sast-idor

Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/idor-results.md. Use when asked to find IDOR or authorization bypass bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and clearly sequenced, with excellent code coverage and precise subagent templates. Its main weaknesses are token inefficiency from duplicated guidance and conceptual preamble, and a monolithic structure that lacks the reference-file split the length warrants.

Suggestions

De-duplicate the authorization-pattern and vulnerable-vs-secure examples: keep them once and have the Phase 2 template reference that section or a shared reference file instead of restating them inline.

Trim or remove the 'What is IDOR / What IDOR IS / What IDOR is NOT' pedagogy, or move it to a reference file, since Claude already understands IDOR — retain only the scoping rules that affect classification.

Move the eight-language example catalog and the long Phase 1/Phase 2 prompt templates into a references/ file (e.g. examples.md and prompts.md) and signal them from the overview to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	At ~458 lines the body explains a concept Claude already knows ('What is IDOR') and duplicates the authorization-pattern / vulnerable-vs-secure material: it appears both in the main body and restated inside the Phase 2 subagent prompt template. Tightening the duplication and trimming the conceptual intro would earn the top score.	2 / 3
Actionability	Provides executable vulnerable/secure code across eight languages, fully-specified subagent prompt templates with substituted fields, concrete batch math (8 candidates → 3 batches), exact markdown output formats, and curl-style dynamic-test placeholders — copy-paste ready.	3 / 3
Workflow Clarity	Three phases are explicitly gated ('Phase 2 must run AFTER Phase 1 completes — it depends on the recon output'; 'Phase 3 must run AFTER all Phase 2 batches complete'), with a concrete batching procedure, merge procedure, file-cleanup step, and an 'Important Reminders' checklist covering edge cases and false-negative avoidance.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent), so everything is inline in a single ~458-line SKILL.md. Sections are well-organized, but the large multi-language example catalog and the long subagent prompt templates are content that could be split into reference files to shorten the overview.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, third-person description that clearly states capabilities, gives an explicit use-when trigger, and names natural user terms. It is concise without padding and unlikely to conflict with sibling skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'Detect Insecure Direct Object Reference (IDOR)', 'recon (find candidates)', 'batched verify (check authorization in parallel subagents, 3 candidates each)', and 'merge (consolidate batch results)', plus 'Checks endpoints for missing ownership or authorization checks on user-supplied identifiers'.	3 / 3
Completeness	Explicitly answers both what it does (three-phase detection approach, prerequisites, output file) and when to use it ('Use when asked to find IDOR or authorization bypass bugs').	3 / 3
Trigger Term Quality	Uses natural terms a security-focused user would say — 'IDOR', 'authorization bypass bugs' — with an explicit trigger: 'Use when asked to find IDOR or authorization bypass bugs.'	3 / 3
Distinctiveness Conflict Risk	Occupies a clear, narrow niche (IDOR detection) with distinct triggers and prerequisite linkage to sast-analysis, making conflict with other skills unlikely. Voice is third person ('Detect', 'Checks', 'Outputs').	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-idor/SKILL.md
Commit: db52227

Reviewed: about 19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.