idor-test SKILL.md skillA
idor-test from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/idor-test@git:20260914.819e838Pins git:20260914.819e838 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
skills/idor_test/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260914.819e838, committed Sep 14, 2026
- Size
- 1,317 bytes
- Repository stars
- 14
- License
- none declared
Test object- and function-level authorization when identifiers, tenants, ownership fields, or nested resources may cross an access boundary.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# IDOR Test ## Goal 建立主体—对象—动作矩阵，判断可控标识符能否造成跨用户、跨租户或跨角色的数据访问与敏感操作。 ## Tools / Inputs - 两个测试账号、对象 ID、tenant/org/user 字段、列表与详情接口、角色差异 - 资源索引：`references/INDEX.md`；候选资源：`authorization-idor-testing.md`、`response-chaining.md` ## Constraints 1. 优先只读差分；写操作只使用自建且可回滚的测试对象。 2. 不批量枚举真实用户对象。 3. HTTP 200 不是结论，必须证明返回或执行了不属于当前主体的内容。 4. 同时检查对象级、字段级、函数级和租户级边界。 5. 新 ID 与关系字段回写值池，供相关端点复测。 ## Chain Questions - 授权绑定的是路径 ID、body 字段、token claim 还是服务端关系？ - 列表、详情、附件、导出和写接口是否使用同一边界？ - 一个泄露对象能否解锁子资源、令牌、文件或管理动作？ - 当前证据跨越了哪一个明确的主体或租户边界？
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/idor-test@sha256:fae4a688ea538783The line at the top of this page pins the label git:20260914.819e838, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ajdtfypqhh24pzex)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 14, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1317 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_ajdtfypqhh24pzex GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/idor-test GET https://markdownregistry.com/api/v1/blob/fae4a688ea53878364691f8db59796f6536a009287dc2b91e19c636647fc4de5
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.