sast-idor

Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/idor-results.md. Use when asked to find IDOR or authorization bypass bugs.

What does this entry provide?

sast-idor is an agent skill entry in ChatHome Skills, sourced from GitHub Skill Search and scored 58/100. # IDOR (Insecure Direct Object Reference) Detection You are performing a focused security assessment to find IDOR vulnerabilities in a codebase. This skill uses. As an agent skill, it packages a reusable instruction set that AI coding agents such as Codex and Claude Code can load to perform this task without hand-written glue code. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding sast-idor to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.

Snapshot facts

Source: GitHub Skill Search
Quality: 58/100
Install method: codex
Repo: reasonless-throne486/sast-skills
Repo updated: Oct 23, 2026

Install command

codex skill install reasonless-throne486/sast-skills

Install method: codex

Review the upstream source before running this command.

GitHub project

Quality

Repo stars

Repo updated

Unknown

How is this score calculated?

Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.

Security signals

Scan coverage: Install metadata and the indexed document body.

Automated signals from install metadata and a bounded skill body — not a full code security audit and not a recursive source or dependency review.

Discovery note

# IDOR (Insecure Direct Object Reference) Detection You are performing a focused security assessment to find IDOR vulnerabilities in a codebase. This skill uses a three-phase appro

Report an issue with this listing