csrf

Cross-Site Request Forgery — missing/invalid tokens, method override, JSON CSRF, SameSite gaps, double-submit flaws, login/logout CSRF, and CSRF-via-XSS chains to account takeover.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, executable, well-sequenced security playbook with a validating decision gate; its main weakness is that everything lives in one monolithic file with no progressive disclosure of detail into bundle files.

Suggestions

Split the bypass/misconfig matrix and exploit PoCs into references/ files (e.g. BYPASSES.md, POC.md) referenced one level deep from the overview.

Replace the bare `finding-protocol` mention with an explicit one-level link so navigation is unambiguous.

Dimension	Reasoning	Score
Conciseness	Lean playbook that assumes Claude's knowledge — no padding explaining what CSRF or cookies are; dense tables and code blocks where every token earns its place.	3 / 3
Actionability	Copy-paste-ready curl probes, auto-submit HTML/JS PoCs, and concrete tool invocations ('xsrfprobe -u https://<TARGET>') give fully executable guidance.	3 / 3
Workflow Clarity	Clear sequence (Detection → Bypass matrix → Exploit → Chains → Tools → OPSEC) capped by a Decision Gate checklist that validates findings before escalation, providing an explicit checkpoint.	3 / 3
Progressive Disclosure	Well-sectioned but monolithic: bypass matrix, PoCs, and signatures are all inline in one file with no bundle references or split-out detail files, fitting the 'content that should be separate is inline' anchor.	2 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive with strong natural trigger terms, but it omits an explicit 'Use when...' invocation clause, leaving the when-to-use intent only implied.

Suggestions

Append an explicit trigger clause, e.g. 'Use when auditing web endpoints for CSRF/XSRF, SameSite gaps, token-binding flaws, or account-takeover chains.'

Add common synonyms like 'XSRF' and 'anti-CSRF token' to broaden natural-language recall.

Dimension	Reasoning	Score
Specificity	Enumerates many concrete attack classes — 'missing/invalid tokens, method override, JSON CSRF, SameSite gaps, double-submit flaws, login/logout CSRF, and CSRF-via-XSS chains to account takeover' — rather than vague language.	3 / 3
Completeness	Clearly states what the skill covers, but lacks a 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 2 per the rubric.	2 / 3
Trigger Term Quality	Uses natural terms a user would say ('Cross-Site Request Forgery', 'CSRF', 'SameSite', 'tokens', 'account takeover') with good coverage across the attack surface.	3 / 3
Distinctiveness Conflict Risk	A narrow, well-defined CSRF niche with distinct trigger terms; unlikely to be confused with unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/csrf/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.