{"slug":"encod3d-sec-hunt-idor","source_name":"encod3d-sec/hunt-idor","name":"Encod3d Sec/Hunt Idor","description":"IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and delete operations. Bounded ID sampling, never range sweeps. Wiki-first, FIND schema output. Trigger on IDOR, BOLA, broken access control, object level authorization, cross-tenant, \"read another user's data\", \"swap the id\", or any API path or parameter carrying a numeric ID, UUID, or account identifier.","version":1,"lift":{"pass_rate_delta_pts":18.18,"pass_rate_pct":81.8,"total_cases":22,"passed_cases":18,"tokens_delta_pct":87.1,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-10-10T22:10:29.307499+00:00"},"skill_score":0.8182,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":18.18,"with_pass_pct":81.8,"without_pass_pct":63.6,"tokens_delta_pct":87.1,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-10-10T22:10:29.307499+00:00","run_id":"24a2583b-4679-43bf-a28c-eb80ec0bf954","latest_attempt":{"id":"24a2583b-4679-43bf-a28c-eb80ec0bf954","runner_model":"gemini-3.6-flash","overall_verdict":"mixed","completed_at":"2026-10-10T22:10:29.307499+00:00","gate":null},"version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"total_uses":0,"total_users":0,"manifest_hash":"1e7f3225bf1a3ab9f16145bf57254e4a7303c6ccf3e027eb8435513dcc5a59cc","raw_url":"https://app.decimal.ai/s/encod3d-sec-hunt-idor/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/encod3d-sec-hunt-idor"}