Screened · automated checks passed
hunt-csrf
What the author says it does
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.
Quoted from the skill's own SKILL.md trigger description — this is what tells
Claude when to activate it. Not yet verified by us.
Automated screening
100/100 validator score
Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.
Install (unverified — review first)
git clone https://github.com/elementalsouls/Claude-BugHunter # skill lives at: skills/hunt-csrf/SKILL.md
SkillProof status
This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.
Already tested in Crypto & Web3
- Vly Money Builds vly.money deep links for crypto sends and X402 paywalled-content redirects -- no execution, just correct URLs.
- Quicknode Skill Quicknode's own reference skill covering RPC, Streams, SQL Explorer, x402/MPP agent payments, CLI, MCP, and more.
- Wallet Security Review Structured 8-section wallet security checklist: keys, approvals, signing, phishing, opsec, multisig, incident response.
- Cosmos Vulnerability Scanner Spawns parallel Cosmos SDK / CosmWasm scanners for chain-halt and fund-loss bugs across 54 documented patterns.