hunt-idor
Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
64
76%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./skills/hunt-idor/SKILL.mdSecurity
3 findings: 1 critical severity, 1 high severity, 1 medium severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
This document is an offensive playbook with step‑by‑step instructions to enumerate, exfiltrate, and abuse IDORs — enabling unauthorized data access, account takeover, and financial fraud.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly shows curl/ffuf/Burp examples and instructions that embed session cookies, bearer tokens, and PATs in command headers and tells the reader to "replace" placeholders with real session/token values, which requires the LLM/operator to handle and output secret auth values verbatim.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill is an IDOR/hunting guide but explicitly documents endpoints and mutation names that perform financial actions: e.g., a POST /api/orders/{order_id}/refund that issues refunds (moves money), references to billing/transfer mutations like `transferBilling`, and mentions of payment platforms (Stripe, PayPal) and specific Stripe mutation `UpdateAtlasApplicationPerson`. These are specific APIs/functions related to payment/billing that could be used for direct financial execution.
- Repository
- elementalsouls/Claude-BugHunter
- Commit
6b9c96e
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.