hellodqy/mastermind-bug-bounty/idor-test
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Test object- and function-level authorization when identifiers, tenants, ownership fields, or nested resources may cross an access boundary.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/idor-testSKILL.md
IDOR Test
Goal
建立主体—对象—动作矩阵，判断可控标识符能否造成跨用户、跨租户或跨角色的数据访问与敏感操作。
Tools / Inputs
- 两个测试账号、对象 ID、tenant/org/user 字段、列表与详情接口、角色差异
- 资源索引：
references/INDEX.md；候选资源：authorization-idor-testing.md、response-chaining.md
Constraints
- 优先只读差分；写操作只使用自建且可回滚的测试对象。
- 不批量枚举真实用户对象。
- HTTP 200 不是结论，必须证明返回或执行了不属于当前主体的内容。
- 同时检查对象级、字段级、函数级和租户级边界。
- 新 ID 与关系字段回写值池，供相关端点复测。
Chain Questions
- 授权绑定的是路径 ID、body 字段、token claim 还是服务端关系？
- 列表、详情、附件、导出和写接口是否使用同一边界？
- 一个泄露对象能否解锁子资源、令牌、文件或管理动作？
- 当前证据跨越了哪一个明确的主体或租户边界？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/idor_test/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/idor-test)