exploit-idor

Insecure Direct Object References (IDOR) — authorization bypass through predictable object references (sequential IDs, UUIDs, filenames, encoded IDs). Covers horizontal/vertical privilege escalation, ID enumeration, HTTP method tampering, and JWT sub claim manipulation.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/idor/SKILL.md

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with strong workflow sequencing and validation, dragged down by a duplicated Flask brute-force section and a monolithic structure that would benefit from splitting sub-topics into reference files.

Suggestions

De-duplicate the Flask SECRET_KEY brute-force material — keep it in one section and cross-reference from the other.

Split the larger sub-topics (MongoDB ObjectId reconstruction, JWT/session cracking, endpoint enumeration) into reference files under ./references/ and link to them from SKILL.md to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code-and-decision-rule density, but the Flask SECRET_KEY brute-force content is duplicated (the 'Flask Session Cookie' fast-path and the later 'JWT / Session Signature Cracking > Flask session' section), and several prose passages could be tightened.	3 / 5
Actionability	Fully executable, copy-paste-ready bash blocks covering horizontal/vertical IDOR, ID enumeration, ObjectId reconstruction, JWT/Flask cracking, and endpoint probing — specific examples cover the common cases.	5 / 5
Workflow Clarity	Clear multi-step sequences with explicit validation checkpoints and feedback loops — 'Decision rule' tables, MANDATORY checkpoints, and recovery paths (e.g. crack fails → fall back to enumeration; confirm victim ID exists before probing).	5 / 5
Progressive Disclosure	Well-organized section headers give navigation, but the body is a 300+ line monolith with distinct sub-topics (Flask cookie, MongoDB ObjectId, JWT cracking, endpoint enumeration) that belong in separate reference files; no external references or bundle files are used.	3 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with concrete capability listing and low conflict risk, weakened only by the absence of an explicit 'Use when...' trigger clause.

Suggestions

Add an explicit trigger clause, e.g. 'Use when the challenge involves IDOR, authorization bypass, access control, or predictable object references.'

Surface a few more natural user phrases (e.g. 'broken access control', 'access another user's data') directly in the description rather than only in metadata.when_to_use.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'authorization bypass through predictable object references (sequential IDs, UUIDs, filenames, encoded IDs)', plus 'horizontal/vertical privilege escalation, ID enumeration, HTTP method tampering, and JWT sub claim manipulation' — comprehensive coverage of the IDOR domain.	5 / 5
Completeness	The 'what' is clear and detailed, but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description field; per the rubric a missing explicit trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ('authorization bypass', 'ID enumeration', 'privilege escalation', 'object reference'), but a few common synonyms and the explicit phrasing users emit are partially covered rather than exhaustive.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (IDOR / authorization bypass via predictable object references) with distinct, specific triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/idor/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.