What problem does it solve? APIs often enforce authorization on read operations (GET) while leaving write operations (PATCH, POST, DELETE) unprotected, allowing authenticated users to escalate privileges, modify balances, or tamper with other users' data. This Skill systematically detects these write-gap vulnerabilities during authorized penetration tests. ## Core Features & Use Cases - Writeable Endpoint Discovery: Probes discovered endpoints with PATCH, PUT, and POST methods to identify which accept write operations based on HTTP status codes. - Privilege Escalation Testing: Attempts to modify privileged fields such as tier, role, balance, subscription status, and rate limits to confirm authorization gaps. - Cross-User Write (IDOR) Detection: Tests whether write filters targeting other users' records succeed, distinguishing self-write issues from critical mass-exploitation flaws. - Use Case: During an authorized assessment of a Supabase-backed SaaS application, you confirm GET /subscribers only returns your own data, then use this Skill to discover PATCH /subscribers lets you upgrade your account to a Pro tier without payment. ## Quick Start Ask the agent to test the target API endpoints for write-gap vulnerabilities using your authenticated token and report any unauthorized modification of privileged fields.
