hunt-idor

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

Quality

64%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-idor/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable curl/ffuf/GraphQL/grep payloads and a sequenced methodology backed by a validation gate, scoring top marks for actionability and strong workflow clarity. Its weak spots are conciseness (some already-known concepts and verbose chain narratives) and progressive disclosure (a ~390-line monolith with no reference-file split).

Suggestions

Trim concepts Claude already knows — e.g. the CIA-triad explanation in Gate 0 and the "Why IDOR pays big" framing — to reclaim tokens.

Split the body into one-level-deep reference files (e.g. references/chains.md for the six chains, references/payloads.md for the pattern library) and keep SKILL.md as an overview with clearly signaled links, which would also improve progressive disclosure.

Add an explicit validate→fix→retry feedback loop in the hunting methodology (e.g. "if Step 4 returns 403, try method tampering / parameter pollution from the bypass table before moving on") to reach the score-5 workflow anchor.

Dimension	Reasoning	Score
Conciseness	The body is dense with specialized bug-bounty tradecraft that earns its tokens, but it also explains concepts Claude already knows (the CIA triad mapping in Gate 0, the "Why IDOR pays big" framing) and runs long with verbose chain narratives. This matches the score-3 anchor (mostly efficient but includes some unnecessary explanation or could be tightened) rather than score 4, which requires only minor trimmable instances.	3 / 5
Actionability	It provides copy-paste-ready, fully executable guidance across the common cases: curl replay commands, an ffuf enumeration invocation, a Python wordlist generator, a GraphQL introspection query, grep patterns, and a base64-decode one-liner. This matches the score-5 anchor (fully executable, copy-paste ready, covers common cases).	5 / 5
Workflow Clarity	The 10-step methodology is clearly sequenced, and because it involves batch/destructive operations the validation cap is relevant — but validation is explicitly present (Step 10's differential confirmation and the Gate 0 reproducibility checklist with a "do not file" gate), so it is not capped at 3. It matches the score-4 anchor (clear sequence with most checkpoints present, minor validation gaps) rather than score 5, which requires explicit validate→fix→retry feedback loops throughout.	4 / 5
Progressive Disclosure	No bundle files exist (references/scripts/assets absent), so the entire ~390-line skill is one self-contained file with strong section headers but content that clearly belongs in separate files (the six detailed chains, the payload library, the root-cause catalog, bypass tables) inlined with zero one-level-deep references. This matches the score-3 anchor (some structure, but content that should be separate is inline) — it is not score 2 because the section organization is strong rather than a wall of text, and not score 4 because nothing is split into referenced files.	3 / 5
	Total	15 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is short, uses third person, and includes an explicit "Use when" trigger, giving it solid completeness and distinctiveness. Its weakness is specificity — it relies on the generic verb "hunting" rather than naming concrete IDOR-testing actions, and it lacks synonyms like BOLA or "insecure direct object reference."

Suggestions

Replace the generic verb "Hunting" with concrete actions, e.g. "Enumerate and replay object IDs across REST and GraphQL endpoints to find IDOR vulnerabilities."

Add natural synonyms and trigger phrases users say, such as "broken access control," "BOLA," or "insecure direct object reference," alongside "idor."

Tighten the "when" clause with concrete triggers, e.g. "Use when testing APIs with id, uuid, or org_id parameters for cross-tenant or cross-user access."

Dimension	Reasoning	Score
Specificity	The description names the domain ("idor vulnerabilities") but the only action verb is the generic "Hunting," with no concrete actions like enumerate, replay, or substitute IDs. It matches the score-2 anchor (names domain, minimal/generic actions) and falls short of score 3 which requires 1-2 concrete actions.	2 / 5
Completeness	It answers both "what" ("Hunting skill for idor vulnerabilities") and "when" via an explicit "Use when hunting idor on any target" clause, so it is not capped at 3. The "when" is present and explicit but somewhat generic ("on any target"), matching the score-4 anchor rather than the more concrete multi-trigger score-5 example.	4 / 5
Trigger Term Quality	It includes relevant natural keywords a hunter would say ("idor vulnerabilities," "hunting idor," "bug bounty reports"), but omits common synonyms and variations like "broken access control," "BOLA," or the spelled-out "insecure direct object reference." This matches the score-3 anchor (some relevant keywords, missing common variations/synonyms).	3 / 5
Distinctiveness Conflict Risk	"IDOR" is a fairly distinct niche with clear triggers, but the broad scope ("on any target") and natural overlap with related skills like auth-bypass/BOLA keep it from being fully distinct. It matches the score-4 anchor (mostly distinct, minor overlap risk with closely related skills).	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-idor/SKILL.md
Commit: 58017df

Reviewed: 43 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.