actions.'

List multiple concrete actions (e.g. 'modify another user's objects, escalate roles, steal recovery tokens, perform admin-level actions') to raise specificity.

Include common keyword variations (e.g. 'IDOR, broken access control, horizontal/vertical privilege escalation, authorization bypass') for better trigger term coverage.

Dimension	Reasoning	Score
Specificity	The description names a concrete domain and chain concept ('IDOR enables privilege escalation and high-impact control-plane actions') but lists a single compound action rather than multiple distinct concrete actions, matching the 'names domain and some actions, but not comprehensive' anchor.	2 / 3
Completeness	It clearly states what the skill does but lacks any 'Use when...' clause or equivalent explicit trigger guidance, which per the judging guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	'IDOR' and 'privilege escalation' are natural terms a security tester would say, but coverage is limited and 'control-plane' leans toward jargon with no common variations, fitting 'some relevant keywords but missing common variations'.	2 / 3
Distinctiveness Conflict Risk	'IDOR to privilege escalation chain' carves a recognizable niche but could still overlap with adjacent web-exploitation or general privilege-escalation skills, matching 'somewhat specific but could still overlap'.	2 / 3
	Total	8 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md
Commit: e34afba

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.