csrf-testing
Provides techniques to identify and test CSRF vulnerabilities in web applications.
Install
mkdir -p .claude/skills/csrf-testing && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/6500" && unzip -o skill.zip -d .claude/skills/csrf-testing && rm skill.zipInstalls to .claude/skills/csrf-testing
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
CSRF跨站请求伪造测试的专业技能和方法论Key capabilities
- →Identify sensitive operations vulnerable to CSRF
- →Detect the presence of CSRF tokens in forms
- →Validate CSRF token effectiveness against predictability and reusability
- →Test Referer header validation for bypasses
- →Construct basic CSRF attacks using HTML forms
- →Utilize tools like Burp Suite and OWASP ZAP for CSRF testing
How it works
The skill guides through identifying sensitive actions, checking for CSRF token protection, validating token effectiveness, and testing Referer header validation.
Inputs & outputs
When to use csrf-testing
- →Identify sensitive actions like password changes
- →Test if tokens are predictable or reusable
- →Bypass Referer checks during security audits
About csrf-testing
Guides developers through identifying sensitive operations, verifying CSRF token effectiveness, and checking Referer header validation. It covers manual and automated testing of state-changing requests.
CSRF跨站请求伪造测试的专业技能和方法论
How it compares
This skill provides specific methods for CSRF token validation, Referer bypass techniques, and tool-assisted testing, which goes beyond general security testing.
Compared to similar skills
csrf-testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| csrf-testing (this skill) | 1 | 7mo | Review | Intermediate |
| security-requirement-extraction | 7 | 2mo | No flags | Intermediate |
| api-fuzzing-for-bug-bounty | 9 | 6mo | Review | Advanced |
| secure-workflow-guide | 3 | 2mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Ed1s0nZ
View all by Ed1s0nZ →You might also like
security-requirement-extraction
wshobson
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
api-fuzzing-for-bug-bounty
davila7
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
secure-workflow-guide
trailofbits
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
cross-site-scripting-and-html-injection-testing
davila7
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
defense-in-depth-validation
mrgoonie
Validate at every layer data passes through to make bugs impossible
semgrep-rule-creator
trailofbits
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.