hunt-csrf

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced hunting guide with excellent concrete payloads and validation gates. Its main weaknesses are verbosity from explaining known concepts and a monolithic structure that inlines reference material instead of splitting it across files.

Suggestions

Split the Disclosed Report Citations, Real Impact Examples, and Duende BFF deep-dive into separate reference files (e.g. references/citations.md, references/duende-bff.md) linked one level deep from SKILL.md to improve progressive disclosure.

Trim concept explanations Claude already knows — SameSite=Lax mechanics, OAuth/SAML RelayState basics, and the BFF architecture primer — keeping only the attack-specific insight.

Condense the three narrative Real Impact Examples into terse one-line summaries that point to the payload/root-cause already shown elsewhere, removing redundant storytelling prose.

Dimension	Reasoning	Score
Conciseness	The actionable core (payloads, grep patterns, methodology) is lean and high-value, but sizable sections explain concepts Claude already knows — SameSite mechanics, OAuth/SAML RelayState basics, the Duende BFF architecture primer — plus narrative scenario and citation prose that could be trimmed.	3 / 5
Actionability	Provides copy-paste-ready, executable artifacts across common cases: HTML PoCs for form POST and text/plain JSON CSRF, curl token-omission/reuse scripts, grep recon patterns, and a Grafana version-check command.	5 / 5
Workflow Clarity	Clear numbered sequences ("Testing flow", 10-step methodology, Duende hunting checklist) with explicit validation gates (2xx confirmation, Gate 0 reproducibility check), though explicit validate→fix→retry feedback loops are less developed than the top anchor.	4 / 5
Progressive Disclosure	Good in-file section structure via headers, but the skill is monolithic (~368 lines) with no bundle files; clearly separable reference material (5 disclosed citations, 3 real-impact scenarios, the Duende BFF deep-dive) is inlined rather than split into one-level-deep reference files.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete CVE-anchored CSRF variants and gives an explicit trigger clause. Its only weakness is keyword synonym coverage, which keeps trigger_term_quality below the top anchor.

Suggestions

Add the spelled-out term "cross-site request forgery" and the synonym "XSRF" alongside "CSRF" so the description matches a wider range of natural phrasings.

Surface "CSWSH" / "cross-site WebSocket hijacking" as a standalone trigger keyword since WebSocket CSRF is a named variant but the acronym only appears buried in the variant list.

Consider adding "account takeover" / "ATO" as an explicit trigger since the chain-to-ATO framing is the skill's distinguishing hook.

Dimension	Reasoning	Score
Specificity	Enumerates ~10 concrete CSRF variant actions ("SameSite=Lax sibling-subdomain bypass", "GraphQL mutations-via-GET", "path-traversal CSRF-token bypass", "JSON-CSRF via text/plain"), giving comprehensive coverage of the domain rather than vague language.	5 / 5
Completeness	Explicitly answers both what ("Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports..." with named variants) and when ("Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns"), with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Includes natural terms ("csrf vulnerabilities", "hunting modern CSRF", "Use when hunting modern CSRF") but lacks common synonyms such as the spelled-out "cross-site request forgery" and "XSRF", so coverage is good rather than comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (modern CSRF hunting) with distinct, CVE-anchored triggers and a chain-to-ATO focus, minimizing overlap with sibling XSS/OAuth hunting skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-csrf/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.