How do I install the API Mass Assignment skill?

Run npx skillmds@latest add noorqureshi/api-mass-assignment in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Mass Assignment safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Mass Assignment?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Mass Assignment free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Mass Assignment?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Mass Assignment by noorqureshi — Agent Skill

Name: API Mass Assignment
Author: NoorQureshi

API Mass Assignment

Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.

NoorQureshi b28e6eb 2.1 KB Updated Sep 17, 2026

File contents

Mass assignment (BOPLA)

When it applies

An endpoint deserializes client JSON straight into a data object without an allowlist of writable fields. You add sensitive properties the developer never meant to be client-writable.

Why it works

Frameworks that auto-bind request bodies to models will set any matching attribute unless explicitly restricted. If role, isAdmin, account_balance, email_verified, or user_id are bindable, you set them by just including them in the body.

Method

Learn the object shape: read a GET response for the object — every returned field is a candidate writable property. Also mine JS, mobile apps, and API docs for hidden fields.
Inject sensitive fields into create/update requests: {"username":"x","password":"y","role":"admin"} or "isAdmin":true, "verified":true, "balance":999999, "user_id":<victim>.
Guess conventions when fields aren't leaked: is_admin, admin, roleId, groups, permissions, account_type, tenant_id — try nested objects too ({"role":{"id":1}}).
Chain: set user_id/owner_id to a victim to combine with IDOR, or flip verified to skip email/2FA gates.

Gotchas

Extra fields silently ignored ≠ safe — confirm by reading the object back for your change.
Some frameworks need the exact case/nesting; mirror the GET response structure.
The writable field may only take effect on a specific endpoint/verb (create vs update).

Verify success

A privileged attribute you supplied is persisted — re-fetch the object and see role:admin, verified:true, or the elevated value reflected, and confirm the new capability works.

References

OWASP API Security Top 10 (2023) API3; framework strong-params/allowlist docs.

---name: api-mass-assignmentdescription: Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.---# Mass assignment (BOPLA)## When it appliesAn endpoint deserializes client JSON straight into a data object without an allowlist ofwritable fields. You add sensitive properties the developer never meant to be client-writable.## Why it worksFrameworks that auto-bind request bodies to models will set *any* matching attribute unlessexplicitly restricted. If `role`, `isAdmin`, `account_balance`, `email_verified`, or`user_id` are bindable, you set them by just including them in the body.## Method1. **Learn the object shape**: read a GET response for the object — every returned field is a candidate writable property. Also mine JS, mobile apps, and API docs for hidden fields.2. **Inject sensitive fields** into create/update requests: `{"username":"x","password":"y","role":"admin"}` or `"isAdmin":true`, `"verified":true`, `"balance":999999`, `"user_id":<victim>`.3. **Guess conventions** when fields aren't leaked: `is_admin`, `admin`, `roleId`, `groups`, `permissions`, `account_type`, `tenant_id` — try nested objects too (`{"role":{"id":1}}`).4. **Chain**: set `user_id`/`owner_id` to a victim to combine with IDOR, or flip `verified` to skip email/2FA gates.## Gotchas- Extra fields silently ignored ≠ safe — confirm by reading the object back for your change.- Some frameworks need the exact case/nesting; mirror the GET response structure.- The writable field may only take effect on a specific endpoint/verb (create vs update).## Verify successA privileged attribute you supplied is persisted — re-fetch the object and see `role:admin`,`verified:true`, or the elevated value reflected, and confirm the new capability works.## ReferencesOWASP API Security Top 10 (2023) API3; framework strong-params/allowlist docs.

Frequently asked questions