Api Authorization And Bola
- 2.3k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
api-authorization-and-bola is an agent skill that >-.
About
SKILL API Authorization and BOLA Object Access Function Access and Mass Assignment AI LOAD INSTRUCTION Use this skill when an API exposes object IDs nested resources or role sensitive functions and you need a focused authorization test path BOLA BFLA method abuse and hidden field control 1 Create Account A and Account B 2 As Account A capture create read update and delete flows 3 Replay with Account B s token 4 Test sibling endpoints nested endpoints and alternate HTTP verbs Surface Example object read api v1 orders 123 nested object api v1 users 1 invoices 9 admin or internal function api v1 admin users update path PUT PATCH DELETE variants hidden JSON fields role org verified tier json role admin isAdmin true org target company verified true The api authorization and bola agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard
- API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable
- > **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions
- 2. As Account A, capture create, read, update, and delete flows.
- Follow api-authorization-and-bola SKILL.md steps and documented constraints.
- Follow api-authorization-and-bola SKILL.md steps and documented constraints.
Api Authorization And Bola by the numbers
- 2,346 all-time installs (skills.sh)
- +142 installs in the week ending Aug 4, 2026 (Skillselion tracking)
- Ranked #413 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
api-authorization-and-bola capabilities & compatibility
- Capabilities
- api authorization and bola testing playbook. use · > **ai load instruction**: use this skill when a · 2. as account a, capture create, read, update, a · follow api authorization and bola skill.md steps
- Use cases
- orchestration
What api-authorization-and-bola says it does
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hi
2. As Account A, capture create, read, update, and delete flows.
npx skills add https://github.com/yaklang/hack-skills --skill api-authorization-and-bolaAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.3k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 2 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
When should an agent use api-authorization-and-bola and what problem does it solve?
>-
Who is it for?
Developers invoking api-authorization-and-bola as documented in the skill source.
Skip if: Skip when requirements fall outside api-authorization-and-bola documented scope.
When should I use this skill?
>-
What you get
Outputs aligned with the api-authorization-and-bola SKILL.md workflow and stated deliverables.
- Authorization test log
- BOLA or BFLA findings
- Mass assignment evidence
Files
SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
1. CORE TEST LOOP
1. Create Account A and Account B. 2. As Account A, capture create, read, update, and delete flows. 3. Replay with Account B's token. 4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
2. TEST SURFACES
| Surface | Example |
|---|---|
| object read | /api/v1/orders/123 |
| nested object | /api/v1/users/1/invoices/9 |
| admin or internal function | /api/v1/admin/users |
| update path | PUT, PATCH, DELETE variants |
| hidden JSON fields | role, org, verified, tier |
3. QUICK PAYLOADS
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}4. WHAT TESTERS MISS
- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields
5. NEXT ROUTING
- For JWT or token-layer abuse: api auth and jwt abuse
- For GraphQL and hidden parameter discovery: graphql and hidden parameters
- For broader IDOR patterns outside APIs: idor broken object authorization
Related skills
Setup Matt Pocock SkillsScaffold the per-repo configuration that Matt Pocock’s engineering agent skills rely on so they understand the issue tracker, triage labels, and domain documentation la495k196k
Lark AppsConnect Claude, Cursor or custom agents directly to Lark (Feishu) for messaging, document automation, approval workflows and enterprise data access.402k
CavemanSlash token usage by roughly 75% while keeping every technical detail intact when working with Claude Code, Cursor or similar agents.391k94.7k
Lark Skill MakerQuickly turn any Lark/Feishu OpenAPI call or multi-step workflow into a reusable agent skill with its own SKILL.md.386k16k
Running Claude Code Via Litellm CopilotRun Claude Code at a fraction of the cost by routing requests through LiteLLM to the GitHub Copilot Chat API.270k72
Codex PetGenerate a complete Codex Pet spritesheet and metadata from one reference image without needing an OpenAI key or Codex Pro.246k10How it compares
Use after recon-for-sec when the target API surface is mapped and authorization boundaries need systematic two-account replay testing.
FAQ
What is api-authorization-and-bola?
>-
When should I use api-authorization-and-bola?
>-
Is api-authorization-and-bola safe to install?
Review the Security Audits panel on this page before production use.