Loading…
Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.
bola-idor is an agent skill entry in ChatHome Skills, sourced from GitHub Skill Search and scored 58/100. # Broken Object Level Authorization (BOLA / IDOR) ## What Is Broken and Why The server accepts a resource identifier from the client and fetches the object with. As an agent skill, it packages a reusable instruction set that AI coding agents such as Codex and Claude Code can load to perform this task without hand-written glue code. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding bola-idor to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.
codex skill install ShulkwiSEC/bb-hugeReview the upstream source before running this command.
Scan coverage: Install metadata and the indexed document body.
Automated signals from install metadata and a bounded skill body — not a full code security audit and not a recursive source or dependency review.
# Broken Object Level Authorization (BOLA / IDOR) ## What Is Broken and Why The server accepts a resource identifier from the client and fetches the object without verifying the re