Find CSRF gaps in your web app's defenses.
What it does
Guides security testing of web flows to identify CSRF weaknesses and protection bypasses.
When to use it
Use when reviewing state-changing web flows, anti-CSRF protections, SameSite behavior, JSON or login CSRF, and OAuth state handling.
How to use it
Give it a web flow to review; it checks CSRF defenses and identifies bypass conditions.
What you provide
- the web flow to review
What you need · 2
Instructs the agent to also load this skill when JSON endpoints become readable cross-origin; whether completing the workflow requires it is unstated.
Instructs the agent to also load this skill when login, account linking, or callback binding relies on OAuth state; whether completing the workflow requires it is unstated.
Access · 1
This skill
the target web application
Sends modified requests to your app