skill

idor-testing — Claude Code skill: what it does, how to install

Q: How to install idor-testing in Claude Code?

Run `npx claude-code-templates@latest --skill security/idor-testing` in your terminal.

A testing skill for discovering IDOR flaws and broken access controls in web apps. Useful for checking whether users can reach unauthorized records or files.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --skill security/idor-testing

Open on GitHub

What idor-testing does

This skill guides developers through testing web apps for Insecure Direct Object References. It details techniques for altering IDs in query parameters and JSON payloads. It also covers trying alternate HTTP verbs when a standard GET endpoint returns forbidden.

The testing workflow relies on Burp Suite for request interception and parameter cycling in Intruder. You must obtain written testing consent and prepare at least two distinct user accounts before starting. Single accounts are not enough to confirm data leakage.

What it helps with

locate direct database object references in API paths
test access boundaries on protected file downloads
spot authorization bypasses caused by HTTP method switching
prepare automated parameter fuzzing runs in Burp Suite

Example prompts for the agent

Check if the /api/user/profile?id=1001 endpoint exposes IDOR issues
Help me configure Burp Suite Intruder to test user ID enumeration
Draft a remediation recommendation for an access control bypass on file receipts

How to install idor-testing

1claude-code-templates

npx claude-code-templates@latest --skill security/idor-testing

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill idor-testing -a claude-code

3Manually: put the files in place

~/.claude/skills/idor-testing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/idor-testing/

Manually: put the files in place

.agents/skills/idor-testing/SKILL.md

For all projects use ~/.agents/skills/

Manually: put the files in place

.cursor/skills/idor-testing/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install davila7/claude-code-templates idor-testing

2Manually: put the files in place

.github/skills/idor-testing/SKILL.md

Platform CLI

gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/idor-testing

Manually: put the files in place

.devin/skills/idor-testing/SKILL.md

The legacy .windsurf/skills/ path still works

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about idor-testing

How to install idor-testing in Claude Code?

Run npx claude-code-templates@latest --skill security/idor-testing in your terminal.

What does idor-testing do?

It outlines inspection steps for parameters, static paths, and payload manipulations to verify that user access controls hold.

What prerequisites are needed for IDOR testing?

You need written testing consent, an interception proxy such as Burp Suite, and at least two active user accounts to test data isolation.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set804

The whole set →

svelte-test-coverage Analyzes test coverage in Svelte and SvelteKit projects, flags untested code paths, and builds a prioritized testing plan. 124installs svelte-test This command creates tests for Svelte components and SvelteKit routes, from component behavior to end-to-end flows. Use it to cover user actions, form handling, and error states. 124installs data-processing-nemo-curator Instructs Claude Code on creating data preparation pipelines for neural network training using NVIDIA NeMo Curator on GPUs. 123installs sync-linear-to-issues Transfers Linear tasks to GitHub issues with state mapping, attachment migration, and comment sync. Useful when consolidating project tracking into GitHub. 123installs distributed-training-pytorch-lightning Refactors standard PyTorch loops into LightningModule structures and manages multi-GPU execution using DDP, FSDP, or DeepSpeed. 122installs sync-pr-to-task Connects GitHub pull requests with Linear tasks and syncs task state. Use it to keep PR details and task updates together. 122installs api-security-testing A skill that walks the agent through seven phases of API security work, from endpoint discovery to error handling. Useful when you need to probe an API for holes. 121installs github-workflow-automation A skill with ready-made patterns for AI-driven PR reviews, issue triage and CI/CD on GitHub. Useful when you are wiring automation into a repository. 121installs