hunt-idor

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-idor/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable payloads and a clear, validated hunting workflow, scoring top marks on actionability and workflow clarity. It loses points for verbosity in the scenario/chain prose and for being a monolithic file with no progressive disclosure structure.

Suggestions

Tighten or trim the 'Real Impact Examples' and per-chain prose narratives to reduce token cost and lift conciseness toward 3.

Move the detailed Chains & Compositions and Bypass Techniques tables into a referenced file (e.g. references/chains.md) with a concise overview and one-level-deep links to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is densely actionable but runs ~390 lines with verbose prose sections (full 'Real Impact Examples' scenarios and six multi-paragraph chain narratives) that could be tightened, fitting 'mostly efficient but includes some unnecessary explanation or could be tightened' rather than the lean score 3.	2 / 3
Actionability	Provides fully executable, copy-paste-ready guidance: curl one-liners swapping sessions, a real GraphQL IDOR query, ffuf enumeration, a Python ID wordlist generator, Burp Intruder payload positions, and grep patterns for missing ORM scoping.	3 / 3
Workflow Clarity	The 'Step-by-Step Hunting Methodology' is a clearly sequenced 10-step process and the 'Gate 0 Validation' section is an explicit validation checkpoint (what can the attacker do / what does the victim lose / reproducible in 10 minutes) before filing a report, matching the score 3 anchor with checkpoints and a feedback loop.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and the skill is a single monolithic SKILL.md with all material — including long chain and bypass content that could be split — inline, fitting 'some structure but content that should be separate is inline' rather than a well-signaled multi-file overview.	2 / 3
	Total	10 / 12 Passed

Description

75%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is clear, third-person, and includes an explicit 'Use when' trigger, giving it strong completeness and distinctiveness. It is weakest on trigger-term coverage and on enumerating concrete capabilities.

Suggestions

Add concrete hunting actions to the description (e.g., enumerate IDs, replay sessions cross-account, test GraphQL IDORs, chain to ATO) to lift specificity to 3.

Include natural user-facing variations such as 'insecure direct object reference', 'broken object-level authorization', or 'access control' alongside 'idor' to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain ("idor vulnerabilities") and provenance ("Built from 26 public bug bounty reports") but does not enumerate concrete hunting actions like enumerating IDs, replaying sessions, or testing GraphQL, matching the 'names domain and some actions, but not comprehensive' anchor rather than the multi-action score 3.	2 / 3
Completeness	Explicitly answers both what ("Hunting skill for idor vulnerabilities") and when ("Use when hunting idor on any target"), matching the score 3 anchor with an explicit trigger clause.	3 / 3
Trigger Term Quality	Includes relevant keywords ("idor", "hunting idor", "bug bounty") but lacks common natural variations a user might say such as "insecure direct object reference", "authorization", or "access control", fitting the 'some relevant keywords but missing common variations' anchor.	2 / 3
Distinctiveness Conflict Risk	The narrow IDOR-hunting niche with a dedicated trigger ("hunting idor on any target") is clearly distinguishable from other hunting skills and unlikely to fire for the wrong skill.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-idor/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.