CtrlK
BlogDocsLog inGet started
Tessl Logo

idor

Hunt Insecure Direct Object Reference (CWE-639) — missing authorization checks on object IDs. Covers horizontal vs vertical privilege escalation, UUID vs integer guessing, and GraphQL introspection-driven IDOR discovery.

64

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/idor/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a highly actionable, well-structured IDOR hunting playbook with executable commands and explicit success/validation signals. Minor trimming of motivational prose and adding a structured feedback loop would push conciseness and workflow clarity to full marks.

DimensionReasoningScore

Conciseness

The body is dense and tactical with copy-paste grep/curl commands and almost no basic-concept padding, but a few motivational lines ('IDOR is the #1 source of bug bounty payouts...', 'one of the richest hunting grounds') could be trimmed, keeping it just below fully lean.

4 / 5

Actionability

Provides fully executable, copy-paste-ready grep patterns across Spring/Express/Flask/Rails, GraphQL introspection curl, ownership-check greps, concrete PoC curl commands, and a Python mass-assignment example covering the common cases.

5 / 5

Workflow Clarity

Clear sequenced audit workflow (Step 1→2→3) and PoC workflows with explicit validation via the Success signals section and a negative control, but there is no structured validate→fix→retry feedback loop or checklist, so it sits just below the 5 anchor.

4 / 5

Progressive Disclosure

Self-contained single-file playbook with no bundle files, organized into eight clearly numbered, well-headed sections that are easy to navigate; the size does not warrant splitting, so well-organized sections earn the top score.

5 / 5

Total

18

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-keyworded, and highly distinctive, but it omits an explicit 'Use when...' trigger clause in the description field itself (relying on metadata.when_to_use instead), which caps completeness at 3. Adding an explicit usage trigger phrase would lift the completeness score.

Suggestions

Append an explicit trigger clause to the description, e.g. 'Use when auditing endpoints for authorization bypass, broken access control, or CWE-639 IDOR vulnerabilities.'

Add common natural synonyms users say ('authorization bypass', 'broken access control', 'access control') to broaden trigger-term coverage.

Consider framing 2-3 distinct concrete actions (enumerate, audit, exploit/PoC) rather than a single 'Hunt' verb to push specificity toward comprehensive.

DimensionReasoningScore

Specificity

Names a concrete action ('Hunt Insecure Direct Object Reference (CWE-639)') and lists several specific coverage areas (horizontal/vertical escalation, UUID vs integer guessing, GraphQL introspection), but it is essentially a single verb with covered topics rather than multiple distinct actions, so it sits just below the comprehensive 5 anchor.

4 / 5

Completeness

Provides a clear 'what' (hunt IDOR / missing authorization checks on object IDs) but the description field contains no 'Use when...' clause or equivalent explicit trigger guidance — the trigger terms live only in metadata.when_to_use, so per the rubric cap completeness stays at 3.

3 / 5

Trigger Term Quality

Includes strong natural terms and synonyms a security tester would say — 'IDOR', 'Insecure Direct Object Reference', 'CWE-639', 'authorization', 'privilege escalation', 'GraphQL introspection' — but omits common natural variants like 'authorization bypass' or 'broken access control', keeping it just short of comprehensive.

4 / 5

Distinctiveness Conflict Risk

Targets a clear, narrow niche (IDOR / CWE-639) with distinct triggers that are unlikely to fire for adjacent web-exploitation skills like XSS, SSRF, or SQLi, giving minimal conflict risk.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.