Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users to check whether the server enforces per-object authorization.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-api-for-broken-object-level-authorizationnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-api-for-broken-object-level-authorization -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-api-for-broken-object-level-authorization -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/testing-api-for-broken-object-level-authorizationgh skill install mukul975/Anthropic-Cybersecurity-Skills testing-api-for-broken-object-level-authorizationgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/testing-api-for-broken-object-level-authorization ~/.claude/skills/testing-api-for-broken-object-level-authorization # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/testing-api-for-broken-object-level-authorization ~/.agents/skills/testing-api-for-broken-object-level-authorization # Codex, Cursor, Gemini CLI, Copilot, OpenCode