idor-broken-object-authorization

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The playbook explicitly instructs capturing and replaying requests using session tokens and demonstrates extracting auth tokens/password fields, which requires including secret values verbatim in requests or outputs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit attacker playbook teaching how to discover and exploit authorization flaws (IDOR/BOLA/BFLA), including techniques for credential/token exfiltration and privilege escalation.