hunt-csrf

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable payloads, clear sequenced workflows, and strong validation checkpoints (Gate 0, hunting checklists). It loses points on conciseness due to cross-section redundancy and on progressive disclosure because everything lives in one large file with no external references despite the volume of material.

Suggestions

De-duplicate the token omission/substitution techniques and the text/plain JSON-CSRF description so each appears once (e.g. consolidate into 'Bypass Techniques' and reference it from the testing flow).

Move the 'Disclosed Report Citations' and 'Duende BFF' deep-dive sections into referenced files under references/ and link to them one level deep, keeping SKILL.md a lean overview.

Trim or collapse the 'Common Root Causes' section, which restates bypass techniques already covered in 'Bypass Techniques'.

Dimension	Reasoning	Score
Conciseness	The body is dense with high-signal, novel content (raw-HTTP-client shortcut, Duende BFF antiforgery primer) but is long (~365 lines) and repeats patterns across sections — e.g. token omission/substitution appears in both 'Autonomous Testing Priority' and 'Step-by-Step Hunting Methodology', and the text/plain JSON-CSRF technique is described three times. Tightening the redundancy would move it to the top anchor.	2 / 3
Actionability	Provides concrete, executable payloads and commands throughout — curl one-liners, grep patterns, copy-paste HTML PoCs (form POST, text/plain JSON CSRF), and specific fetch() payloads (e.g. the Argo CD and Duende BFF admin-replay fetch calls). Examples are complete and copy-paste ready.	3 / 3
Workflow Clarity	Multi-step processes are clearly sequenced with validation checkpoints: the 'Autonomous Testing Priority' testing flow (GET baseline → POST without token → 2xx confirms CSRF), the 'Gate 0 Validation' checklist, and the Duende BFF 'Hunting checklist' all provide explicit validate/confirm steps and feedback loops for these destructive/batch operations.	3 / 3
Progressive Disclosure	The skill is a single monolithic SKILL.md with no bundle files in references/scripts/assets and no one-level-deep references to split material out; the body itself could offload the long report-citation and Duende-BFF-primer sections into referenced files. Organization via clear headers is good, but content that should be separate is inline.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and clearly niched to modern CSRF hunting with chain-to-ATO emphasis. It uses appropriate third-person voice and includes an explicit 'Use when' trigger clause, hitting the top anchor on all dimensions.

Dimension	Reasoning	Score
Specificity	Lists many concrete, named vulnerability patterns and specific real-world cases (e.g. 'SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424)', 'GraphQL mutations-via-GET (GitLab $3,370)', 'JSON-CSRF via text/plain on email-change'), which are concrete actions/variants rather than vague claims.	3 / 3
Completeness	Explicitly answers what ('Hunting skill for csrf vulnerabilities... heavy emphasis on chain-to-ATO patterns') and when ('Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns'), satisfying both clauses with an explicit trigger.	3 / 3
Trigger Term Quality	Uses natural terms a hunter would actually say — 'csrf', 'hunting modern CSRF', 'chain-to-ATO patterns', 'SameSite', 'WebSocket CSRF / CSWSH' — with good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (CSRF vulnerability hunting with modern SameSite-era chain-to-ATO focus) unlikely to conflict with sibling skills like hunt-xss or hunt-oauth, which are separately referenced in the body.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-csrf/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.