sast-idor

Identify and map IDOR vulnerabilities in REST or GraphQL endpoints.

1.3k|61|Updated Mar 30, 2026

Search Tags:#authorization #vulnerability #api #web-security #code-analysis #pentest #idor

Ready to run

npx skills add https://github.com/utkusen/sast-skills --skill sast-idor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-idor
Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-idor
Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-idor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect Insecure Direct Object Reference (IDOR) vulnerabilities in codebases by tracing how user-supplied identifiers are used to access resources and confirming proper authorization checks.

Core Features & Use Cases

Three-phase workflow: recon (find candidates), batched verify (authorization checks in parallel batches of 3), and merge (consolidation of results).
Artifact generation: writes findings to sast/idor-recon.md and sast/idor-results.md, and creates batch results at sast/idor-batch-*.md for each verification batch.
Prerequisite awareness: requires sast/architecture.md to exist and for the analysis phase to run first.

Quick Start

Initiate the IDOR analysis workflow on a codebase to begin recon and verification.

Frequently Asked Questions about sast-idor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect IDOR vulnerabilities in a REST API codebase?▼

This Skill identifies IDOR vulnerabilities in REST or GraphQL endpoints by analyzing how user-supplied identifiers access resources and verifying authorization checks through a three-phase recon, batched verify, and merge workflow.

What is the best way to find insecure direct object reference issues during a code analysis pentest?▼

Finding insecure direct object reference issues during a code analysis pentest involves mapping endpoints that use user-supplied identifiers to access resources and running batched authorization verification to generate structured IDOR findings.

Does this IDOR detection workflow work with GraphQL endpoints?▼

Yes, this IDOR detection workflow supports GraphQL endpoints. It analyzes both REST and GraphQL codebases to trace user-supplied identifiers accessing resources and confirm the presence of proper authorization checks.

Do I need to run architecture analysis before detecting IDOR vulnerabilities?▼

Yes, you need to run architecture analysis first. The workflow requires sast/architecture.md to exist and for the architecture analysis phase to run first before initiating IDOR recon and verification.

What output files are generated when mapping IDOR vulnerabilities?▼

Mapping IDOR vulnerabilities generates sast/idor-recon.md for initial candidates, sast/idor-batch-*.md files for each verification batch, and sast/idor-results.md containing structured findings and remediation guidance.