idor-testing
Assess IDOR Authorization Controls
Object references can expose or modify another user's resources when authorization checks fail. This skill structures authorized testing, evidence collection, impact analysis, and remediation.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "idor-testing" from https://skillstore.io/skills/sickn33-idor-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-idor-testing/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "idor-testing". Plan an authorized two-account review for profile and invoice access.
Expected outcome:
- Test each account's own profile and invoice before changing identifiers.
- Expect denial when either account requests the other's resources.
- Record endpoint, role, object owner, response status, and ownership evidence.
- Stop before downloading sensitive content or changing production data.
Using "idor-testing". Summarize a finding where Account A can view Account B's invoice metadata.
Expected outcome:
Confirmed horizontal authorization failure. Account A received Account B's invoice metadata. Restrict queries by authenticated owner and add cross-account regression tests.
Using "idor-testing". Recommend remediation for an address endpoint that trusts a submitted user identifier.
Expected outcome:
Derive the user from the authenticated session. Query the address by both object identifier and owner. Return a consistent denial for mismatches.
Security Audit
Medium RiskAll 65 external-command alerts are false positives caused by Markdown code delimiters, not executable shell or Ruby syntax. One low-risk enumeration instruction is confirmed. Destructive cross-account testing and rate-limit evasion create additional medium-risk misuse potential despite the authorization warnings.
Confirmed security concerns (3)
Risk Factors
⚙️ External commands (50)
Detected Patterns
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-idor-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-idor-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-idor-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-idor-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-idor-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). idor-testing security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-idor-testing/audits/5BibTeX citation
@techreport{zebbern-sickn33-idor-testing-2026,
author = {zebbern},
title = {idor-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-idor-testing/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "idor-testing security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-idor-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-idor-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Validate Customer Isolation
Compare controlled accounts to verify that each customer can access only owned profiles, orders, files, and messages.
Review API Authorization
Create regression checks for object ownership across read, update, and delete endpoints.
Teach Access Control
Demonstrate IDOR discovery and remediation in a laboratory containing synthetic users and records.
Try These Prompts
Create an IDOR checklist for my authorized test. Cover URLs, parameters, bodies, files, expected ownership checks, and evidence requirements.
Plan non-destructive IDOR tests using two controlled accounts. List requests, identifier changes, expected denials, and safe stopping conditions.
Analyze these sanitized request and response descriptions for possible IDOR. Separate confirmed evidence, uncertainty, impact, and recommended validation.
Build a scoped IDOR matrix across roles, methods, API versions, files, and asynchronous workflows. Include request budgets and non-destructive verification.
Best Practices
- Use written scope, isolated test accounts, synthetic records, and a fixed request budget.
- Prefer non-destructive proof and minimize access to data belonging to other accounts.
- Document ownership context, expected denial, actual response, impact, and reproducible remediation tests.
Avoid
- Do not enumerate production identifiers without explicit limits and monitoring.
- Do not bypass rate limits, rotate source addresses, or conceal testing activity.
- Do not modify or download real user data when metadata or controlled records can prove the issue.