graphql-idor

What problem does it solve?

This Skill helps you detect GraphQL authorization failures where a user can access or mutate data they don’t own, including IDOR-style horizontal privilege escalation and risky client-controlled arguments.

Core Features & Use Cases

• Introspection probing to learn the available schema and operations while respecting the workflow’s guardrails.
• Authentication boundary testing to compare unauthenticated, baseline authorized, and cross-user access behavior for queries and mutations.
• Client-controlled ID argument checks to validate whether parameters like userId or resource IDs are properly constrained server-side.
• Batch enumeration checks to determine whether a single query leaks data across users.
• Unauthed mutation attempts to catch overly permissive mutation endpoints.

Quick Start

Run the graphql-idor skill against your in-scope GraphQL endpoint (or a path to your recon/target directory) and provide any required Authorization Bearer header so it can test authorization boundaries and validate suspected IDOR behavior.