Name: sast-idor
Rating: 68 (1 reviews)
Author: utkusen

sast-idor

Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/idor-results.md. Use when asked to find IDOR or authorization bypass bugs.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is sast-idor in utkusen/sast-skills

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced multi-phase detection workflow with excellent copy-paste-ready prompts and examples. Its main weaknesses are token cost from duplicated guidance and an inlined examples catalog that could be split into reference files.

Suggestions

Externalize the nine-stack 'Vulnerable vs. Secure Examples' catalog into a references file (e.g. references/examples.md) and have the orchestrator load only the matching stack, reducing always-loaded context and improving progressive_disclosure.

De-duplicate the 'What IDOR is NOT' and 'Authorization patterns that PREVENT IDOR' blocks: keep them once in the body and have the Phase 2 subagent prompt reference that section or load a shared snippet instead of repeating the full text.

Add an explicit checkpoint in Phase 3 verifying that every expected sast/idor-batch-N.md file was written before merging, with a retry/re-launch path for any failed batch subagent, to close the workflow_clarity gap.

Dimension	Reasoning	Score
Conciseness	The skill is mostly efficient with tight vulnerable/secure code pairs, but it teaches IDOR concepts Claude already knows ('What is IDOR', 'What IDOR IS / IS NOT') and duplicates the 'What IDOR is NOT' and 'Authorization patterns that PREVENT IDOR' blocks between the body and the Phase 2 subagent prompt, so it could be tightened.	3 / 5
Actionability	Provides copy-paste-ready subagent prompt templates with explicit placeholders, fully templated markdown output formats, a clear classification scheme, and real executable vulnerable/secure code pairs across nine tech stacks — covering the common cases concretely.	5 / 5
Workflow Clarity	The three phases are explicitly sequenced with phase-gating ('Phase 2 must run AFTER Phase 1 completes'), a detailed batching procedure, and a merge procedure, plus a 'Needs Manual Review' safety valve; the minor gap is absence of any handling for batch-subagent failure or retry.	4 / 5
Progressive Disclosure	The single 459-line SKILL.md is well-sectioned with no nested references, but roughly 160 lines of nine-language examples and the full subagent prompt templates are inlined bulk content that could be externalized into load-on-demand reference files rather than always occupying context.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly conveys both capability and trigger conditions in third person. It is comprehensive on actions and use-when guidance, with only minor missing trigger-term synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Detect IDOR vulnerabilities', 'recon (find candidates)', 'batched verify (check authorization in parallel subagents, 3 candidates each)', 'merge (consolidate batch results)', and 'Checks endpoints for missing ownership or authorization checks' — giving comprehensive coverage with no real gaps.	5 / 5
Completeness	Clearly states both what it does (detect IDOR via a three-phase recon/verify/merge approach) and when to use it ('Use when asked to find IDOR or authorization bypass bugs') with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Includes solid natural terms ('IDOR', 'Insecure Direct Object Reference', 'authorization bypass bugs') that a security user would say, but misses common synonyms like 'BOLA', 'access control', and 'horizontal privilege escalation', so it falls short of comprehensive.	4 / 5
Distinctiveness Conflict Risk	IDOR detection is a sharp, well-defined security niche with distinctive triggers, making conflict with unrelated skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-idor/SKILL.md
Commit: db52227

Reviewed: 15 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.