hunt-clickjacking

Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An action-dense, well-structured hunting guide with executable commands, a ready PoC, and a gated two-step workflow; its only real weakness is the conceptual framing prose that could be trimmed for token efficiency.

Suggestions

Condense or remove the 'What is Clickjacking' paragraph — Claude already knows the mechanism; keep only the highest-value-target framing.

Tighten the 'Protection Headers' section to the reference table plus the single 'If NEITHER is present, the page is frameable' rule, dropping the explanatory lead-in.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean and actionable, but the 'What is Clickjacking' paragraph and the explanatory prose in 'Protection Headers' restate a concept Claude already knows, so it is not the lean level-3 case; it avoids the padded level-1 example by being far more efficient.	2 / 3
Actionability	Provides fully executable guidance — the copy-paste curl one-liner and a complete iframe PoC HTML block, plus a concrete checklist (SameSite=Lax/Strict, framebusting JS, state-changing action) — matching the 'fully executable code/commands; copy-paste ready' anchor.	3 / 3
Workflow Clarity	A clear two-step sequence (header screening, then prove framing) with an explicit validation checkpoint ('If either is present and restrictive... stop — it's protected') and an 'or it is not exploitable' gate, matching the 'clear sequence with explicit validation steps' anchor.	3 / 3
Progressive Disclosure	No bundle files are present and the skill is self-contained with well-organized sections (What is, Protection Headers, How to Test, False Positives, Proof Requirements) and no nested references, which the rubric scores 3 for a small single-purpose skill with no need for external references.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with excellent distinctiveness and concrete actions, weakened only by the absence of an explicit 'Use when...' invocation trigger. The 'Targets:' scoping line substitutes for, but does not fully satisfy, that trigger guidance.

Suggestions

Add an explicit trigger clause such as 'Use when testing web apps for clickjacking/UI redressing or when the user asks about framing, X-Frame-Options, or CSP frame-ancestors.'

Reframe the 'Targets:' line as a use-when condition rather than just a target list so the 'when to invoke' half of completeness is explicit.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'fetching the page', 'PROVE it frames in a real browser', and verifying 'a sensitive state-changing action survives the cross-site context' — matching the 'lists multiple specific concrete actions' anchor rather than the single-domain level 2.	3 / 3
Completeness	It clearly states what the skill does, but 'when to invoke it' is only implied via the 'Targets: login flows, money transfers...' line rather than an explicit 'Use when...' trigger, so per the cap guideline it does not reach level 3; it is above level 1 because both what and a scoping signal are present.	2 / 3
Trigger Term Quality	Includes the natural user terms 'Clickjacking' and 'UI redressing' alongside relevant technical tokens ('X-Frame-Options', 'CSP frame-ancestors', 'SameSite cookies'), giving good coverage of phrases a user would actually say; not merely jargon-only like the level-1 example.	3 / 3
Distinctiveness Conflict Risk	The 'Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors' framing carves a clear, narrow niche that is unlikely to collide with other skills, matching the 'clear niche with distinct triggers' anchor.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-clickjacking/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.